Subject: [NSIS] draft-ietf-nsis-nslp-natfw-01

From: [email-masked]
Date: Fri, 20 Feb 2004 14:02:11 -0600

Hello,

I read the NAT/Firewall NSIS Signaling Layer Protocol (NSLP) (draft-ietf-nsis-nslp-natfw-01) and the problems as well as the scenarios are well described.

I would have some comments:

Technical comments:

1) Looking at the Protocol Description (section 5), it is not clear if it is currently supported or not, but it would be useful if in addition to opening pinholes in the firewall, the protocol could also allow to install filters in the firewall. This would e.g. allow undesired packets to be dropped in the network, before being forwarded over the access link to the end nodes. This can more particularly be useful in access networks with limited bandwidth access links.

2) As another feature that could be useful, the node may be behind a NAT and may want to reserve a public address. However the node may not yet know the IP address of its correspondent nodes to send the NSLP request to. E.g. this could be the case when the node wants to receive incoming requests (for P2P applications, Web server, etc.). The node may also be behind a firewall, and  similarly, the node may want to open the appropriate pinholes in the firewall to accept incoming requests. So to summarize, it would be useful if the node could open pinholes in the firewall, and/or make reservation for a public IP address in a NAT without knowing the IP address of the data sender (the node may not know it yet), nor the IP address at the Application Server (there may not be any Application Server) (section 4.2.1).

3) Finally it seems that the draft requires the firewall to forward some of the messages (such as the create one) without performing any authentication on them. Such requirement may present security issues since a malicious node may send many of these messages and flood a node behind the firewall. Also this may result in an overbilling attack in access networks where data is charged by packet volume since the victim has to pay for the access link utilization (delivery of these unsolicited messages over the access link to the node).

References:

A protocol such as the NSLP could help solving some of the problems identified in draft-le-mip6-firewalls-00.txt. As a suggestion, this draft could be referred to, to complement the use cases of this protocol, and the problems/challenges this protocol could help solving (section 3)

Franck

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis