Subject: AW: [NSIS] Query & Diagnosis Capabilities in NATFW NSLP

From: "Tschofenig, Hannes" <[email-masked]>
Date: Tue, 18 Oct 2005 00:21:16 +0200

hi martin, 

the discussions at the interim meeting indeed questioned the usefulness of a scenario where the end host fetches state information from the firewall after the end host crashed. my impression was also that this scenario is not particularly good. 

in gabor's draft (see <draft-bajko-nsis-fw-reqs-02.txt) the need for a 'firewall feature discovery' was mentioned. i documented this requirement as issue#45 (see https://kobe.netlab.nec.de/roundup/nsis-natfw-nslp/issue45). i wonder whether the query functionality isn't actually go into this direction. 

ciao
hannes

-----Ursprüngliche Nachricht-----
Von: [email-masked] [mailto:[email-masked]] Im Auftrag von Hancock, Robert
Gesendet: Montag, 17. Oktober 2005 23:58
An: [email-masked]; [email-masked]; [email-masked]
Betreff: RE: [NSIS] Query & Diagnosis Capabilities in NATFW NSLP

hi all, 
IIRC there were two aspects of this topic discussed at the 
interim: 
a) the availability of the diagnosis/query features in the 
first place, and 
b) the use of them to build some procedures for recovery from 
certain error/restart scenarios 
I don't recall much discussion of (a). I recall significant 
objections to (b) (indeed, I think I made several of them) 
because they seemed rather complicated and fragile. 
But that doesn't mean that the facilities themselves are 
not useful for - well - diagnosis (for which it's hard to 
build reasonable scenarios other than "something went wrong 
and I'd like to work out what"). 
It is possible to go overboard on diagnostics but I don't 
think we're there yet. 
r. 
> -----Original Message----- 
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of [email-masked] 
> Sent: 14 October 2005 08:09 
> To: [email-masked]; [email-masked] 
> Subject: RE: [NSIS] Query & Diagnosis Capabilities in NATFW NSLP 
> 
> 
> Hi Martin, 
> 
> >Draft -07 of the NATFW NSLP describes a query and diagnosis 
> >capability in Section 3.3.6. These capabilities have been in 
> >the draft for while but no real usage scenarios have been 
> >described so far (see issue 30 in the tracker 
> ><https://kobe.netlab.nec.de/roundup/nsis-natfw-nslp/issue30>). 
> > 
> >The general feeling of the WG about these query and diagnosis 
> >capabilities were quite mixed (as expressed during the last 
> >interim in Munich). Since then I have not received any further 
> >comments about this issue. 
> > 
> >Personally, I do not see any good use cases for such a 
> >capability in the NATFW NSLP and I'm in favour of removing it 
> >completely. 
> > 
> >I'm soliciting the WG to give feedback on this issue, whether 
> >it is considered a useful feature or not. If you consider it a 
> >useful feature, you should give some use cases. 
> 
> I am leaning towards dropping this feature.  I think that this is 
> extra functionality without defined use - this will make the 
> implementatino & usage more difficult. 
> 
> John 
> 
> _______________________________________________ 
> nsis mailing list 
> [email-masked] 
> https://www1.ietf.org/mailman/listinfo/nsis 
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Martin Stiemerling <[email-masked]>
Date: Wed, 19 Oct 2005 10:43:26 +0200

--On Dienstag, 18. Oktober 2005 0:21 Uhr +0200 "Tschofenig, Hannes" 
<[email-masked]> wrote:

| hi martin,
|
| the discussions at the interim meeting indeed questioned the usefulness
| of a scenario where the end host fetches state information from the
| firewall after the end host crashed. my impression was also that this
| scenario is not particularly good.

I see it the same way. The end host crash scenario is most probably not
applicable since the node would need to figure out its old used
session IDs to fetch further information.

|
| in gabor's draft (see <draft-bajko-nsis-fw-reqs-02.txt) the need for a
| 'firewall feature discovery' was mentioned. i documented this requirement
| as issue#45 (see
| https://kobe.netlab.nec.de/roundup/nsis-natfw-nslp/issue45). i wonder
| whether the query functionality isn't actually go into this direction.

Yes, this is an issue, but is not related to the envisioned Query
capabilities. I would like to handle this independently.

Regards,

  Martin

|
| ciao
| hannes
|
| -----Ursprüngliche Nachricht-----
| Von: [email-masked] [mailto:[email-masked]] Im Auftrag von
| Hancock, Robert Gesendet: Montag, 17. Oktober 2005 23:58
| An: [email-masked]; [email-masked]; [email-masked]
| Betreff: RE: [NSIS] Query & Diagnosis Capabilities in NATFW NSLP
|
|
| hi all,
| IIRC there were two aspects of this topic discussed at the
| interim:
| a) the availability of the diagnosis/query features in the
| first place, and
| b) the use of them to build some procedures for recovery from
| certain error/restart scenarios
| I don't recall much discussion of (a). I recall significant
| objections to (b) (indeed, I think I made several of them)
| because they seemed rather complicated and fragile.
| But that doesn't mean that the facilities themselves are
| not useful for - well - diagnosis (for which it's hard to
| build reasonable scenarios other than "something went wrong
| and I'd like to work out what").
| It is possible to go overboard on diagnostics but I don't
| think we're there yet.
| r.
|> -----Original Message-----
|> From: [email-masked] [mailto:[email-masked]] On
|> Behalf Of [email-masked]
|> Sent: 14 October 2005 08:09
|> To: [email-masked]; [email-masked]
|> Subject: RE: [NSIS] Query & Diagnosis Capabilities in NATFW NSLP
|>
|>
|> Hi Martin,
|>
|> > Draft -07 of the NATFW NSLP describes a query and diagnosis
|> > capability in Section 3.3.6. These capabilities have been in
|> > the draft for while but no real usage scenarios have been
|> > described so far (see issue 30 in the tracker
|> > <https://kobe.netlab.nec.de/roundup/nsis-natfw-nslp/issue30>).
|> >
|> > The general feeling of the WG about these query and diagnosis
|> > capabilities were quite mixed (as expressed during the last
|> > interim in Munich). Since then I have not received any further
|> > comments about this issue.
|> >
|> > Personally, I do not see any good use cases for such a
|> > capability in the NATFW NSLP and I'm in favour of removing it
|> > completely.
|> >
|> > I'm soliciting the WG to give feedback on this issue, whether
|> > it is considered a useful feature or not. If you consider it a
|> > useful feature, you should give some use cases.
|>
|> I am leaning towards dropping this feature.  I think that this is
|> extra functionality without defined use - this will make the
|> implementatino & usage more difficult.
|>
|> John
|>
|> _______________________________________________
|> nsis mailing list
|> [email-masked]
|> https://www1.ietf.org/mailman/listinfo/nsis
|>