Subject: [OPSAWG] RFC for Firewall communication?

From: "Yingjie Gu(yingjie)" <[email-masked]>
Date: Thu, 31 Mar 2011 10:45:49 +0000

When I presented "Dynamic Information migration" on Monday on OPSAWG session, a lady made comment that there is already a RFC defined communication "between Firewalls". I searched IETF website but failed to find the RFC. Does anybody remember what's the RFC number?

As for the other Firewall/Middlebox RFCs and IDs I found, none of them defined the communication directly between Firewalls/Middleboxes.

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Thu, 31 Mar 2011 12:52:36 +0200

Hi, 

I think this was Melinda Shore.

Thanks and Regards,

Dan 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Yingjie Gu(yingjie)
> Sent: Thursday, March 31, 2011 12:46 PM
> To: [email-masked]
> Subject: [OPSAWG] RFC for Firewall communication?
> 
> When I presented "Dynamic Information migration" on Monday on 
> OPSAWG session, a lady made comment that there is already a 
> RFC defined communication "between Firewalls". I searched 
> IETF website but failed to find the RFC. Does anybody 
> remember what's the RFC number?
> 
> As for the other Firewall/Middlebox RFCs and IDs I found, 
> none of them defined the communication directly between 
> Firewalls/Middleboxes.
> 
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg
>

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 31 Mar 2011 04:01:45 -0700

>>>>> On Thu, 31 Mar 2011 10:45:49 +0000, "Yingjie Gu(yingjie)" <[email-masked]> said:

YG> When I presented "Dynamic Information migration" on Monday on OPSAWG
YG> session, a lady made comment that there is already a RFC defined
YG> communication "between Firewalls". I searched IETF website but failed
YG> to find the RFC. Does anybody remember what's the RFC number?

YG> As for the other Firewall/Middlebox RFCs and IDs I found, none of them
YG> defined the communication directly between Firewalls/Middleboxes.

RFC5189 and 5190 I believe.
-- 
Wes Hardaker
Cobham Analytic Solutions

---

From: "Yingjie Gu(yingjie)" <[email-masked]>
Date: Thu, 31 Mar 2011 12:46:26 +0000

Sorry for the repeated post. 
Thanks for the information. I quick go through RFC5189 and RFC3303(Architecure), here is what I found.
The purpose of MIDCOM is to decouple middlebox and application, by introducing a MIDCOM agent who is application-aware and generate/delete/modify rules on middlebox by request/response mechanism. 

It's different with Dynamic Information Migration, which is from one middlebox to another. 
Put Dynamic Information Migration into MIDCOM scenario, we will find that dynamic information migration doesn't touch MIDCOM agent. 

But MIDCOM can provide some reference. 

Thanks and regards.
Yingjie Gu

________________________________________
发件人: [email-masked] [[email-masked]] 代表 Yingjie Gu(yingjie) [[email-masked]]
发送时间: 2011年3月31日 18:45
到: [email-masked]
主题: [OPSAWG] RFC for Firewall communication?

---

From: Melinda Shore <[email-masked]>
Date: Thu, 31 Mar 2011 05:45:33 -0800

> Put Dynamic Information Migration into MIDCOM scenario, we will find that dynamic information migration doesn't touch MIDCOM agent. 

It may (or may not!) be possible to reuse some or all of the
midcom MIB.  It's also worth noting that it's a pretty general
information for conveying information about resources to
middleboxes from a trusted entity and that you'd be able to
reuse substantial portions of it.  I think it's worth considering
reusing what you can because you're going to be dealing with
an extremely difficult problem that I don't believe has been
dealt with elsewhere in the IETF, which is detecting in the
network that the connection has moved and where it's moved to.
I think that's going to be a non-trivial piece of work, and new,
and you might want to think about how you're going to marshall
your volunteer resources.

Melinda

---

From: "Yingjie Gu(yingjie)" <[email-masked]>
Date: Thu, 31 Mar 2011 13:59:29 +0000

Sure, we definitely want to reuse existing protocol as much as possible. I agree with you that MIDCOM provide valuable information for future research.
And thank you very much for taking MIDCOM to our discussion :)

________________________________________
发件人: Melinda Shore [[email-masked]]
发送时间: 2011年3月31日 21:45
到: Yingjie Gu(yingjie)
Cc: [email-masked]
主题: Re: [OPSAWG] RFC for Firewall communication?

Melinda