Subject: [OPSAWG] I-D Action: draft-ietf-opsawg-firewalls-00.txt

From: [email-masked]
Date: Tue, 12 Jun 2012 12:53:31 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Operations and Management Area Working Group Working Group of the IETF.

	Title           : On Firewalls in Internet Security
	Author(s)       : Fred Baker
	Filename        : draft-ietf-opsawg-firewalls-00.txt
	Pages           : 12
	Date            : 2012-06-12

Abstract:
   There is an ongoing discussion regarding the place of firewalls in
   security.  This note is intended to capture and try to make sense out
   of it.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-opsawg-firewalls

There's also a htmlized version available at:
http://tools.ietf.org/html/submission.filename }}-00

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Fred Baker <[email-masked]>
Date: Tue, 12 Jun 2012 23:00:03 -0700

In Paris, I had at least two people tell me that they would be sending me comments or would do something more substantive, earning co-author bragging rights. If they have sent them, I missed them. This is the draft that used to be draft-baker-..., except with a WG name. Comments/discussion are of interest.

On Jun 12, 2012, at 12:53 PM, <[email-masked]> <[email-masked]> wrote:

> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Melinda Shore <[email-masked]>
Date: Wed, 13 Jun 2012 10:45:55 -0800

I've taken the liberty of sending a heads-up on this to opsec.

Melinda

-------- Original Message --------
Subject: [OPSAWG] I-D Action: draft-ietf-opsawg-firewalls-00.txt
Date: Tue, 12 Jun 2012 12:53:31 -0700
From: [email-masked]
To: [email-masked]
CC: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.
  This draft is a work item of the Operations and Management Area 
Working Group Working Group of the IETF.

Abstract:

_______________________________________________
OPSAWG mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsawg

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 14 Jun 2012 09:23:41 +0100

I think this draft should mention the distributed firewalls paper
(https://www.cs.columbia.edu/~smb/papers/distfw.pdf) and discuss
the role of "personal" firewalls. They are too widespread to be
ignored.

I also think it would be useful to be explicit about the problems
caused by inconsistent firewall practices. For example, there is
the somewhat random breakage of PMTUD due to some people blocking
all ICMP, similarly random breakage of IPv6 transition due to some
people blocking protocol 41, and so on.

In the recommendations, it says

>    As further discussed in Section 2.1, firewalls of any type SHOULD NOT
>    attempt to perform the kind of deep packet inspection and surgery...

In fact I don't think section 2.1 makes the downsides of this behaviour
clear enough. There's a general presumption against innovation in
the firewall world; for example it appears that a very well known
device always discards packets containing shim6 extension headers.
Some will remember that we had a big discussion in 6man about what
firewalls might do to the IPv6 flow label. And so on. Firewalls are
actually, IMHO, a bigger obstacle to innovation than NAT - at least
we know roughly what a NAT does, but we have no idea in general what
a firewall might choose to do. Inevitably, that forces designers
to implement innovative ideas over HTTP - which just escalates the
arms race with firewall designers.

Regards
   Brian Carpenter

---

From: Fred Baker <[email-masked]>
Date: Thu, 14 Jun 2012 14:21:47 -0700

Do you have text to suggest?