Subject: Re: [OPSAWG] I-D Action: draft-ietf-opsawg-firewalls-00.txt

From: <[email-masked]>
Date: Thu, 5 Jul 2012 18:07:00 -0400

Hi Fred,

> In Paris, I had at least two people tell me that they would be sending me
> comments or would do something more substantive, earning co-author bragging
> rights.

Er, ah ... one of those people would be me ;-).

Here are some comments, and I do apologize for the delay caused by my day job
getting in the way of IETF work (yet again ...):

I don't have much to say about firewall functionality, but I do want to
see some discussion of the impact of server virtualization, particularly
these two aspects:

	- Protection boundaries occur inside physical servers (e.g., VMs that
		require firewall separation  may run on the same physical server).
	- Firewalls may be deployed as virtual machines (aka virtual appliances).

The overall implication is that when servers are virtualized, the network
effectively extends into servers, and one has to think about the resulting
overall network topology (including the portions in the servers) in
determining where the protection boundaries are at which perimeter security
(section 2.1) and pervasive access control (section 2.2) firewalls should be
deployed.  On a related note, the discussion of perimeter security should
acknowledge the usual security criticism of this approach - "hard and crunchy
on the outside, soft and chewy on the inside" - once an attack is inside the
perimeter, something else needs to be done for defense in depth.

The firewalls may be deployed as physical nodes, part of other network nodes,
virtual machines or a combination.  Overlay network virtualization (the new
nvo3 WG) will extend this need to consider virtual topology into the network
(beyond VLANs), making this even more "interesting".  FWIW, I'm going to
ignore the vyncke IPv6 draft that is referenced as it's targeted at home CPE
gear (e.g., the home "router" for DSL or cable modem) and I don't think server
virtualization is relevant to that sort of system.

I'm not sure where to put this new material - my initial thought is that
putting it between sections 2 and 3 might fit the overall structure and flow
of the draft, as this expands the applicability of the discussion in section
3. 

Thanks,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Fred Baker
> Sent: Wednesday, June 13, 2012 2:00 AM
> To: [email-masked]
> Subject: Re: [OPSAWG] I-D Action: draft-ietf-opsawg-firewalls-00.txt
> 
> In Paris, I had at least two people tell me that they would be sending me
> comments or would do something more substantive, earning co-author bragging
> rights. If they have sent them, I missed them. This is the draft that used to
> be draft-baker-..., except with a WG name. Comments/discussion are of
> interest.
> 
> On Jun 12, 2012, at 12:53 PM, <[email-masked]> <internet-
> [email-masked]> wrote:
> 
> >
> > A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> > This draft is a work item of the Operations and Management Area Working
> Group Working Group of the IETF.
> >
> > 	Title           : On Firewalls in Internet Security
> > 	Author(s)       : Fred Baker
> > 	Filename        : draft-ietf-opsawg-firewalls-00.txt
> > 	Pages           : 12
> > 	Date            : 2012-06-12
> >
> > Abstract:
> >   There is an ongoing discussion regarding the place of firewalls in
> >   security.  This note is intended to capture and try to make sense out
> >   of it.
> >
> >
> >
> > The IETF datatracker status page for this draft is:
> > https://datatracker.ietf.org/doc/draft-ietf-opsawg-firewalls
> >
> > There's also a htmlized version available at:
> > http://tools.ietf.org/html/submission.filename }}-00
> >
> >
> > Internet-Drafts are also available by anonymous FTP at:
> > ftp://ftp.ietf.org/internet-drafts/
> >
> > _______________________________________________
> > I-D-Announce mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/i-d-announce
> > Internet-Draft directories: http://www.ietf.org/shadow.html
> > or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> 
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg