Subject: [OPSAWG] Fwd: I-D Action: draft-ietf-opsawg-firewalls-01.txt

From: Shishio Tsuchiya <[email-masked]>
Date: Mon, 18 Mar 2013 17:17:15 +0900

I read the draft,and I think this is useful for decistion of operators's security policy and vendor's implementation.
BTW,Today's IPv6 network environment easy to build cascade networks,because most of CPE equipment already
implemented "hierarchical DHCPv6 Prefix Delegation" and most of ISP provides IPv6 prefix by dhcp-pd.
http://tools.ietf.org/html/draft-chakrabarti-homenet-prefix-alloc-01#section-6

User---|Home GW|----|CPE|-------ISP network
               <--DHCP-pd   <--DHCP-pd

In this case,who should act Firewall security?

CPE would do firewall to the user traffic for all of delegated prefix, Home GW might do firewall to user traffic.
If security policy is same then user traffic would be double count/check on both HomeGW and CPE.
It is waste of resource and might be downgraded for user experience.

It is enough to do by each of one.
What do think?

If security policy differs among CPE and Home GW,then it might need to communicate and exchange policy.
Does PCP would be useful for this case?

Regards,
-Shishio

-------- Original Message --------
Subject: I-D Action: draft-ietf-opsawg-firewalls-01.txt
Date: Thu, 18 Oct 2012 15:50:55 -0700
From: <[email-masked]>
Reply-To: <[email-masked]>
To: <[email-masked]>
CC: <[email-masked]>

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Operations and Management Area Working Group Working Group of the IETF.

	Title           : On Firewalls in Internet Security
	Author(s)       : Fred Baker
                          Paul Hoffman
	Filename        : draft-ietf-opsawg-firewalls-01.txt
	Pages           : 10
	Date            : 2012-10-18

Abstract:
   This document discusses the most important operational and security
   implications of using modern firewalls in networks.  It makes
   recommendations for operators of firewalls, as well as for firewall
   vendors.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-opsawg-firewalls

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-opsawg-firewalls-01

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-opsawg-firewalls-01

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
.

.

---

From: Ted Lemon <[email-masked]>
Date: Mon, 18 Mar 2013 12:38:59 +0000

> It is enough to do by each of one.

You might want to look at the work Erik Kline and Lorenzo Colitti have been doing in homenet on homenet edge detection.

As for hierarchical prefix delegation, the current way of doing it is broken—if you divide the prefix arbitrarily and delegate larger prefixes than /64 within the home, you wind up with a mess, although it does make routing simple until it fails.   If you want to do prefix delegation within the home, the CPE edge router that got the delegation from the ISP should be the delegating router for the entire home, and the routers below it in the hierarchy should relay PD requests up to the CPE edge.