Subject: [OPSAWG] Fwd: New Version Notification for draft-gont-opsawg-firewalls-analysis-01.txt

From: Fernando Gont <[email-masked]>
Date: Tue, 13 Oct 2015 10:52:55 -0300

FYI.

This rev hopefully addresses some/most/all of the comments received so
far (mostly by Eric Vyncke and James Woodyatt).

More comments/feedback will be welcome.

Thanks,
Fernando

-------- Forwarded Message --------
Subject: New Version Notification for
draft-gont-opsawg-firewalls-analysis-01.txt
Date: Tue, 13 Oct 2015 06:45:30 -0700
From: [email-masked]
To: Fred Baker <[email-masked]>, Fernando Gont <[email-masked]>

A new version of I-D, draft-gont-opsawg-firewalls-analysis-01.txt
has been successfully submitted by Fernando Gont and posted to the
IETF repository.

Name:		draft-gont-opsawg-firewalls-analysis
Revision:	01
Title:		On Firewalls in Network Security
Document date:	2015-10-13
Group:		Individual Submission
Pages:		17
URL:
https://www.ietf.org/internet-drafts/draft-gont-opsawg-firewalls-analysis-01.txt
Status:
https://datatracker.ietf.org/doc/draft-gont-opsawg-firewalls-analysis/
Htmlized:
https://tools.ietf.org/html/draft-gont-opsawg-firewalls-analysis-01
Diff:
https://www.ietf.org/rfcdiff?url2=draft-gont-opsawg-firewalls-analysis-01

Abstract:
   This document analyzes the role of firewalls in network security, and
   suggests a line of reasoning about their usage.  It analyzes common
   kinds of firewalls and the claims made for them.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Rick Casarez <[email-masked]>
Date: Fri, 16 Oct 2015 08:19:19 -0400

While I get amused reading such things are we sure we need lines like this
in the document?

"...and attempts to end the bickering on the topic, which is, for the most
part, of little value in illuminating the discussion."

A few parts of the introduction I think can be re-worded to express the
issues professionally without getting people defensive by making the
statements you are making. Rise above it.

In Section 2:

Firewall - I am wondering if a better definition can be made. From what you
wrote I cannot distinguish between a Firewall and an ACL. No mention of
state tracking for instance etc.

Defense-in-depth - I think you should define this term in this section
since you go on to use it in following sections. It helps by also showing
the differences between it and perimeter.

Section 3.3:

The sentence:

"By that line of reasoning, a firewall primarily protects infrastructure,
by preventing traffic that would attack it from it."

I think flows better as:

"By that line of reasoning, a firewall primarily protects infrastructure,
by preventing traffic that would attack it."

or

"A firewall primarily protects against infrastructure attacks."

Section 5.1:

"The drawback of this approach is that the security goal of "block traffic
unless it is explicitly allowed" prevents useful new applications."

I am not sure I understand this line. It blocks new applications from
immediately traversing the firewall. I know from experience though that
when a discussion is had with the NetSec team the application can be added
to the allow list. So not sure a "default deny" means new stuff never gets
allowed as the text insinuates.

Section 6:

There are temporary IPv4 addresses too. Usually the prefix is allowed with
a set access or security profile. The only problems I am aware of is if you
mix hosts with differing access/security profiles into one subnet. This is
fixed by designating subnets for specific profiles. IPv6 is not any
different and can work the same way.

As for application being tunneled over well-known ports that sounds like a
breakdown of communication between the Service Owners and NetSec. Simple
communication *should* lead to the creation of a profile for that new
application and its individual port. By doing what you describe it sounds
like a Service Owner trying to get out of doing due diligence with NetSec
or not knowing what port their application needs for access (More common
than you might think).

-------------------
Cheers, Rick

Experiences not things.

On Tue, Oct 13, 2015 at 9:52 AM, Fernando Gont <[email-masked]>
wrote:

> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops
>

---

From: Fernando Gont <[email-masked]>
Date: Fri, 16 Oct 2015 16:53:32 -0300

Hi, Rick,

Thanks so much for your feedback! Please find my responses in-line...

On 10/16/2015 09:19 AM, Rick Casarez wrote:
> While I get amused reading such things are we sure we need lines like
> this in the document?
> 
> "...and attempts to end the bickering on the topic, which is, for the
> most part, of little value in illuminating the discussion."
> 

I'll re-check the text -- The Intro was going to be re-worked, anyway.

> In Section 2:
> 
> Firewall - I am wondering if a better definition can be made. From what
> you wrote I cannot distinguish between a Firewall and an ACL. 

An ACL is a policy. A firewall is a device that enforces filtering policies.

> No mention
> of state tracking for instance etc.

Ok, will try to add somethin in this respect.

> since you go on to use it in following sections.

Will do.

> Section 3.3:
> 
> The sentence:
> 
> "By that line of reasoning, a firewall primarily protects
> infrastructure, by preventing traffic that would attack it from it."
> 
> I think flows better as:
> 
> "By that line of reasoning, a firewall primarily protects
> infrastructure, by preventing traffic that would attack it."
> 
> or
> 

This seond option my work. (Your first option changes the meaning of the
sentence).

> Section 5.1:
> 
> "The drawback of this approach is that the security goal of "block
> traffic unless it is explicitly allowed" prevents useful new applications."
> 
> when a discussion is had with the NetSec team the application can be
> added to the allow list. So not sure a "default deny" means new stuff
> never gets allowed as the text insinuates.

Well, that depends on where the firewall is being deployed, and if it is
actively managed.

> Section 6:
> 
> There are temporary IPv4 addresses too.

Not by definition I'd say. Or... would you mind elaborating a bit more
in this respect?

> As for application being tunneled over well-known ports that sounds like
> a breakdown of communication between the Service Owners and NetSec.
> Simple communication *should* lead to the creation of a profile for that
> new application and its individual port. By doing what you describe it
> sounds like a Service Owner trying to get out of doing due diligence
> with NetSec or not knowing what port their application needs for access
> (More common than you might think).

Yes. Or, at times, a user/app trying to circumvent unmanaged firewalls.
-- Ironically, at times these protocols are referred to as "firewall
friendly".

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Ca By <[email-masked]>
Date: Fri, 16 Oct 2015 14:13:49 -0700

I think this is important work, but i think this draft is too broad to be
effective in its current form.  I think it would be a great value to adopt
the common enterprise network view and scope of a "stateful firewall" that
most people
think of... from the likes of Checkpoint, Palo Alto, ...

> An ACL is a policy. A firewall is a device that enforces filtering
This defintion makes every on path device a firewall.  This is not a good
places to go.

> Ok, will try to add somethin in this respect.
This is the core of what 99% of the world thinks a firewall is.

> This seond option my work. (Your first option changes the meaning of the
eh...what is infrastructure... slippery slope here.

> Well, that depends on where the firewall is being deployed, and if it is
Actively managed vs not actively are worlds apart.  Do not lump them
together.

Same with stateful vs stateless

> -- Ironically, at times these protocols are referred to as "firewall
Yes... own the PC via Phishing or Flash, then use PCP from the PC to open
all the rules you want!

CB

---

From: Rick Casarez <[email-masked]>
Date: Sun, 18 Oct 2015 08:35:51 -0400

Just trying to help. Answers in line.

-------------------
Cheers, Rick

Experiences not things.

On Fri, Oct 16, 2015 at 3:53 PM, Fernando Gont <[email-masked]>
wrote:

> [Rick] Sounds good. Thanks.

> [Rick] Your definition would encompass routers and switches who have
ACL/Filters on interfaces/SVIs. I would not consider these firewalls.

> [Rick] Please do, as Ca mentions this is how the vast majority of the
world define it as. This even includes common compliance audits like
PCI/SOC etc.

> [Rick] I am unaware of any firewall deployed that is no longer managed.
The only cases I can think of is if the company has fired all engineers
after initial deployment. This would make it a business problem, not a
technical one since appropriate staffing is a business item.

Placement of the firewall is moot since if staffing is done correctly the
scenario I describe above should happen. If not staffed properly the
business has issues not related to creating new applications. In other
words it is not really the firewalls fault but the business for not having
anyone to maintain a piece of gear they deployed.

>  [Rick] My apologies on this one got some wires crossed. This is good to
go.

> -- Ironically, at times these protocols are referred to as "firewall

 [Rick] The scenario makes no sense other than a mismanaged company
frankly. You are essentially encouraging something against BCP. Even beyond
security you will make it difficult to troubleshoot if everything is using
the same port to traverse the firewall.

---

From: Fernando Gont <[email-masked]>
Date: Mon, 19 Oct 2015 21:53:58 -0300

Hi, Rick,

> Just trying to help. Answers in line.

Indeed -- and that's really appreciated!

> ACL/Filters on interfaces/SVIs. I would not consider these firewalls.

Well, that's a firewalling functionality. From a strict point of view, a
router does not really drop offending packets, but just forwards them.

> world define it as. This even includes common compliance audits like

Question: WOuld you include this as part of the fw definition, or rather
e.g. simply define "state-tracking"?

> [Rick] I am unaware of any firewall deployed that is no longer managed.

I'm told that comcast does currently deploys this sort of boxes for
their IPv6 residential customers.

And I'd argue that anything that is deployed at the home mostly follows
into this category...

>  [Rick] My apologies on this one got some wires crossed. This is good to go.

Thanks for double-checking!

> frankly. You are essentially encouraging something against BCP. Even
> beyond security you will make it difficult to troubleshoot if everything
> is using the same port to traverse the firewall.

We¿re not talking about companies, but about e.g. about firewalls
deployed at homes, and applications meant to be employed by such users.

Thanks!

Best regards,

---

From: Rick Casarez <[email-masked]>
Date: Tue, 20 Oct 2015 08:17:22 -0400

Hmm so maybe the problem is the scope of the draft. You seem to want to
cover home-based unmanaged CPE devices that have firewall functionality
built into them (Not dedicated firewalls as I recognize them). This is a
very specific definition of firewall and a specific type of deployment. If
you changed the introduction and scope to say you are only discussing this
specific type of hardware and deployment then a lot of the problems I have
with the text disappear.

If you however want this draft to cover firewalls in general then you have
to be aware of all the different ways they are deployed and maintained. You
also need to distinguish what separates a firewall from general L3/L4
access-control. I can tell you the industry does differentiate between the
two.

As for your statement that routers just route packets, that has not been
true for well over 18 years if not longer. ACLs/Filters on routing and
switching devices is not a new phenomenon.

Finally, to truly cover the subject you also have to at least mention the
things that have replaced dedicated firewalls for security at the Edge
(Load-balancers with built in Firewall functionality as an example) that
even PCI and SOC have accepted.
-------------------
Cheers, Rick

Experiences not things.