Subject: Re: [rrg] Remote ACLs [Proposals which match rrg architectures.html pls check the page]

From: [email-masked] (Noel Chiappa)
Date: Sun, 4 Jan 2009 15:40:52 -0500 (EST)

> From: Brian E Carpenter <[email-masked]>

    > Isn't this in fact a (perceived) problem with the multi-prefix model?
    > If an endpoint has multiple locators, then any site that puts one of
    > those locators in an ACL needs to put all of them in the ACL.

To expand a tiny bit on that 'Why are people putting locators in ACLs
anyway?' (since what I meant might not have been obvious) ....

It would seem to me that this would get us right back in the soup, in that a
change local to a site (e.g. changing ISPs) would, if ACLs were given in
terms of locators, be basically 'non-visible' to sites elsewhere in the
network which had configuration(s) which only included locator information
about that site.`

Put another way, unless some 'out of band' communication happens, there's no
way for e.g. a filter box Cf at client site C to know that the server site S
has moved from locator S1 to new locator S2. Since the highest level
semantics in which Cf has information about S is 'S1', unless there was some
sort of 'forwarding service' (e.g. an ICMP redirect from S1 to S2, sent back
to C - and I shudder to think about how to secure that so that it doesn't
become an attack vector), when S moves to S2, then Cf is just left entirely
in the dark.

On the other hand, if Cf knows of S at some higher semantic level, then it's
possible to imagine that Cf might be able to discover without human
intervention that S had moved from S1 to S2.

	Noel
_______________________________________________
rrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/rrg