Subject: [Rserpool] Should ASAP be splitted?

From: Manuel Urueña <[email-masked]>
Date: Mon, 10 Nov 2003 12:19:52 +0100

Hi,

Reading the ASAP draft I felt that it seems a little overloaded. In
particular, registration operations are just employed by PEs.

Maybe it would be good to put those operations in another protocol. Or
exactly the same ASAP protocol but without PU related operations. Of
course PE would require both protocols.

This will ease firewall protection, I mean, with ASAP firewalls should
allow ASAP connections to both PEs and NSs. Therefore, remote PUs are
able to send Registration operations to NSs. With two separate
protocols, registration port could be filtered.

Has been this discussed before? comments?

Regards,
--Manuel

-- 
Manuel Uruen~a - Universidad Carlos III de Madrid
GPG FP: 9BE9 9FFF ACFF 2887 80E6 50FE FABC A79F 5535 5A75

---

From: Qiaobing Xie <[email-masked]>
Date: Mon, 17 Nov 2003 20:55:01 -0600

Hi, Manuel,

I think you have raised a quite interesting point. But to further split
ASAP seems not a good idea, since we already see the difficult for
people to have to read two documents (ENRP and ASAP) at the same time in
order to under RSERPOOL operations. This is because they are tightly
related. Further split of ASAP will make this even harder.

We may be able to achieve the same thing you described by asking for two
separate ports for PU and PE. Just a though.

regards,
-Qiaobing

Manuel Urueña wrote:
>   ------------------------------------------------------------------------
>                        Name: signature.asc
>    signature.asc       Type: application/pgp-signature
>                 Description: Esta parte del mensaje =?ISO-8859-1?Q?est=E1?= firmada digitalmente

_______________________________________________
rserpool mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rserpool

---

From: Qiaobing Xie <[email-masked]>
Date: Mon, 17 Nov 2003 20:55:01 -0600

Hi, Manuel,

regards,
-Qiaobing

---

From: Manuel Urueña <[email-masked]>
Date: Tue, 18 Nov 2003 14:59:20 +0100

Hi Qiaobing,

Good suggestion, two ports would be enough if ENRP Servers only accept
Register operations from the PE port. That port should be filtered for
IP addresses outside the Pool range to provide an additional security
level.

Just another question, I was not able to go to the IETF #58 Rserpool
meeting. Does anybody raise the MAX-BAD-PE-REPORT DoS issue?

Thanks,
--Manuel

-- 
Manuel Uruen~a - Universidad Carlos III de Madrid
GPG FP: 68A1 164B EE28 52C9 87CB  EBF9 616E 52B5 451A B6B2

---

From: Manuel Urueña <[email-masked]>
Date: Tue, 18 Nov 2003 14:59:20 +0100

Hi Qiaobing,

Thanks,
--Manuel