Subject: [rbridge] TTL only - was RE: New fields in shim header?

From: Eric.Gray at marconi.com (Gray, Eric)
Date: Fri, 13 Oct 2006 13:04:09 -0400

Caitlin,

Agree.

The thing to remember here is that RBridges on essentially intra-LAN
devices.  The point at which it makes sense to do authentication is
on entry to the LAN - either from a top-down view of protocol-stack 
traversal, or from a perspective of peer-to-peer traversal of routers 
and/or firewalls.

--
Eric

--> -----Original Message-----
--> From: rbridge-bounces at postel.org 
--> [mailto:rbridge-bounces at postel.org] On Behalf Of Caitlin Bestler
--> Sent: Thursday, October 12, 2006 4:37 PM
--> To: Silvano Gai; Joe Touch
--> Cc: rbridge at postel.org; Radia Perlman
--> Subject: Re: [rbridge] TTL only - was RE: New fields in shim header?
--> 
--> Silvano Gai wrote:
--> > Catlin,
--> > 
--> > I didn't reply to your last point
--> > 
--> >> 
--> >> I am assuming there is no desire to replicate IPSEC funcationality
--> >> at L2 then *all* of the L2 headers may be forged. I don't see how
--> >> you can claim that any specific one is more trustworthy than the
--> >> others.
--> > 
--> > Even without IPsec, RBridges can authenticate to each other
--> > and forging an RBridge is much more difficult that using a
--> > readily available program on your PC to spoof the IP or 
--> > MAC address.
--> > 
--> > -- Silvano
--> 
--> I wouldn't be surprised if RBridges ending up authenticating
--> to each other as part of fabric discovery. But clearly there
--> will be no high quality authentication applied at L2 on a 
--> per packet basis.
--> 
--> 
--> 
--> _______________________________________________
--> rbridge mailing list
--> rbridge at postel.org
--> http://mailman.postel.org/mailman/listinfo/rbridge
-->