Subject: Re: [BEHAVE] NAT66 - pointer to opsec doc on infrastructure security

From: Fred Baker <[email-masked]>
Date: Mon, 1 Dec 2008 14:41:39 -0800

On Nov 23, 2008, at 12:11 PM, Brian E Carpenter wrote:

> Infrastructure hiding is a different matter and
> clearly a normal function of firewalls or ACLs.

or the use of a ULA that isn't advertised elsewhere.
_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Mon, 1 Dec 2008 23:53:29 +0100

Which is also a firewall function: public vs. Internal-only information.

But, I do agree that this is a perimeter function :-)

-éric 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Fred Baker (fred)
> Sent: lundi 1 décembre 2008 23:42
> To: Brian E Carpenter
> Cc: [email-masked]
> Subject: Re: [BEHAVE] NAT66 - pointer to opsec doc on 
> infrastructure security
> 
> 
> > Infrastructure hiding is a different matter and clearly a normal 
> > function of firewalls or ACLs.
>

---

From: Keith Moore <[email-masked]>
Date: Mon, 01 Dec 2008 17:57:08 -0500

> or the use of a ULA that isn't advertised elsewhere.

it won't work.  they'll leak.

and it's much easier to trace packets that use the same address at all
points in the signal path, than to trace packets that are NATted.

not that any of this matters to people who have consumed the NAT
kool-aid.  mindshare trumps all else, and people (re)learn slowly -
mostly as they retire and are replaced by new people.

Keith