Subject: Re: (NAT) RSIP : Flexibility of tunneling method...

From: Carmelo Zaccone <[email-masked]>
Date: Tue, 01 Jun 1999 14:01:12 +0200

Sorry for multiple receipt :-( However, I didn't saw my reply on the list.

Carmelo Zaccone wrote:
 
         Hello Mike,
 
 Mike Borella wrote:
 >
 > Hi Carmelo,
 >
 > We never claim that tunneling prevents external attacks (or any other
 > kind of an attack).
 
Ok.
 
 > Tunneling will, however, make it easier for RSIP to
 > operate with legacy firewall code and policy such that packets that are sent
 > by RSIP clients do not have external (public) addresses in their outer headers.
 
However, could you extend some more on the reasons which make RSIP server 's
live more easier using tunneling with the RSIP client ?
 
Because I don't really see any inconvenience of enabling the host to send
packets with a globally addresses IP header, assuming that our network may
correctly route them towards the good destination (the Internet for
outbound traffic and a particular host for inbound traffic).
 
I think that using globally addressed IP header in the network do not insert
potential disadvantages concerning security issues. Because if a host would like to
send junk packets onto the network there is not difference if this one create its
headers using private or global IP addresses.
Internal traffics with public or private IP addresses may be considered the
same level concerning their 'legacy' or 'junk' aspect at internal router.
 
Assuming now that this junk traffic is exchanged with the Internet, if we have
firewalling on the exit points of the network, if those firewalls are configured like :
      For outbound traffic, only accept to forward packets with
                - source IP addresses : IP addresses from the global pool
                                       (potentially with the filter set to only accept
                                       the currently assigned IP addresses)
                         and
                - destination IP addresses : whatever public IP addresses but not 
                                             from the global pool
     For inbound traffic, only accept to receive packets with
                - source IP addresses : whatever public IP addresses but
                                       not from the global pool
                - destination IP addresses : IP addresses from the global pool.
                                            (potentially with a filter to only accept the
                                            currently assigned IP addresses but however
                                            here this is not really required as anyway if an IP
                                            address is not currently assigned, there will
                                            be no routes towards it)
 
there will be no objection to authorize the use of globally addressed packet inside the 
private network.
 
                         Carmelo
-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.

---

From: Carmelo Zaccone <[email-masked]>
Date: Wed, 02 Jun 1999 10:34:10 +0200

Mike Borella wrote:
> 
> In speaking with architects and programmers, they all think that
> RSIP would be much easier to implement in the client
> when tunnels are used, i.e., once a packet arrives on a
> particular virtual interface, you know exactly what to do with
> it.
> 
> However, there doesn't seem to be a compelling reason
> (at least I can't think of one) to completely forbid *not* using
> tunnels.
> 
> So, I'll add a "no-tunnel" tunnel type to the negotiated
> parameters.
>
> -Mike

	We (at Alcatel research) are currently writing a draft 
	describing some non-tunneled mechanisms to enable end to 
	end Internet communications.

	This draft will be submitted at the Oslo meeting.

		Regards,

			Carmelo
-