Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
[EMAIL PROTECTED] writes: On Wed, 18 Jun 2003 21:30:35 PDT, Eric Rescorla said: This seems to me like a false dichotomy. If I were deploying a NAT (which I didn't) there would be certain things I would care about and others I didn't. If I'm already firewalling off these services, why

RE: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Michel Py
Valdis Kletnieks wrote: The point I was making is that if an NNTP connection fails because the firewall is *configured* to say 'None Shall Pass' (insert Monty Python .wav here ;) then that is *proper* behavior. If a VOIP connection fails because the NAT is saying 'None Shall Pass', then

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread James Seng
Why should the users be limited to what IT managers decide is good or bad? Internet is build on dumb network, smart terminal. End-users are suppose to be able to put up their own services, not just running some apps. This has been the Internet principles and have serves us well so far. (The

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Valdis . Kletnieks
On Wed, 18 Jun 2003 22:19:12 PDT, Eric Rescorla said: You've got it absolutely backwards. The fact that the NAT breaks applications that I don't want to run anyway is a FEATURE, not a bug. And the fact that NAT breaks things that you DO want to run is a ? And unfortunately, a lot of the

Re: WG review: Layer 2 Virtual Private Networks (l2vpn)

2003-06-19 Thread Kurt Erik Lindqvist
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 If you use LDP, it is NOT a routing protocol. The specific mode of use (targeted LDP) is already described in RFC 3036. The FECs are different, but the FEC TLV was defined in such a way as to be extensible. And when you want to do this

Re: NATs are NOT Firewalls

2003-06-19 Thread Valdis . Kletnieks
On Thu, 19 Jun 2003 00:55:49 EDT, S Woodside said: On Wednesday, June 18, 2003, at 06:28 PM, Tomson Eric ((Yahoo.fr)) wrote: Now, the fact that masking the internal addresses to the external world - so that internal hosts can initiate traffic to the outside, but no external host can

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread James Seng
If you need a secure zone, and you want a firewall, then should install a firewall. You should not put an NAT thinking that it is also a firewall. But I agree with you that NAT is here to stay. -James Seng Fleischman, Eric wrote: Eric Rescorla [mailto:[EMAIL PROTECTED] wrote: similarly,

RE: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Michel Py
Valdis, Valdis Kletnieks wrote: And unfortunately, a lot of the Just Does Not Work stuff are applications like H.323 and VOIP that Joe Sixpack actually *might* be interested in. Unfortunately, there is no single reason [protocol or app xyz] does not work over NAT. When [protocol or app xyz]

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread John Loughney
Eric, With due respects, there is a flaw in your thinking. Many ISPs give users NATed adresses, without users really knowing or understanding what they are. When the users try applications or serves which fail because of the non-transparency, the users may not know the cause of the failures.

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread Eric A. Hall
on 6/18/2003 10:44 PM [EMAIL PROTECTED] wrote: Melinda Shore [EMAIL PROTECTED] writes: None of these things worked real well through firewalls either, which is sort of my point. If it doesn't work through a firewall, it's because the firewall is doing what you ASKED it to do - block

Re: myth of the great transition (was US Defense Department

2003-06-19 Thread Paul Vixie
The Internet is a Internetwork of Internets. It is not a network! To repeat, it has no center, and further, does not even have any edges. that's not a useful vocabulary. try this one: 1 - Connection Taxonomy 1.1. The Internet is a network of networks, where the component networks

Re: myth of the great transition

2003-06-19 Thread Paul Vixie
[EMAIL PROTECTED] (Vernon Schryver) writes: Related to what you wrote a little while ago, blackhole routes are easier to deploy against overseas senders of junk IP packets (for most localized notions of overseas) than nearby spammers. Do you get much spam direct from China or Korea? before

RE: WG review: Layer 2 Virtual Private Networks (l2vpn)

2003-06-19 Thread Pekka Savola
On Wed, 18 Jun 2003, Vach Kompella wrote: - the IETF is too large, so we shouldn't be adding more work Yes. So we should not do any new work?! We should focus on the work that is more integral to IP and the Internet. 1. Virtual Private LAN Service. This is Internet-wise ethernet

Re: NATs are NOT Firewalls

2003-06-19 Thread Daniel Senie
At 01:34 AM 6/19/2003, [EMAIL PROTECTED] wrote: On Thu, 19 Jun 2003 00:55:49 EDT, S Woodside said: On Wednesday, June 18, 2003, at 06:28 PM, Tomson Eric ((Yahoo.fr)) wrote: Now, the fact that masking the internal addresses to the external world - so that internal hosts can initiate

Architectures and frameworks (Re: WG review: Layer 2 VirtualPrivate Networks) (l2vpn)

2003-06-19 Thread Harald Tveit Alvestrand
--On onsdag, juni 18, 2003 11:04:30 -0700 Ping Pan [EMAIL PROTECTED] wrote: As for IESG, the problem is not about having a new IETF WG. Rather, why are we spending so much time and energy on standardization? How many times are people going to write architecture and framework RFC's? until they

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread Keith Moore
My take is that NAT's respond to several flaws in the IPv4 architecture: - 1) Not enough addresses - this being the one that brought them into existence. - 1a) Local allocation of addresses - a variant of the preceeding one, but subtly different; NAT's do allow you to allocate

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
James Seng [EMAIL PROTECTED] writes: Why should the users be limited to what IT managers decide is good or bad? Internet is build on dumb network, smart terminal. End-users are suppose to be able to put up their own services, not just running some apps. This has been the Internet principles

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread Keith Moore
The reason that we are explaining (once again) why NAT sucks is that some people in this community are still in denial about that The person who's most in denial around here is you - about how definitively the market has, for the moment, chosen IPv4+NAT as the best balance between

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
John Loughney [EMAIL PROTECTED] writes: With due respects, there is a flaw in your thinking. Many ISPs give users NATed adresses, without users really knowing or understanding what they are. When the users try applications or serves which fail because of the non-transparency, the users may

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Theodore Ts'o
On Thu, Jun 19, 2003 at 07:49:14AM -0400, J. Noel Chiappa wrote: My take is that NAT's respond to several flaws in the IPv4 architecture: - 1) Not enough addresses - this being the one that brought them into existence. - 1a) Local allocation of addresses - a variant of the preceeding

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
[EMAIL PROTECTED] writes: On Wed, 18 Jun 2003 22:19:12 PDT, Eric Rescorla said: You've got it absolutely backwards. The fact that the NAT breaks applications that I don't want to run anyway is a FEATURE, not a bug. And the fact that NAT breaks things that you DO want to run is a ? I'm

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
Keith Moore [EMAIL PROTECTED] writes: Sadly, the IETF seems to find ways to generate immense amounts of heat over NAT, while sticking its collective head in the sand with regards to activity in the marketplace. the NAT vendors are the irresponsible ones. they create a mess out of the

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread Keith Moore
If the customers are getting what they want, that seems to me that it can hardly be characterized as a mess. And you have yet to establish that they're not getting what they want. certainly the users I deal with are not getting what they want. others seem to be reporting similar experiences.

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
Keith Moore [EMAIL PROTECTED] writes: If the customers are getting what they want, that seems to me that it can hardly be characterized as a mess. And you have yet to establish that they're not getting what they want. certainly the users I deal with are not getting what they want.

Re: WG review: Layer 2 Virtual Private Networks (l2vpn)

2003-06-19 Thread Keith Moore
1. Virtual Private LAN Service (VPLS)--L2 service that emulates LAN across an IP and an MPLS-enabled IP network, allowing standard Ethernet devices communicate with each other as if they were connected to a common LAN segment. I do not believe this is a technically

RE: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Peter Ford
Title: Re: myth of the great transition (was US Defense Department forma lly adopts IPv6) Noel, You are getting too cerebral. We can look at the marketing info on the box of a NAT product to see what people think they are getting: 1) Instant Internet Sharing for cable and DSL 2)

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread Keith Moore
certainly the users I deal with are not getting what they want. others seem to be reporting similar experiences. Then why don't they switch providers. variety of reasons: often the provider is not the problem, it's the local network admins, and the users aren't free to go elsewhere. some

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Melinda Shore
This is more hyperbole. How have NATs created a mess out of the network? Yes, I understand that they've made the network environment more complicated which makes life hard on protocols designers. So what? If the customers are getting what they want, that seems to me that it can hardly be

RE: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Fleischman, Eric
My posting wasn't concerning what I think, it was concerning what is commonly done today in industry. I also didn't intend to imply that the NAT was being used as a firewall, rather that the NAT is commonly used today as an element within firewalls. My own thoughts (which is off-topic) is that

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Peter Deutsch
J. Noel Chiappa wrote: From: Keith Moore [EMAIL PROTECTED] The reason that we are explaining (once again) why NAT sucks is that some people in this community are still in denial about that The person who's most in denial around here is you - about how definitively the

Re: myth of the great transition

2003-06-19 Thread Peter Deutsch
Keith Moore wrote: expecting the network to isolate insecure hosts from untrustworthy attackers, or more generally, to enforce policy about what kinds of content are permitted to pass, has always been a stretch. So where do firewalls fit into your picture? Do they represent

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Michael Thomas
Eric Rescorla writes: What applications that people want to run--and the IT managers would want to enable--are actually inhibited by NAT? It seems to me that most of the applications inconvenienced by NAT are ones that IT managers would want to screen off anyway. Uh, have you paid no

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Richard Shockey
At 02:45 AM 6/19/2003 +, Paul Vixie wrote: Which BTW come July 1 becomes illegal in the US with the implementation of the Federal Trade Commission Do Not Call list. which country's federal do you mean? http://www.ftc.gov/bcp/conline/edcams/donotcall/index.html oh, that one. i guess that

firewall logic (was Re: myth of the great transition)

2003-06-19 Thread Keith Moore
I believe the primary purpose of firewalls should be to protect the network, not the hosts, from abusive or unauthorized usage. So for every firewall you purchase and install, you can focus its configuration and operation on protecting the network from your users. I trust you agree that

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Paul Vixie
Remember Paul ..the issue in most of these laws is to go after the company offering the products, porn, whatever _via_ spam. and when they are syn-scanning me from outside the us i can tell who their client is how? and when the robot calls back asking me to hold on the line for a human

RE: NATs are NOT Firewalls

2003-06-19 Thread Michel Py
Daniel, I agree with the rest of your post, however Since NAPT uses stateful inspection to operate, I think I don't agree with this. I would say that NAPT is a stateful process but not that it uses inspection. By inspection I understand a more intelligent process that decapsulates packets and

Re[2]: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Richard Welty
On 19 Jun 2003 06:59:56 -0700 Eric Rescorla [EMAIL PROTECTED] wrote: [EMAIL PROTECTED] writes: And the fact that NAT breaks things that you DO want to run is a ? I'm not convinced that this is happening... if it is, why isn't there a market reaction. such maybe building. i have a client who

RE: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Christian Huitema
The person who's most in denial around here is you - about how definitively the market has, for the moment, chosen IPv4+NAT as the best balance between cost and effectiveness. Get a grip. We all know you don't like NAT. You don't need to reply to *every* *single* *message* *about*

Re[2]: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Richard Welty
On 19 Jun 2003 07:39:56 -0700 Eric Rescorla [EMAIL PROTECTED] wrote: Then why don't they switch providers. Revealed preference suggests that they *are* getting what they want, no matter how much complaining. in many places, the choice of broadband providers is quite poor. see my earlier

RE: Re[2]: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Neil Carpenter
in many places, the choice of broadband providers is quite poor. see my earlier posting about my client for whom Ameritech DSL was the only affordable choice, and we just barely made it work for their application. This seems like a specious argument. The client had chosen, as you indicate,

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
Keith Moore [EMAIL PROTECTED] writes: certainly the users I deal with are not getting what they want. others seem to be reporting similar experiences. Then why don't they switch providers. variety of reasons: often the provider is not the problem, it's the local network admins, and

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
Michael Thomas [EMAIL PROTECTED] writes: Eric Rescorla writes: What applications that people want to run--and the IT managers would want to enable--are actually inhibited by NAT? It seems to me that most of the applications inconvenienced by NAT are ones that IT managers would want

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
Melinda Shore [EMAIL PROTECTED] writes: As I said before, the workarounds that are being used to help facilitate application traversal of NATs are definitely introducing new security problems that wouldn't exist if the NAT weren't there. There are other problems around robustness and routing.

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Michael Thomas
Eric Rescorla writes: Michael Thomas [EMAIL PROTECTED] writes: Eric Rescorla writes: What applications that people want to run--and the IT managers would want to enable--are actually inhibited by NAT? It seems to me that most of the applications inconvenienced by NAT are

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread Keith Moore
until recently the only way I could get even one static IP address for my home was through a special deal with a friend of mine who had a small ISP, and the best bandwidth I could get was 128kbps. none of the other local providers would sell me one. Doesn't the fact that there's not

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Iljitsch van Beijnum
On donderdag, jun 19, 2003, at 13:49 Europe/Amsterdam, J. Noel Chiappa wrote: Maybe NATs are, in fact, a result of a very deep problem with our architecture. My take is that NAT's respond to several flaws in the IPv4 architecture: - 1) Not enough addresses - this being the one that brought

Re[4]: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Richard Welty
On Thu, 19 Jun 2003 13:00:47 -0400 Neil Carpenter [EMAIL PROTECTED] wrote: in many places, the choice of broadband providers is quite poor. see my earlier posting about my client for whom Ameritech DSL was the only affordable choice, and we just barely made it work for their application.

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread S Woodside
Exactly. A NAPT (not a NA(!P)T ..) is in fact a perfectly good firewall* for the home user. So all this argumentation that a NAPT is not a firewall is bunk. * where firewall = a device that protect my internal net from external threats simon On Thursday, June 19, 2003, at 03:46 AM,

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread S Woodside
Keith, I don't get this argument. A NAPT is a firewall by your own definition I believe the primary purpose of firewalls should be to protect the network, not the hosts, from abusive or unauthorized usage. It's implementing a very simple policy, protect me from the outside world. simon On

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
Keith Moore [EMAIL PROTECTED] writes: until recently the only way I could get even one static IP address for my home was through a special deal with a friend of mine who had a small ISP, and the best bandwidth I could get was 128kbps. none of the other local providers would sell me

Re: myth of the great transition (was US Defense Department forma llyadopts IPv6)

2003-06-19 Thread ned . freed
Melinda Shore [EMAIL PROTECTED] writes: What applications that people want to run--and the IT managers would want to enable--are actually inhibited by NAT? It seems to me that most of the applications inconvenienced by NAT are ones that IT managers would want to screen off anyway.

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
Michael Thomas [EMAIL PROTECTED] writes: Eric Rescorla writes: Michael Thomas [EMAIL PROTECTED] writes: Eric Rescorla writes: What applications that people want to run--and the IT managers would want to enable--are actually inhibited by NAT? It seems to me that most

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Bob Braden
* * So, on the one hand, we have the actual behavior of millions of people. * On the other hand we have Keith Moore's opinion about what they ought * to prefer. I don't have any trouble figuring out which one I believe. * * -Ekr * Erik, Errr, let's see if I understand your

use of (the term) NAT considered dangerous

2003-06-19 Thread S Woodside
since usually you mean NAPT. Realistically speaking, almost every NAT that's out there in the real world is actually a NAPT. In fact I think that NAT is so rare that it really should be called NA(!P)T to be completely clear that there is no port translation going on. simon --

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread Keith Moore
Keith, I don't get this argument. A NAPT is a firewall by your own definition I believe the primary purpose of firewalls should be to protect the network, not the hosts, from abusive or unauthorized usage. only if the policy that the user wants is exactly what the NAPT provides. it's

Re: NATs are NOT Firewalls

2003-06-19 Thread S Woodside
On Thursday, June 19, 2003, at 01:34 AM, [EMAIL PROTECTED] wrote: Is this just security through obscurity, or something better? Security through obscurity. See Bellovin's paper on enumerating through a NAT. http://www.research.att.com/~smb/papers/fnat.pdf This paper has nothing to do with

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread Keith Moore
Doesn't the fact that there's not enough demand for this product to make it available suggest anything to you? does the fact that there was enough demand for the product that it eventually became available suggest anything to you? Yeah, that there's a subset who cares. They got it.

RE: NATs are NOT Firewalls

2003-06-19 Thread shogunx
On Thu, 19 Jun 2003, Michel Py wrote: Daniel, I agree with the rest of your post, however Since NAPT uses stateful inspection to operate, when referring to NAPT, we are talking about rinetd, right? you can run that on a linux box with two network interfaces (ethernet, ppp, token ring,

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
Keith Moore [EMAIL PROTECTED] writes: Yeah, that there's a subset who cares. They got it. The market is working. the market is dysfunctional. it doesn't always fail to deliver what is needed, but it often does. That's your claim. I don't buy it. Apparently not, or they wold switch.

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
Bob Braden [EMAIL PROTECTED] writes: * * So, on the one hand, we have the actual behavior of millions of people. * On the other hand we have Keith Moore's opinion about what they ought * to prefer. I don't have any trouble figuring out which one I believe. * * -Ekr *

Re: WG review: Layer 2 Virtual Private Networks (l2vpn)

2003-06-19 Thread Joe Touch
Vach Kompella wrote: Melinda, As a process kind of thing, I'm also concerned about the growth of the temporary sub-IP area, so I think there are issues here with both the work itself and in how the IETF goes about taking on and structuring its work. And proposals have been made to dismantle

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread S Woodside
On Thursday, June 19, 2003, at 01:54 PM, Keith Moore wrote: Keith, I don't get this argument. A NAPT is a firewall by your own definition I believe the primary purpose of firewalls should be to protect the network, not the hosts, from abusive or unauthorized usage. only if the policy that the

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread Eric A. Hall
on 6/19/2003 12:59 PM Keith Moore wrote: Yeah, that there's a subset who cares. They got it. The market is working. the market is dysfunctional. it doesn't always fail to deliver what is needed, but it often does. I wouldn't say that this market is dysfunctional, more that markets aren't

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
Keith Moore [EMAIL PROTECTED] writes: they would switch if they had alternatives available. but people like you keep claiming that alternatives aren't needed because the market has spoken. Nonsense. I'd love to see an alternative. Obviously, NATS have costs and a solution that

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread Keith Moore
they would switch if they had alternatives available. but people like you keep claiming that alternatives aren't needed because the market has spoken. Nonsense. I'd love to see an alternative. Obviously, NATS have costs and a solution that reduced those costs would be better. What

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Theodore Ts'o
On Thu, Jun 19, 2003 at 11:10:03AM -0700, Eric Rescorla wrote: Users aren't physically handcuffed to their Internet connections. They have choices as to who to purchase connectivity from. Those users, if they chose, could purchase connectivity with static IP addresses and no NAT. They by and

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread Keith Moore
Yes, I agree, that NAPTs have tons of side effects, and that's a bad thing. But, for the average home user on DSL, they have purchased millions upon millions of these things. It's a tiny little network and they have full control over all the hosts. So for them, the NAPT firewalling

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Michael Thomas
Eric Rescorla writes: P.S. And btw, I'm not advocating NAT. What I'm advocating is that we stop behaving as if we think that anyone who uses NAT is obviously an idiot. I don't think that I've seen anybody say that. Most people who use NAT have no clue one way or the other about NAT any more

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread Keith Moore
so it's not like I haven't actually been working on solving the problem. I didn't say you haven't been. So, my question at this point is: (1) If these solutions aren't available, why not? (2) If they are available and people don't want them, why not? it may be too early, and lots of

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Melinda Shore
I'm not sure what you mean by routing above. Are you suggesting there's some negative externality in that NAT makes the routing infrastructure more complicated? If so, what is it? If you're multihomed and your route changes, your address changes. (Yes, this happens). I am profoundly weirded

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Melinda Shore
Keith, I don't get this argument. A NAPT is a firewall by your own definition I believe the primary purpose of firewalls should be to protect the network, not the hosts, from abusive or unauthorized usage. It's implementing a very simple policy, protect me from the outside world. NAT has

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
I said I was done with this discussion, but I think Melinda deserves a response here. Melinda Shore [EMAIL PROTECTED] writes: I'm not sure what you mean by routing above. Are you suggesting there's some negative externality in that NAT makes the routing infrastructure more complicated? If

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread John Stracke
Eric Rescorla wrote: (2) NAT solves at least some of those problems, at some cost (say Cn), both financial and operational and that solution has benefit Bn. (5) It's also possible that at some time in the future Cn will exceed Bn, in which case I would expect people to stop using NAT

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread Keith Moore
(1) There are some set of problems that users have or believe they have. (2) NAT solves at least some of those problems, at some cost (say Cn), both financial and operational and that solution has benefit Bn. (3) The fact that a large number of people have chosen to use

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Melinda Shore
Does this seem like a weird position for an IAB member to take? I don't think so. I think economics provides useful tools for talking about and evaluating this stuff, too, but I think it's pretty evident that you can optimize for anything you like and get different results. I question whether

Re: myth of the great transition

2003-06-19 Thread S Woodside
On Thursday, June 19, 2003, at 03:27 PM, Melinda Shore wrote: Keith, I don't get this argument. A NAPT is a firewall by your own definition I believe the primary purpose of firewalls should be to protect the network, not the hosts, from abusive or unauthorized usage. It's implementing a very

Re: myth of the great transition

2003-06-19 Thread Melinda Shore
NAT has problematically constrained policy capabilities. Does that mean that a NAT is a workable firewall but introduces undesirable side effects? No, it means that NAT is inherently incapable of enforcing policy decisions at a granularity that's useful. Melinda

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
Melinda Shore [EMAIL PROTECTED] writes: Does this seem like a weird position for an IAB member to take? I don't think so. I think economics provides useful tools for talking about and evaluating this stuff, too, but I think it's pretty evident that you can optimize for anything you like

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
Keith Moore [EMAIL PROTECTED] writes: (1) There are some set of problems that users have or believe they have. (2) NAT solves at least some of those problems, at some cost (say Cn), both financial and operational and that solution has benefit Bn. (3) The fact that a

Re: myth of the great transition

2003-06-19 Thread J. Noel Chiappa
From: S Woodside [EMAIL PROTECTED] Does that mean that a NAT is a workable firewall but introduces undesirable side effects? Is it (or could it be) possible to make an equally workable firewall, at a low price, that doesn't introduce to constrained policy capabilities?

Re: myth of the great transition

2003-06-19 Thread S Woodside
On Thursday, June 19, 2003, at 05:59 PM, J. Noel Chiappa wrote: From: S Woodside [EMAIL PROTECTED] Does that mean that a NAT is a workable firewall but introduces undesirable side effects? Is it (or could it be) possible to make an equally workable firewall, at a low price, that doesn't

RE: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Michel Py
Eric, Eric Rescorla wrote: The fact that a large number of people have chosen to use NAT is a strong argument that BC. (Here's where the invocation of revealed preference comes in). This is not the point. What you are saying is that since BC it makes NAT OK. What I am saying (and possibly

RE: Re[2]: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Michel Py
Richard Welty wrote: the needed three legged firewall, bridging two interfaces and using NAT on the third one, is rather more complicated than i wanted to deploy for a budget-constrained customer. neither i nor my client feel that there was a much of a win here, but there weren't any other

Re[4]: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Richard Welty
On Thu, 19 Jun 2003 18:26:17 -0700 Michel Py [EMAIL PROTECTED] wrote: Richard Welty wrote: the needed three legged firewall, bridging two interfaces and using NAT on the third one, is rather more complicated than i wanted to deploy for a budget-constrained customer. neither i nor my

RE: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Michel Py
Keith, Michel Py wrote: IMHO, here is the deal: IPv4 NAT does suck, but there is nothing we can do to remove it; so the only worthy efforts are 1) maybe try to make it less worse (I will not go as far as saying better) and 2) let's not make the same mistake with IPv6. Keith Moore wrote:

RE: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Michel Py
Ted, Theodore Ts'o wrote: So 30 static IP addresses, with a slower service, is over *five* times more expensive, and over twice as expensive as faster service with only 2 static IP addresses. As much as I hate NAT, from an aesthetic perspective, using two static IP addresses and a NAT box

primary purpose of firewalls

2003-06-19 Thread Keith Moore
I believe the primary purpose of firewalls should be to protect the network, not the hosts, from abusive or unauthorized usage. I do not agree with this. The primary purpose of firewalls is to protect BOTH the network and the hosts. the reason I disagree is that fundamentally, there's

RE: myth of the great transition

2003-06-19 Thread Michel Py
Simon, Simon Woodside wrote: Is it (or could it be) possible to make an equally workable {local address isolation system}, at a low price, that doesn't introduce the drawbacks of NAPT. If you are talking about the actual hardware, yes. It already exists, just a matter of how it is

Re: myth of the great transition (was US Defense Department formally adopts IPv6)

2003-06-19 Thread James Seng
The question: smart terminal or smart network? I believe in smart terminal. Nothing there suggest you should not run your firewall or any other filtering software on your end-terminal. End-machine are vulnerable? Then fixed the end-machine. It isnt rocket science. -James Seng Eric Rescorla

RE: primary purpose of firewalls

2003-06-19 Thread Michel Py
Keith, Keith Moore wrote: I believe the primary purpose of firewalls should be to protect the network, not the hosts, from abusive or unauthorized usage. Michel Py wrote: I do not agree with this. The primary purpose of firewalls is to protect BOTH the network and the hosts. the reason

Re: primary purpose of firewalls

2003-06-19 Thread Keith Moore
Keith Moore wrote: I believe the primary purpose of firewalls should be to protect the network, not the hosts, from abusive or unauthorized usage. Michel Py wrote: I do not agree with this. The primary purpose of firewalls is to protect BOTH the network and the hosts. the

RE: primary purpose of firewalls

2003-06-19 Thread Michel Py
Keith, Keith Moore wrote: I believe you should buy or write applications that ensure their own security and protect the security of the machines on which they are hosted. I believe you should buy computing platforms that provide facilities to isolate applications from one another, so that

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Michael Thomas
Eric Rescorla writes: I said I was done with this discussion, but I think Melinda deserves a response here. Melinda Shore [EMAIL PROTECTED] writes: I'm not sure what you mean by routing above. Are you suggesting there's some negative externality in that NAT makes the routing

Re: primary purpose of firewalls

2003-06-19 Thread Keith Moore
Keith Moore wrote: I believe you should buy or write applications that ensure their own security and protect the security of the machines on which they are hosted. I believe you should buy computing platforms that provide facilities to isolate applications from one another, so that a

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Stephen Sprunk
Thus spake James Seng [EMAIL PROTECTED] The question: smart terminal or smart network? I believe in smart terminal. Nothing there suggest you should not run your firewall or any other filtering software on your end-terminal. End-machine are vulnerable? Then fixed the end-machine. It isnt

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Eric Rescorla
Michael Thomas [EMAIL PROTECTED] writes: So just saying that NAT is here get used to it is, architecturally, not helpful. The split of effort is to put it mildly a huge drain on engineering talent, but more importantly the net is becoming more and more incomprehensible because of it, both

Re: NAT box spec? (RE: myth of the great transition)

2003-06-19 Thread james woodyatt
On Wednesday, Jun 18, 2003, at 12:51 US/Pacific, Keith Moore wrote: [I wrote:] When customers of retail Internet service start demanding a NAT standard, then that's when the IETF might want to think about documenting the standard that the market seems to want. here's the only thing that a NAT

Re: primary purpose of firewalls

2003-06-19 Thread Stephen Sprunk
Thus spake Keith Moore [EMAIL PROTECTED] you know, I'm happy to say that I don't really know enough about Windows internals (for any version of Windows) to know for sure whether it provides those facilities or not. my honest guess is that recent versions do provide them, and that the reason

COACHES bof announcement

2003-06-19 Thread John Loughney
Hi all, Here is a heads-up on a new BOF for Vienna. br, John BOF NAME ACRONYM: Comprehensive apprOACH to quality (COACH) AREA: General BOF CHAIR(S): Bernard Aboba, John Loughney MAILING LIST: List: [EMAIL PROTECTED] Subscribe: [EMAIL PROTECTED] Body:

Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

2003-06-19 Thread Valdis . Kletnieks
On Thu, 19 Jun 2003 07:27:03 EDT, J. Noel Chiappa said: The person who's most in denial around here is you - about how definitively the market has, for the moment, chosen IPv4+NAT as the best balance between cost and effectiveness. Actually Noel, I think what he's in denial about is the fact

  1   2   >