Re: NATs as firewalls and the NEA

2007-03-07 Thread Douglas Otis
On Mar 6, 2007, at 1:39 PM, Jeff Young wrote: For better or worse, the centralized means of control you mention may well come in the form of the latest IPTV networks being built by large telco providers. As telco battles cable for couch potatoes, they've realized that mucking with

RE: NATs as firewalls

2007-03-07 Thread Tony Hain
While I agree with Brian that the enterprise draft will be difficult, I also believe the SOHO one will be virtually impossible to get agreement over. The issue is that most ISP's don't yet get the point that the device needs to be dual managed, because they are still in the mindset that there

Re: IETF 70 73 Venue Locations

2007-03-07 Thread Fred Baker
that's the Westin Bayshore (aka Westin Picadilly), as opposed to the Westin Grand or the Westin Capital, right? On Mar 5, 2007, at 2:42 PM, IETF Administrative Director wrote: The IETF is pleased to announce its meeting locations for IETF's 70 and 73, and they are locations we have been to

Re: IETF 70 73 Venue Locations

2007-03-07 Thread Ray Pelletier
Fred Baker wrote: that's the Westin Bayshore (aka Westin Picadilly), as opposed to the Westin Grand or the Westin Capital, right? Yes, the Westin Bayshore. Ray On Mar 5, 2007, at 2:42 PM, IETF Administrative Director wrote: The IETF is pleased to announce its meeting locations for

Re: [Fwd: Fwd: Re: Last Call: draft-ietf-6lowpan-problem (6LoWPAN: Overview, Assumptions, Problem Statement and Goals) to Informational RFC]

2007-03-07 Thread Pekka Savola
Hi, On Tue, 6 Mar 2007, Geoff Mulligan wrote: You question about switches does point to an overloaded term. In that particular paragraph the switches we are talking about are electrical switches, as in light switches, not network switches. We'll fix the wording. I guessed as much, which is

RE: NATs as firewalls

2007-03-07 Thread michael.dillon
is a crisis to force action. That will occur sometime after 2010 when they need more than they already have and find that the lease price per IPv4 address per day has been moving up from its current averages of $1/day or $5/day depending on contract length (a price service providers seem

FYI: Daylight Savings Time discrepancy

2007-03-07 Thread Brian E Carpenter
Hi folks, North America changes to Daylight Savings Time this weekend 10/11 March. Europe changes two weeks later, 24/25 March, immediately after the IETF. This has consequences. 1. During those two weeks, the time difference between North America and Europe will be one hour less than usual.

Re: NATs as firewalls

2007-03-07 Thread Eliot Lear
[EMAIL PROTECTED] wrote: is a crisis to force action. That will occur sometime after 2010 when they need more than they already have and find that the lease price per IPv4 address per day has been moving up from its current averages of $1/day or $5/day depending on contract length (a price

RE: NATs as firewalls

2007-03-07 Thread John C Klensin
(off list) --On Tuesday, 06 March, 2007 15:46 -0800 Tony Hain [EMAIL PROTECTED] wrote: While I agree with Brian that the enterprise draft will be difficult, I also believe the SOHO one will be virtually impossible to get agreement over. I agree, although I think we might disagree a bit about

RE: NATs as firewalls

2007-03-07 Thread John C Klensin
--On Wednesday, 07 March, 2007 09:55 + [EMAIL PROTECTED] wrote: ... Also, even though there are only 3 years supply left in IANA, to date none of the RIRs have changed their allocation policies to deal with wind-down of IPv4 space or scarcity. Certainly in some regions, there is the

Prague

2007-03-07 Thread Edward Lewis
I will attest to Prague being survivable. I have been there once already and suffered no ill effects and was not robbed. I.e., don't panic. Location for location, the IETF (only) goes to the tamest and most accessible places in the world. Compare it to other Internet organizations. At

RE: NATs as firewalls

2007-03-07 Thread Hallam-Baker, Phillip
I agree with John's analysis of the constraints here. It may be possible to get the ISPs to move on the expectation that if they do nothing government coertion will follow. The caveat here being that the pressure the vendors are most likely to be responsive to would be from the US and it is

[Dan Harkins] comments on draft-houseley-aaa-key-mgmt-07.txt

2007-03-07 Thread Sam Hartman
Hi, folks. The following last call comment was received and based on discussion the draft was updated. This comment never seems to have made it to the ietf list though. The following text was added to address the comment. Please confirm that this text addresses the comment and that from the

Re: Prague

2007-03-07 Thread Brian E Carpenter
On 2007-03-07 16:58, Marshall Eubanks wrote: I have been to Prague 3 times in the last 5 years. It is quite survivable. However, the taxi's are ... unregulated. I would suggest that IETFers never take a cab on the street. You may pay 50 Euros to go 1 km. Get the hotel, store, restaurant,

Re: Prague

2007-03-07 Thread John C Klensin
--On Wednesday, 07 March, 2007 10:54 -0500 Edward Lewis [EMAIL PROTECTED] wrote: I will attest to Prague being survivable. I have been there once already and suffered no ill effects and was not robbed. I.e., don't panic. Location for location, the IETF (only) goes to the tamest and most

RE: NATs as firewalls

2007-03-07 Thread John C Klensin
--On Wednesday, 07 March, 2007 08:07 -0800 Hallam-Baker, Phillip [EMAIL PROTECTED] wrote: I agree with John's analysis of the constraints here. [skipping the conjectures about US politics -- it is a much longer discussion that isn't clearly suitable for the IETF list] The ISPs face costs

Re: Prague

2007-03-07 Thread Dave Crocker
Edward Lewis wrote: I will attest to Prague being survivable. I have been there once already and suffered no ill effects and was not robbed. I.e., don't panic. ... At 14:52 -0500 3/6/07...: ... Under the entry for taxis from the airport they say Warning: Prague's taxi drivers ... When

RE: NATs as firewalls

2007-03-07 Thread michael.dillon
(i) there is every reason to expect a run on remaining addresses at some point, whether induced by public coverage, larcenous providers, ISP or RIR anxieties, or something else. In other words HIGH PUBLIC PROFILE. Interestingly, this roughly coincides with increased

SecDir Review of draft-ietf-v6ops-natpt-to-historic-00

2007-03-07 Thread Narayanan, Vidya
I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors should treat these comments just like any other last

Re: Prague

2007-03-07 Thread Ralph Droms
I visited Prague about two years ago and had the same experience as Ed. I traveled via the Metro and on foot, visited all the tourist traps; had no problems and never felt unsafe. - Ralph On 3/7/07 10:54 AM, Edward Lewis [EMAIL PROTECTED] wrote: I will attest to Prague being survivable. I

RE: Prague

2007-03-07 Thread ASH, GERALD R, ATTLABS
You can arrange a taxi pick up at the airport directly with the Hilton (Hilton taxi driver will be waiting in the arrivals hall right behind the customs holding a sign with your name and Hilton Logo). Cost for taxi (CZK 750, EUR 25) can be posted to your hotel account. Jerry -Original

RE: Prague

2007-03-07 Thread David Harrington
Hi, I travelled to Prague after the Vienna IETF in 2003. It's a city; you need to take city precautions. There are signs of poverty, mostly outside the city center. I was surprised when I arrived (by train) by people aggressively trying to rent me a room in their house, and by taxi drivers who

Re: Prague

2007-03-07 Thread Ole Jacobsen
Just to add to Dave's comments: The information provided needs to be based on reality rather than hyperbole. A bunch of us just returned from Bali which according to the US State Department is a place you should not even think about visiting, and required Senior VP approval to go. Yet, I am

Re: Prague

2007-03-07 Thread Lucy Lynch
On Wed, 7 Mar 2007, John C Klensin wrote: --On Wednesday, 07 March, 2007 10:54 -0500 Edward Lewis [EMAIL PROTECTED] wrote: I will attest to Prague being survivable. I have been there once already and suffered no ill effects and was not robbed. I.e., don't panic. Location for location, the

Re: IETF 70 and 73 Venue Announcement

2007-03-07 Thread Thierry Ernst
I have some basic observations: - for non North-American, that's too many IETF meetings in North America. The IETF should have a fallback in other places than North American - for non North-Americans, there are different criterias for defining what normality is (I ACK Dave on the other thread

RE: NATs as firewalls

2007-03-07 Thread Hallam-Baker, Phillip
From: John C Klensin [mailto:[EMAIL PROTECTED] And, when I conclude that IPv6 is inevitable (unless someone comes up with another scheme for global unique addresses RSN), Here we disagree, I don't think that IPv6 is inevitable. When I model the pressures on the various parties in the

Re: [Dan Harkins] comments on draft-houseley-aaa-key-mgmt-07.txt

2007-03-07 Thread Dan Harkins
Hi Sam, Thanks for the update. My original comment never made it to the ietf list because I wasn't a member at the time of posting. I was informed that if the moderator approved my posting it would be sent to the list, unfortunately it wasn't. :-( In the new Peer and authenticator

RE: NATs as firewalls

2007-03-07 Thread Hallam-Baker, Phillip
The idea that the US is not affected by IPv4 address space exhaustion is a canard. The US runs out of addresses the same day as everywhere else. US organizations are certainly over-represented in the list of organizations holding underutilized IPv4 address blocks. But the fact that MIT has net

RE: Prague

2007-03-07 Thread Janet P Gunn
For those of you with experience in Prague/Czech Republic- How practical is it to rent a car? There are a couple of places outside Prague I would like to visit on the weekend (in particular the JAWA Motorcycle Museum of Konopiště, about 20 miles outside Prague), and I am considering renting a

Re: [Dan Harkins] comments on draft-houseley-aaa-key-mgmt-07.txt

2007-03-07 Thread Sam Hartman
Dan, again, with the text as it stands, what attacks do you see permitted by these requirements that you believe should not be permitted. The text changes you proposed were considered but are rather problematic for existing protocols. I don't think we mind mandating changing protocols for real

RE: NATs as firewalls

2007-03-07 Thread Tony Hain
Eliot Lear wrote: [EMAIL PROTECTED] wrote: is a crisis to force action. That will occur sometime after 2010 when they need more than they already have and find that the lease price per IPv4 address per day has been moving up from its current averages of $1/day or $5/day depending on

RE: NATs as firewalls

2007-03-07 Thread Tony Hain
JFC Morfin wrote: Dear Phillip, I do not think USA will have any say into this. For several reasons. They are the last to be harmed by IPv4 addresses shortage and most probably the home of the addressquatters. This is BS that just has to stop. The ARIN region continues to burn through ~30%

Re: NATs as firewalls, cryptography, and curbing DDoS threats.

2007-03-07 Thread Douglas Otis
On Mar 7, 2007, at 9:01 AM, John C Klensin wrote: It is true that I tend to be pessimistic about changes to deployed applications that can't be sold in terms of clear value. I'm also negative about changing the architecture to accommodate short- term problems. As examples of the latter,

Re: NATs as firewalls

2007-03-07 Thread Fred Baker
On Mar 7, 2007, at 11:38 AM, Elwyn Davies wrote: Also this appears to be tied to the US business model where the ISP supplies you with the box and you don't get to change it (or even own it). Do they do that in the US? I'm not aware of it...

RE: NATs as firewalls

2007-03-07 Thread Darryl (Dassa) Lynch
Hallam-Baker, Phillip wrote: From: John C Klensin [mailto:[EMAIL PROTECTED] And, when I conclude that IPv6 is inevitable (unless someone comes up with another scheme for global unique addresses RSN), Here we disagree, I don't think that IPv6 is inevitable. When I model the pressures on

RE: NATs as firewalls, cryptography, and curbing DDoS threats.

2007-03-07 Thread Hallam-Baker, Phillip
Doug makes a critical point here: In order to successfully make a technology transition at the IP layer we have to change the way in which we use the DNS layer. Another way to look at the routing problems exposed by NAT is that they are the result of relying on the IP layer for signalling

Re: [Dan Harkins] comments on draft-houseley-aaa-key-mgmt-07.txt

2007-03-07 Thread Lakshminath Dondeti
Hi Sam, Many thanks for the opportunity to comment on the proposed text before approval. I do have concerns with the proposed text. Some of the new requirements are overly burdensome. In other places, it is not clear what is expected. Some notes below: Sam Hartman wrote: Hi, folks.

DNS role (RE: NATs as firewalls, cryptography, and curbing DDoS threats.)

2007-03-07 Thread Harald Tveit Alvestrand
Here I was thinking that the DNS needs to be an useful name lookup service for the Internet to function, and now PHB tells me it's a signalling layer. Either I have seriously misunderstood the nature of signalling, seriously misunderstood the nature of the DNS, or I have reason to dislike this

Re: DNS role (RE: NATs as firewalls, cryptography, and curbing DDoS threats.)

2007-03-07 Thread Douglas Otis
On Mar 7, 2007, at 3:00 PM, Harald Tveit Alvestrand wrote: Here I was thinking that the DNS needs to be an useful name lookup service for the Internet to function, and now PHB tells me it's a signalling layer. Either I have seriously misunderstood the nature of signalling, seriously

RE: NATs as firewalls

2007-03-07 Thread Hallam-Baker, Phillip
Quite, the dissappearance of un-NATed IPv4 is inevitable. Regretably the ready availability of IPv6 is not. There are two possible future outcomes here. The first is that the only widely available option is NAT-ed IPv4. The second is a dual stack offering that combines NAT-ed IPv4 with full

RE: NATs as firewalls

2007-03-07 Thread Jeffrey Hutzelman
On Wednesday, March 07, 2007 04:23:20 PM -0800 Hallam-Baker, Phillip [EMAIL PROTECTED] wrote: We do need to revise the architecture description. Using IP addresses as implicit signalling You keep using that word. I do not think it means what you think it means. Another instance that

RE: DNS role (RE: NATs as firewalls, cryptography, and curbing DDoS threats.)

2007-03-07 Thread Hallam-Baker, Phillip
OK I will restate. All connection initiation should be exclusively mediated through the DNS and only the DNS. The reason I introduced the term signalling was precisely because setting up a connection today involves more than naming. Saying that the DNS should be the exclusive naming

RE: NATs as firewalls

2007-03-07 Thread Hallam-Baker, Phillip
Wildcards are not permitted in the new Extended Validation certificates. -Original Message- From: Jeffrey Hutzelman [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 07, 2007 7:59 PM To: Hallam-Baker, Phillip; ietf@ietf.org Cc: Jeffrey Hutzelman Subject: RE: NATs as firewalls

Re: [Dan Harkins] comments on draft-houseley-aaa-key-mgmt-07.txt

2007-03-07 Thread Dan Harkins
Sam, The problem I see is that when AAA is used as a key distribution protocol there are 3 parties involved (peer, AAA server and authenticator) and it's a 2 party model. For existing protocols-- the peer is speaking to a NAS and the NAS obtains a key for the peer from the AAA server-- the

RE: NATs as firewalls

2007-03-07 Thread David Morris
On Thu, 8 Mar 2007, Darryl (Dassa) Lynch wrote: Hallam-Baker, Phillip wrote: From: John C Klensin [mailto:[EMAIL PROTECTED] There is a major difference between a NAT box plugged into the real Internet and a NAT box plugged into another NAT box. It is a pretty ugly one for the

Re: NATs as firewalls

2007-03-07 Thread Mark Andrews
On Thu, 8 Mar 2007, Darryl (Dassa) Lynch wrote: Hallam-Baker, Phillip wrote: From: John C Klensin [mailto:[EMAIL PROTECTED] There is a major difference between a NAT box plugged into the real Internet and a NAT box plugged into another NAT box. It is a pretty ugly one for the

RE: NATs as firewalls

2007-03-07 Thread John C Klensin
--On Wednesday, 07 March, 2007 10:14 -0800 Hallam-Baker, Phillip [EMAIL PROTECTED] wrote: ... IPv6 is not inevitable, the issue is how to make it so. I believe that we need a branding scheme that tells the user that they are getting a next generation Internet hookup, that they have a next

RE: [Dan Harkins] comments on draft-houseley-aaa-key-mgmt-07.txt

2007-03-07 Thread Narayanan, Vidya
Since there is no binding of identities it allows an authenticator to say give me the key for authenticator FOO even though it is actually authenticator BAR. For instance the NAS-Id is put into a RADIUS request to ask for a specific key and the key is sent back protected by the shared

RE: [Dan Harkins] comments on draft-houseley-aaa-key-mgmt-07.txt

2007-03-07 Thread Dan Harkins
If you have a 3 party key distribution scheme and at the end of it the 3 parties do not share ALL THE SAME STATE yet believe the protocol has successfully completed then your key distribution scheme is flawed. Dan. On Wed, March 7, 2007 8:32 pm, Narayanan, Vidya wrote: Since there is no

RE: DNS role (RE: NATs as firewalls, cryptography, and curbing DDoS threats.)

2007-03-07 Thread Harald Tveit Alvestrand
--On 7. mars 2007 17:06 -0800 Hallam-Baker, Phillip [EMAIL PROTECTED] wrote: OK I will restate. All connection initiation should be exclusively mediated through the DNS and only the DNS. OK, I'll restate too. In my opinion, we should never introduce any function that involves the DNS

Re: Prague

2007-03-07 Thread Fred Baker
On Mar 7, 2007, at 7:58 AM, Marshall Eubanks wrote: the taxi's are ... unregulated. I would suggest that IETFers never take a cab on the street. You may pay 50 Euros to go 1 km. Get the hotel, store, restaurant, whatever, where you are to order you a cab, and you won't have problems. This

Re: [Dan Harkins] comments on draft-houseley-aaa-key-mgmt-07.txt

2007-03-07 Thread Lakshminath Dondeti
Dan Harkins wrote: Sam, But for things like HOKEY or 802.11r they want to have the AAA server create a key hierarchy rooted off the EMSK or the MSK, respectively, that contains keys for specific authenticators. These keys are going to be distributed using AAA (that seems to be the

Re: Prague

2007-03-07 Thread Fred Baker
On Mar 7, 2007, at 3:57 PM, Jari Arkko wrote: I think we should boldly go where no IETF has gone before (but millions of other people have, safely). I'll agree if I can change the phrase ever so slightly. I would like to see the IETF meet where IETF participants live. Over time, I would

Re: Prague

2007-03-07 Thread Tim Bray
I haven't been following this discussion closely, but in case nobody else has made the point: the bad news is that the Prague taxi-driver community is (in my personal experience) crooked, while on the other hand Prague public transit is quite efficient. Last time I was there I arrived late and

Re: [Dan Harkins] comments on draft-houseley-aaa-key-mgmt-07.txt

2007-03-07 Thread Dan Harkins
Hi Lakshminath, That's not entirely correct. As I recently stated to your colleage if a 3 party key distribution scheme finishes and all 3 parties think it finished successfully but they do not agree on all state then the scheme is flawed. I see the path you're trying to go down-- add a

Protocol Action: 'TCP Extended Statistics MIB' to Proposed Standard

2007-03-07 Thread The IESG
The IESG has approved the following document: - 'TCP Extended Statistics MIB ' draft-ietf-tsvwg-tcp-mib-extension-15.txt as a Proposed Standard This document is the product of the Transport Area Working Group Working Group. The IESG contact persons are Lars Eggert and Magnus Westerlund. A

Impending publication: draft-iab-raws-report-01.txt

2007-03-07 Thread Leslie Daigle
The IAB is ready to ask the RFC-Editor to publish Report from the IAB Workshop on Routing and Addressing draft-iab-raws-report-01.txt as an Informational RFC. This document is a report from an invitational workshop convened by the IAB. As such, it represents the