Re: port blocking (was Re: CELP (was RE:) )

[Tim Shepard <shep@alum.mit.edu>]

> Why would anyone want to filter based on port numbers? It provides no 
> real security, just headaches. On the other hand, I can understand that 
> people are unconfortable having internal hosts communicate with 
> external ones without being able to see what's going on. A way to solve 
> this would be to include firewalls in the authentication and 
> authorization negotiations.

Well, I agree with you.  But apparently there are some who have
raised objections to end-to-end encryption that does not allow a
meddling middlebox to discriminate based on port numbers.  I was
just pointing out that any such objection to HIP would be no
different than an objection to IPSEC in general.

			-Tim Shepard
			 shep@alum.mit.edu