RE: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03

["Dan Wing" <dwing@cisco.com>]

> -----Original Message-----
> From: Gert Doering [mailto:gert@space.net] 
> Sent: Tuesday, August 26, 2008 4:49 AM
> To: Dan Wing
> Cc: 'Truman Boyes'; 'Brian E Carpenter'; 'Mark Smith'; 
> jhw@apple.com; 'IPv6 Operations'
> Subject: Re: Some suggestions for 
> draft-ietf-v6ops-cpe-simple-security-03
> 
> Hi,
> 
> On Mon, Aug 25, 2008 at 05:29:47PM -0700, Dan Wing wrote:
> > Internalt to external is permitted, by default, in the 
> current document.
> > 
> > We are discussing external to internal.  
> 
> What is "internal to external" is inevitably "external to internal" to
> someone else.
> 
> How do you solve "tunneling is permitted if solicited from 
> the inside" for the
> 
>   Host A --- CPE A ----[Internet]---- CBE B --- Host B
> 
> case?

The host (A and/or B) have to tell the CPE that they want the communication
to occur.

Let me ask the question the other way:  how do you prevent a mis-configured
application on Host A or Host B from being accessed from the Internet?  It is
my understanding such protection ('simple security') is the primary goal of
this working group document.

-d


> Gert Doering
>         -- NetMaster
> -- 
> Total number of prefixes smaller than registry allocations:  128645
> 
> SpaceNet AG                        Vorstand: Sebastian v. Bomhard
> Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. 
> Grundner-Culemann
> D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
> Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279