Re: draft-ietf-v6ops-cpe-simple-security: filtering encapsulated flows

[james woodyatt <jhw@apple.com>]

On Aug 24, 2009, at 11:33, Mark Baugher wrote:

> The node that accepts the IKE phase 1 presumably has some acl or  
> credential requirement to control access - or could have.  I thought  
> that this was the idea behind the original recommendation.

I'm always getting confused about whether we're presuming that the  
interior node is well secured or that the interior node has some  
hypothetical vulnerability that can be remotely exploited to obtain  
access to the rest of the interior network.  I'm often making the  
wrong assumption in the wrong context, and I suspect I just don't have  
sufficient network security expertise to know which assumption to make  
in what scenario.

Hence, my tendency to defer to the people with more credible claims to  
such expertise.  Let them take the heat for mistakes of that  
category.  That's what they get paid to do.


--
james woodyatt <jhw@apple.com>
member of technical staff, communications engineering