DEFCON BOF Report

["James Kempf" <kempf@docomolabs-usa.com>]

Defcon is a proposal for protocols and other support for a distributed firewall
architecture where the firewall is distributed rather than on the perimiter.
Steve Bellovin has proposed the architecture but was not present due to conflict
of interest, Randy Bush chaired. I arrived at the BOF somewhat late, due to the
need to be in IPv6 for the KRE Appeal discussion. I managed to catch two
presentations, one on MIDCOM applicability and one on requirements for wireless
networks.

Process discussion was around the need for a more focussed charter. The current
charter has a very large number of potentail deliverables. There was also some
discussion around the fact that the chairs were authors for 2 of the three
documents, and whether they would be willing to give up authoriship if they were
to become WG chairs, and whether anybody in the room would be interested in
actually doing the work. This discussion was inconclusive, so it is unclear at
this point whether the requisite number of committed people exist for the long
haul, though clearly there is interest.

Technical discussion centered around whether the protocol could be both general
enough to accomodate requirements of specific application protocols yet specific
enough that it would be attractive to vendors and operators and could actually
be implemented and deployed. Ongoiing work on general COPS-based policy was
cited as an example of something that is too general. This question led to a
short "general policy language" rathole discussion. Clearly, if the work is
chartered, there will be need for close interaction with other working groups,
such as SIP and possibly Mobile IP, that will have requirements in the area to
keep the WG grounded in reality. Managing that interaction to come up with
something specific enought to be useful but not overly focussed on one
particular application or area will be a major key for success.

Getting a focussed charter and identifiying people committed for the long haul
is a necessary prerequisite, but the technical problem is clearly an important
one (especially but not exclusivly for wireless).

            jak