Re: [IPsec] draft-kivinen-ipsecme-esp-null-heuristics comments

["Grewal, Ken" <ken.grewal at intel.com>]

Stateless firewalls are commonly employed for efficiency and as a crude method for cutting off access to certain services - these are useful for basic access control in cost effective, high bandwidth, network scenarios. E.g. Corporations may not want to allow various P2P protocols, discovery of resources, access to certain services (especially if using UDP as the underlying protocol), remote access/management to certain resources from outside well established network boundaries, etc., etc.. There are thousands of well defined ports providing different services from legacy, experimental, to the 'latest, greatest, service of the day' - and someone just found an exploit for and there is no fix available! How do you ensure that your network doesn't get inundated with unwanted traffic or exploited? Block that port!!

Stateless firewalls can and do provide the fundamental building blocks for basic access control. In these scenarios, the need to differentiate between encrypted / NULL ESP traffic is required to enforce these policies, without the need or burden of keeping state on 'connections' or 'security sessions'.

Thanks, 
- Ken
 

>-----Original Message-----
>From: ipsec-bounces at ietf.org [mailto:ipsec-bounces at ietf.org] On Behalf Of
>Yoav Nir
>Sent: Tuesday, February 10, 2009 11:52 AM
>To: gabriel montenegro; Tero Kivinen; Grewal, Ken
>Cc: ipsec at ietf.org; Dragan Grebovich
>Subject: Re: [IPsec] draft-kivinen-ipsecme-esp-null-heuristics comments
>
>gabriel montenegro wrote:
>
>>I'll just comment on one item below:
>>
>>> As the draft says this is mostly meant for stateful devices, and that
>>> has been the main goal for the document. The charter says:
>>>
>>> "A standards-track mechanism that allows an intermediary device, such
>>> as a firewall or intrusion detection system ..."
>>>
>>> I.e. the main goal was set to be on the devices doing deeper
>>> inspection i.e. firewalls and intrusion detection systems.
>>
>>Disagree completely. The charter item is a general one for intermediary
>devices
>>(some of which are and are expected to continue being stateless).
>>
>>The above was just an example.
>
>OK, so give us a counter-example. Why would a stateless device want to be
>able to tell the difference between ESP-AES-CBC and ESP-NULL.  What policy
>is it trying to enforce?
>
>
>
>
>Email secured by Check Point
>_______________________________________________
>IPsec mailing list
>IPsec at ietf.org
>https://www.ietf.org/mailman/listinfo/ipsec