Re: RE : [midcom] More on new work item

[Joel Tran <joel.tran at USherbrooke.ca>]

Selon Jonathan Rosenberg <jdrosen@dynamicsoft.com>:

> 
> 
> Joel Tran wrote:
> 
> > Jonathan Rosenberg, you raised a good point.
> > 
> > There are however some ISPs that are deploying NAT/Firewall (i.e. China,
> > Europe, Africa). In such case, DHCP might be useful. The ISP might do
> some
> > load balancing. Thus, DHCP method will provide a mean for the ISP to
> > configure dynamically third-end party devices. As for the security
> > information, this might be entered by the user to the third-end party
> device
> > (ex: same id/password as for the ADSL authentication).
> 
> There is a serious trust issue here. Is the ISP really going to issue a 
> username and password to every user of their network, entrusting them 
> with permissions to use midcom to manage port bindings on their network 
> wide NAT?? I certainly hope not. Thats an open invitation for 
> substantial denial of service attacks.
> 
> -Jonathan R.

Correct me if I'm wrong. I don't think it is an open invitation for DOS attack 
if there is a proper Access Control List/Policy Rule in the Midcom device which 
may limit the use of the port bindings for each user. 

...J

_______________________________________________
midcom mailing list
midcom@ietf.org
https://www1.ietf.org/mailman/listinfo/midcom