Subject: RE: Next question...

From: "Tony Li" <[email-masked]>
Date: Fri, 6 Dec 2002 19:26:16 -0800

|   >>> Tony Li wrote:
|   >>> 2) Put the locators in the border router.  This frees
|   >>>    the host of the management burden, but makes it
|   >>>    somewhat harder for a site to provide site-wide
|   >>>    policy.
|   
|   2000 hosts: small potatoes. Allow me to rephrase my 
|   question: if you put
|   locators in the border router and they are unknown to the hosts, why
|   would it be harder? You would not have to communicate policy to the
|   hosts.

Would you believe that it's because I am an idiot?

First, what I wrote is the exact opposite of what I was thinking. 
Second, even that was wrong.  ;-)

What I should have written was:

2) Put the locators in the border router.  This frees the host
   of the management burden, but makes it somewhat harder for the
   host administrator to implement host specific policies without
   the assistance of the administrator of the border router.  Host
   specific policies can still be implemented, they just need to
   be managed by the border router.  The number of unique host
   policies can be a scalability issue for the border router.

Fair enough?

Tony

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Sat, 7 Dec 2002 20:05:13 +0100 (CET)

>    policies can be a scalability issue for the border router.

I would still like some hint from the host to the border router that the
current connection isn't working.

If a host needs specific policies, would it be possible to "move the
border" for that host to that host? Then the real border routers only
have to pass the traffic without touching it and the host is in full
control, the border routers only get to say yes or no, which should be
enough to keep rogue sysadmins in check.

Iljitsch