Subject: RE: network controls are necessary

From: "Christian Huitema" <[email-masked]>
Date: Fri, 6 Dec 2002 08:49:46 -0800

> If we really want the hosts to make the choice (a concept I am
doubtful
> of)
> I suppose we could invent a query / response protocol for the purpose
of
> asking a routing intelligent server what source /dest pair from a
given
> set
> of sources and dests would be a good pair to use.

I am much more optimistic than Joel about the possibilities of hosts.
The average PC has as much CPU and memory as the average router, if not
more; even small appliances tend to have much more memory and CPU than
the routers of yesteryears, which we trusted to make routing decisions
at the time.

I like the way Tony phrased the problem. I think that any solution
should allow a smart host to manage the set of "locators" that it want
to use. (Rant: an old tenet of networking is that a name is not an
address and an address is not a route; I don't see why we would need to
invent new names and refer to names as identifiers and addresses as
locators.) 

Clearly, there is an issue with the smallest appliances, which can at
best be expected to perform random choices. In most cases, it does not
matter, as most of the smallish appliances communications are likely to
take place inside a single site. But to be general, we need to either
ensure that the default choices work, or somehow let the appliances be
informed by the routing fabric. 

There is also an issue with policy enforcement. However, we already have
mechanisms to inform the hosts: router advertisements can carry
preferences for this or that prefix or router; ICMP can inform the hosts
that their choices are not acceptable. In fact, ICMP can also be used
from the site exit router(s) to suggest alternatives on a case by case
basis.

-- Christian Huitema

---

From: Michael Richardson <[email-masked]>
Date: Fri, 06 Dec 2002 12:54:02 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Christian" == Christian Huitema <[email-masked]> writes:
    Christian> I am much more optimistic than Joel about the possibilities of hosts.
    Christian> The average PC has as much CPU and memory as the average router, if not

  As am I.

    Christian> Clearly, there is an issue with the smallest appliances, which can at
    Christian> best be expected to perform random choices. In most cases, it does not

  1) *Today's* smallest appliances rival the high end desktop systems of less than a
     decade ago.
  2) if the defaults work okay, except during network failures, it might not matter
     if my gas meter is a bit unresponsive. 

    Christian> There is also an issue with policy enforcement. However, we already have
    Christian> mechanisms to inform the hosts: router advertisements can carry
    Christian> preferences for this or that prefix or router; ICMP can inform the hosts
    Christian> that their choices are not acceptable. In fact, ICMP can also be used
    Christian> from the site exit router(s) to suggest alternatives on a case by case
    Christian> basis.

  Router advertisements I will trust. Not because they are unspoofable, but
because we have to secure them anyway (SEND issue).

  I would love to be able to secure ICMPs from the site exit routers. I am
skeptical that we will be able to do that. I expect my link-local routers to
be able to develop a trust relationship with the site exit routers much
easier than an end-system can.

  Yes, as Bill says, we have to have strong indications of cacheability.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [