Subject: [OFF-PATH-BOF] How does an endpoint discover a local policy by DHCP?

From: Kylin Wei <[email-masked]>
Date: Mon, 18 Sep 2006 11:35:27 +0800

Dear off-path experts,

How does an endpoint discover a local policy by DHCP? Who can tell me
detailed approach?

Thanks in advance.

Kylin Wei 

_______________________________________________
OFF-PATH-BOF mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/off-path-bof

---

From: "Paul Francis" <[email-masked]>
Date: Mon, 18 Sep 2006 07:18:53 -0400

I don't think any of us envisioned that an endpoint would learn policy via
DHCP.

PF

-----Original Message-----
From: Kylin Wei [mailto:[email-masked]] 
Sent: Sunday, September 17, 2006 11:35 PM
To: [email-masked]
Subject: [OFF-PATH-BOF] How does an endpoint discover a local policy by DHCP?

Dear off-path experts,

Thanks in advance.

Kylin Wei

---

From: Scott W Brim <[email-masked]>
Date: Mon, 18 Sep 2006 08:27:51 -0400

> I don't think any of us envisioned that an endpoint would learn policy via

Rather, a policy server?

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 18 Sep 2006 08:45:23 -0400

What type of policies are we talking about?

Ciao
Hannes

---

From: "Paul Francis" <[email-masked]>
Date: Mon, 18 Sep 2006 09:54:18 -0400

How the boxes that have policy get their policy I think of as peripheral to
the core problem.  There may of course be lots of value in standardizing this
interface (in what we implemented, we use CPL), but as a researcher I don't
see any particularly interesting issues here.  Am I wrong?

PF

-----Original Message-----
From: Scott W Brim [mailto:[email-masked]] 
Sent: Monday, September 18, 2006 8:28 AM
To: Paul Francis
Cc: Kylin Wei; [email-masked]
Subject: Re: [OFF-PATH-BOF] How does an endpoint discover a local policy by
DHCP?

On 09/18/2006 07:18 AM, Paul Francis allegedly wrote:
> I don't think any of us envisioned that an endpoint would learn policy 
> via DHCP.

Rather, a policy server?

---

From: Saikat Guha <[email-masked]>
Date: Tue, 19 Sep 2006 02:08:48 -0400

> > I don't think any of us envisioned that an endpoint would learn policy via

If the question is how someone learns of which policy server to use ...

Signaling packets go 1) up, 2) across, and 3) down; and the next-hop
policy server on each segment is determined differently.

1) UP: Drilling out towards the Internet through multiple layers of
firewalls ... a packet (any packet) is sent outwards, a firewall/M-Box
intercepts it and responds with an ICMP-like error message that informs
the source what policy server to contact for auth.

2) ACROSS: Packet goes from internet-facing firewall of the stack of
firewalls for the source to the internet-facing firewall of the
recipient. The signaling server for the recipient's domain is resolved
over DNS through SRV-type records.

3) DOWN: Drilling down to the destination through multiple firewalls.
When the destination registers its presence it creates a chain of
registrations to the internet-facing signaling proxy for his domain
(chain discovered through the drill-out in #1 above). The signaling
packets bound for the destination follow the reverse route of the
registration-chain.

-- 
Saikat

---

From: Kylin Wei <[email-masked]>
Date: Tue, 19 Sep 2006 15:31:21 +0800

Hi Saikat,

Thank you very much for your detailed introduction. 
I should say sorry because I make a mistake. My original question is "How
does an endpoint discover a local policy box by DHCP".

Kylin Wei 

> From: Saikat Guha [mailto:[email-masked]]
> Sent: Tuesday, September 19, 2006 2:09 PM
> To: Scott W Brim
> Cc: [email-masked]
> Subject: Re: [OFF-PATH-BOF] How does an endpoint discover a local policy
> byDHCP?
> 
via