Subject: [ipfix-protocol] IPFIX entity?

From: Benoit Claise <[email-masked]>
Date: Thu, 14 Apr 2005 11:49:00 +0200

Hi,

I received this question from Paul Aitken, when he was reviewing the draft
What is an IPFIX entity below?

 11.4       When IPsec or TLS is not an option 
    
   The use of IPsec or TLS might not be an option because of 
   performance issues. 
    
   Without IPsec or TLS an IPFIX entity has no means to authenticate an 
   IPFIX entity other than the Source IP address.  Useful protection is 
   gained by allocating Exporter and Collector IP addresses from ranges 
   that are excluded from use by user traffic and preventing spoofing 
   attacks by proper ingress filtering.  Where large numbers of 
   Exporters, proxies and Collectors are used in a network, it may be 
   tempting for the administrator to not impose source IP address 
   restrictions but this leaves a proxy or Collector open to the 
   reception of invalid information.  Using an open proxy or Collector 
   is therefore discouraged.  

I don't recall who participate with this text...
New proposal welcome

Regards,  Benoit.

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Stewart Bryant <[email-masked]>
Date: Thu, 14 Apr 2005 15:53:13 +0100

> What is an IPFIX entity below?

I think that the term entity was used to mean Exporter/Collector/proxy
and was an attempt to simplify the text. Authentication has to take place
in both directions - the Exporter has to know that it is sending
IPFIX data to the genuine Collector, and similarly the Collector
has to know that it is receiving IPFIX data from the genuine Exporter.

> 11.4       When IPsec or TLS is not an option      The use of IPsec or 
> TLS might not be an option because of   performance issues.      Without 
> IPsec or TLS an IPFIX entity has no means to authenticate an   IPFIX 
> entity other than the Source IP address.  Useful protection is   gained 
> by allocating Exporter and Collector IP addresses from ranges   that are 
> excluded from use by user traffic and preventing spoofing   attacks by 
> proper ingress filtering.  Where large numbers of   Exporters, proxies 
> and Collectors are used in a network, it may be   tempting for the 
> administrator to not impose source IP address   restrictions but this 
> leaves a proxy or Collector open to the   reception of invalid 
> information.  Using an open proxy or Collector   is therefore discouraged. 
> 

How about:

11.4 When IPsec or TLS is not possible

The use of IPsec or TLS might not be possible in certain cases due to 
performance issues. Without IPsec or TLS the only way that an IPFIX
Exporter, proxy or Collector can authenticate each
other is by inspecting the IP source address of the packets carrying
the IPFIX messages and their transport acknowledgments.

Useful protection is gained by allocating Exporter and Collector IP
addresses from ranges that are excluded from use by user traffic and
hence preventing spoofing attacks by ingress packet filtering.

Where large numbers of Exporters, proxies and Collectors are used in a
network, it may be tempting for the administrator to not impose source
IP address restrictions but this leaves a proxy or Collector open to the 
reception of invalid information.  The use of an open proxy or Collector
is therefore discouraged.

Regards

Stewart