Subject: [Isms] Firwalls and NATs

From: "Wijnen, Bert (Bert)" <[email-masked]>
Date: Fri, 19 Aug 2005 16:01:43 +0200

Eliot, I am picking on some text from your posting:
> We have demonstrable proof in the form of FTP that having one 
> connection in one direction and another connection in another
> is a serious mistake, thanks again to firewalls and NATs.
> We have them, let's please not stick our heads in the sand
> (again).  Let connection directionality flow in a single
> direction - the one that works (whatever that might be).
> 

I would like you to explain to me how this applies (or is inscope)
for ISMS. It may be just me... so bear with me please.

I explicitly also invite operators to chime in if I have it
wrong or right. That would be very good input. I rather hear
them speak up for themselves as opposed to vendors "channeling
their customer requirements". 

- I believe that many networks and network devices are being
  managed from the inside. I.e. there is no need to go and
  pass through a firewall or NAT in order to manage the
  network device or network service.
- Specifically large operators have been pushing on us
  (boeing, us governement, ... ) that we need to blend in
  with existing NM infrastructure (I believe that SSH and
  use of RADIUS was also explicitly mentioned)
- Some operators (ISPs) possibly manage things like ADSL
  or cable modems at their curtomer sites. But even then,
  I think they manage it from the inside side of the NAT
  or firewall, and they do not go and manage systems
  inside the customer premises.

So, I am not saying that the issue does not exist at all, but
I do wonder (and I do not know, so that is why I am asking)
if the oeprators who are interested to work with us to get
this integration of security infrastructure for SNMP, if 
those operators indeed need to manage all sorts of devices
and services outside (i.e. beyond a firewall or NAT).
If that number is only a very small percentage, then maybe
we should focus on the majority of situations first and
do the remaining small piece later (in a 2nd step) if at all.

Just thinking aloud and asking questions,
Bert

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms