[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: v6 host load balancing



 

>Yes I'm aware of both modes.  Since you mentioned the server told the
>client
>what server to use, I assumed you were talking about passive mode, which
>is what I was responding to above.

Sorry about not making it clear at the first place. Now we are on the same
page. One minor point: the passive mode was for old proxy firewalls, which
you can hardly find any around.


>You lost me here.  Since the passive open has the connection initiated
>by the client, there is no need for the firewall around the client to
>open a port based on listening to the control channel, right?

Ok, let me try to explain. Even for outgoing connections, the policy needs
to be matched on the firewall. (The firewall policy is just a complicated
version of access list to match 5 tuples, you can think that way if this is
any easy for you). And in most case, only one policy is defined for both FTP
control and data channel. This is for simplity and accounting, logging and
many other reasons, to list few. This is very common for all firewalls, not
just ours. The data channel can not match the policy defined for control
because of its dynamic port. So the firewall needs to open a hole (like a
dynamic policy for data channel).

>> The hole is opened only on the firewall which is dealing the
>> control channel. If the data channel goes to another file, apparently
this
>> will not work.

>I don't see why not.  It's just another outgoing TCP connection.

Is it clear now? If not, please forgive me, a white board discussion may be
better.

> FTP is just a classical example of this dynamic port problem that a
> firewall
> needs to deal with. For VoiP apps such H323 and SIP, similar problem
> exists
> as well and even severe. This is because the signalling channel and
media
> channel are totally different and destination are usually completely
> different.
> 
> 
> As a firewall/NAT/IDP company we've been struggling with these issues
all
> the time. It really adds lots of complexity to the system. I just
don't
> want
> to get it worse in IPv6, if not better.
> 
> Hope this makes sense to you.

Not particularly.  I'm still at the same point I was before where 
elaborating on what the exact scenario that fails is would help.

Thanks,
-Dave

> Changming

--------------------------------------------------------------------
IETF IPv6 working group mailing list
ipv6@ietf.org
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------