Re: firewalls (Re: How to specify the local ip address to connect from)

On Tue, 30 Oct 2012 22:23:13 -0500
"Craig A. Berry" <[email protected]> wrote:

> And you also assumed it's a single organization that designs the
> architecture of the network and the architecture of the services and
> applications.

Quite so.  From time to time questions are asked here that make me
wonder, "But why?".  Sometimes by asking I help the person asking to
find an easier way.  And sometimes the siituation turns out to be one I
haven't dealt with.  

> > I see no reason to have a firewall between a TDS server and client,
> 
> I get the feeling that internal firewalls are on the rise, especially
> the ones that do "deep packet inspection."  

What was that your said about rational organizations?  Back when I was
riding the Pony Express, they told us networks exist to facilitate
communication, not to prevent it.  

> > If the reason is "security" then the answer should explain the
> > specific threat, and why ordinary routing rules are insufficient.  
> 
> I suspect there are piles of whitepapers that attempt to do just that
> but it's not something I've ever looked into. 

That may be.  I approach security policies skeptically because in
general they follow a feasibilty gradient: the policy in force is that
which is technically feasible.  We control what we can because we can,
nothing more.  

--jkl