Re: 9 reasons for dynamic authorization records

On Fri, Feb 13, 2004 at 09:58:31AM -0500, Alan DeKok wrote:
> >   would have to update their zone file every second if the wanted 
> >   to support their traveling employees/customers.
> 
>   This means that their network design is incorrect.  The travelling
> employees can use VPN's to connect back to corporate headquarters to
> send mail.  Companies that don't do that should understand that the
> price for not doing that work is more work of a different nature.
> (i.e. DNS updates)


Alan, 

you're kidding. That's far from reality.


- Not every ISP or MSP is willing to allow its customers a 
  VPN connection. 

- Try to open a VPN connection to Hotmail, Yahoo, AOL,GMX,
  T-Online,...

- VPN requires to have a VPN capable device. Every tried to 
  open a VPN connection from an Airport internet terminal or 
  an Internet Cafe?

- VPN is encryption, which is not allowed in all legislations 
  of the world. We need a solution which works everywhere.

- VPN is encryption and thus requires key management. 
  That's too complex to be widely deployed.

- Setting up VPN connections is (currently) far from beeing 
  trivial, especially when connecting between devices of 
  different Vendors. 

- Many people site behind a firewall which will not allow 
  to open a VPN connection from the LAN to somewhere in the world. 


I've already pointed out why DNS updates are not feasible in 
such cases.

regards
Hadmut