Internet Source address filtering in 3G Networks

Hi Xiaobao,

[email protected] wrote:
[much discussion cut]
>>should fix this problem in the GPRS gateway nodes.
> 
> 
> Thank  you  for proposing a solution which we had  considered very carefully
> before we raised the issues to  group.This solution  would require some
> fundamental changes to the current GPRS/UMTS deployments that are already in
> operation or being rolled out. This could involve major cost and have
> significant implications for networks.
> 
> Alternatively,changing GPRS/UMTS means  to change the GPRS/UMTS specs to
> restrict the use of  some or all of MIPv6 functions in GPRS/UMTS IPv6 nodes. I
> am sure very few people would like to see this practice.
> 
> Even if GPRS/UMTS could be changed to support MIPv6,  do you think that these
> kind of " packet filtering" are only limited to GPRS/UMTS network ?

As you mentioned in your draft, current ISP source address filtering
is to prevent nodes on the ISP's own access network from
spoofing addresses on outbound packets.   This is not what
GPRS/UMTS networks do.

It's worth considering what types of devices currently undertake
packet classification on ingress to an access network, from the
Internet, based on Source addresses today.

These are essentially: Firewalls (including application level
proxies, and stateful L3 agents) and NAT systems.

There aren't many others.

In the case of firewalls, it is part of the process that firewalls
inspect outbound packets (such as signalling packets for Multimedia
sessions) and make modifications to the filter state for this.

This is done routinely as new protocols are adopted.

It doesn't need hardware upgrades (although software upgrades
are required).  This has been the case for many years,
and such change becomes driven by the balance between user
and service provider or enterprise security policy.

If there is no business case to modify the (in this case firewall)
devices, then the change will not take place.

Modifications to network protocols (especially protocols
which have been in standardization processes for as long
a time as MIPv6) take MUCH longer and have impact further
afield than the systems experiencing problems due to packet
filtering.

This can be seen with the case of NATs (which also experience
loss if packets arrive with different header formats
than those previously registered).   It is important that
the introduction of packet filtering or classification
technology in one environment doesn't force modification
of protocols such as IPSec, or MobileIP, simply because
the next header is not TCP, or because an address may
change.

We're talking about having end-to-end communucations here,
so the presence of intermediate machines either should be
unobtrusive, or explicitly configured on the applicable hosts.

Just dropping packets isn't good enough.

Greg