Re: WGLC: draft-ietf-nsis-nslp-natfw-16.txt

Hi Martin, all,

i have reviewed the NATFW NSLP draft. Overall i think the draft is in a 
good shape.

My three major comments:

    * p24: Redraw the picture! Add administrative domains or point out
      with node belongs to which network! Also rewrite the first
      paragraph! Use a easier example! This section indicates (at least
      to me) the usage of the proxy mode in a way which is not supported
      by NATFW!
    * p26/section 3.2.3: Why do you have this section within the draft?
      The listed states are not enough to implement the NATFW NSLP and
      may confuse reviewers/implementers. You could point to the
      statemachine draft! If you want to have this section inside the
      draft, you should update it. What is the "Dead" state good for?
      Such a session has to be deleted directly and not "... and the
      NATFW NSLP signaling session can be deleted."
    * regarding section 3.7.2: this section is a little bit confusing!
      Even with knowledge about the NATFW NSLP it is hard to follow.
      Maybe you should re-structure it a little bit, e.g. creating
      several sub-sections. You should also clearly point out that EXT
      can also be used to install pinholes in FWs (and not only deny
      rules as described later, if i don't understand this wrong (see
      below)).

Further comments:

    * p2/p4: If you introduce NAT, you should do the same for FW
    * p8/p10: you introduce the terminology "middlebox" twice, in
      section 1.2. and section 1.3
    * p11: meaning that there is a middlebox on the => meaning that
      there is _at least one_ middlebox on the
    * p22, first paragraph: (check local policies for authorization and
      authentication, possibly create policy rules) that is not right,
      the NF only notice the policy rules
    * p22, third paragraph: the NF installs the policy rule when
      receiving a success RESPONSE msg
    * p22, fourth paragraph: Ni => NI
    * p27: 'Protocol error' (0x1) => (0x3)
    * p29/p30: many recurrences here: Requested signaling session
      lifetime is too big, Requested signaling session lifetime is too
      small, with codes, the same on page 30
    * p32: section 3.7:  ... how to create NATFW NSLP signaling
      sessions, maintain them, and how to reserve addresses. => and delete
    * p34: NSLP forwarder: what happened if the NF can not install the
      pinhole? e.g. it is already installed
      looks like you forgot this case, there is also node error code for
      this case on page 58.
    * p40:  ... an error RESPONSE of class 'Protocol error' (0x3) ... =>
      of class signaling session failure (0x6)
    * p40: "The policy rule is remembered, but not activated, if the
      action in the NATFW_EFI object is set to 'allow'." Why? In
      general, i don't understand the "Firewall" paragraph.
    * p41: "Reservations with action 'allow' made with EXT MUST be
      enabled by a subsequent CREATE message." What happens if the
      pinhole isn't use for reservation of an external address or a
      NAT-binding? In this case no CREATE msg will follow.
          o or is this in general not allow within the NATFW NSLP? The
            next sentence indicates that:
          o "The only function of EXT is to ensure that subsequent
            CREATE messages traveling towards the NR will be forwarded
            across the public-private boundary towards the DR."
          o One earlier version of the NATFW NSLP supports this with the
            use of U-CREATE. Or is this completely remove?
    * p41: ...created by REA. => ... created by EXT.
    * p42: "The lifetime extension of a NATFW NSLP signaling session is
      calculated as current local time plus proposed lifetime value",
      really local time _*plus *_proposed? This would increase the
      lifetime step by step as the local lifetime is always >0!
    * p44: "'NATFW node is going down soon' (0x03) The NI and other NFs
      should be prepared for a service interruption at any time."
      What is this good for????
    * p48/49, section 3.7.6.2: you should make clear where are the
      differences to the EXT msg.
    * p52: ... of this memo => ...of this memo.
    * p56: ... of class 'Signaling session error' (0x6) with ... => ...
      of class 'Signaling session failure' (0x6) with ...
    * p58: you forgot 0x04 (see 3.7.5) 'NATFW signaling session lifetime
      expired'
    * p59(and whole doc) => signaling session failures => signaling
      session failure (as for the other classes).
    * p62: The fields MUST be interpreted according these rules: => The
      fields MUST be interpreted according _*to *_these rules:
    * p62: with response code 'Mandatory object missing' (0x02) MUST =>
      (0x04)
    * p76: Open issues. Should this be part of a WGLC document?


Regards,
Niklas


Martin Stiemerling schrieb:
> [writing as WG chair]
>
> Dear all,
>
> The authors believe that the NATFW NSLP
> (draft-ietf-nsis-nslp-natfw-16.txt) is ready for WGLC. 
>
> The WGLC starts today and will run until December 14th. 
>
> Please review the draft, and comment if you feel that this draft
> is ready to be sent to the IESG.  A simple mail saying that the
> draft is ready for publication would be great.
>
> Of course, if you read the draft and find open issues, then please
> send a summary of your issue with the current draft.
>
> Thanks, 
>
>   John and Martin
>
> [email protected] <mailto:[email protected]>
> NEC Laboratories Europe - Network Research Division
>
> NEC Europe Limited | Registered Office: NEC House, 1 Victoria Road, 
> London W3 6BL | Registered in England 2832014
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> nsis mailing list
> [email protected]
> https://www1.ietf.org/mailman/listinfo/nsis
>   

-- 
Niklas Steinleitner          Tel: +49 551 3913583
Institute for Informatics    [email protected]
University of Göttingen      http://www.tmg.informatik.uni-goettingen.de
Lotzestrasse 16-18
D-37083 Göttingen, Germany

_______________________________________________
nsis mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/nsis