Re: letting traffic flow through a SG by default

On Wed, 12 Mar 2003, John S. Denker wrote:

>  > Add to the manual: A security gateway is NOT A FIREWALL.
>  > Use excessive large font.
> 
> How do you know a security gateway is not a firewall?

I meant to say that we're talking talking about two
different things. I see a VPN as nothing more then
a conduit, another cable into my network. Even if you
restrict the IPsec policies for IP addresses, you still
have a firewall policy issue to resolve.
  
> I believe that scalable ("OE"?) solutions that are robust
> enough to handle trust models suitable for VPN usage
> are possible -- but we haven't seen them yet.

Whether a connection comes in over OE or as plain traffic doesn't
matter, it is coming from the outside Evil world, and you should
treat it as such. 

VPN's do change the trust somewhat, because the trust of a certain
network is extended to the user connecting to it. But such a connection
is explicitely granted, and can be locked in its own set of priviledges.

I don't see why OE cannot scale. If you do not wish to run OE on individual
public servers, because you're afraid it pierces your Corporate Firewall, then 
you can define it so it is sent to an OE security gateway, which in itself can 
be placed on the outside (or DMZ) of a network.

> That's a very interesting question.  That is tantamount
> to asking what is the content of the SPD.  IPsec must
> provide a flexible, expressive SPD.  It must not dictate
> what policy is expressed therein.

Though allowing 0/0 both ways, the easy way out, is also not a good
solutoin (for VPN's).

Paul