The end-to-end principle in the Internet. 15 maart 2005



Similar documents
Firewalls and VPNs. Principles of Information Security, 5th Edition 1

5.0 Network Architecture. 5.1 Internet vs. Intranet 5.2 NAT 5.3 Mobile Network

Proxy Server, Network Address Translator, Firewall. Proxy Server

21.4 Network Address Translation (NAT) NAT concept

Firewalls P+S Linux Router & Firewall 2013

Network Address Translation (NAT)

Linux Network Server: Firewalls

Government of Canada Managed Security Service (GCMSS) Annex A-1: Statement of Work - Firewall

Internet Protocol: IP packet headers. vendredi 18 octobre 13

Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding

Security Technology: Firewalls and VPNs

Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN

ICS 351: Today's plan. IP addresses Network Address Translation Dynamic Host Configuration Protocol Small Office / Home Office configuration

Internet Security Firewalls

1 Basic Configuration of Cisco 2600 Router. Basic Configuration Cisco 2600 Router

GregSowell.com. Mikrotik Security

We will give some overview of firewalls. Figure 1 explains the position of a firewall. Figure 1: A Firewall

MINIMUM NETWORK REQUIREMENTS 1. REQUIREMENTS SUMMARY... 1

12. Firewalls Content

Use Domain Name System and IP Version 6

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003

How To - Configure Virtual Host using FQDN How To Configure Virtual Host using FQDN

R4: Configuring Windows Server 2008 Network Infrastructure

Module 8. Network Security. Version 2 CSE IIT, Kharagpur

Компјутерски Мрежи NAT & ICMP

Application Delivery Networking

Networking Basics and Network Security

What would you like to protect?

IPv4 and IPv6 Integration. Formation IPv6 Workshop Location, Date

Virtual Private Networks

Source-Connect Network Configuration Last updated May 2009

2. What is the maximum value of each octet in an IP address? A. 28 B. 255 C. 256 D. None of the above

Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1

Basic Network Configuration

EXPLORER. TFT Filter CONFIGURATION

GPRS and 3G Services: Connectivity Options

Tomás P. de Miguel DIT-UPM. dit UPM

Configuring Windows Server 2008 Network Infrastructure

Firewalls. CEN 448 Security and Internet Protocols Chapter 20 Firewalls

A Brief Overview of VoIP Security. By John McCarron. Voice of Internet Protocol is the next generation telecommunications method.

For extra services running behind your router. What to do after IP change

Security in IPv6. Basic Security Requirements and Techniques. Confidentiality. Integrity

Advanced Higher Computing. Computer Networks. Homework Sheets

White Paper Copyright 2011 Nomadix, Inc. All Rights Reserved. Thursday, January 05, 2012

2. IP Networks, IP Hosts and IP Ports

Chapter 15. Firewalls, IDS and IPS

Linux firewall. Need of firewall Single connection between network Allows restricted traffic between networks Denies un authorized users

EdgeRouter Lite 3-Port Router. Datasheet. Model: ERLite-3. Sophisticated Routing Features. Advanced Security, Monitoring, and Management

NAT and Firewall Traversal with STUN / TURN / ICE

Workflow Guide. Establish Site-to-Site VPN Connection using RSA Keys. For Customers with Sophos Firewall Document Date: November 2015

A Practical Look at Network Address Translation. A Nokia Horizon Manager White Paper

PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES

Firewalls. Mahalingam Ramkumar

VMware vcloud Air Networking Guide

Lehrstuhl für Informatik 4 Kommunikation und verteilte Systeme. Firewall

Chapter 3 LAN Configuration

What is a Firewall? Computer Security. Firewalls. What is a Firewall? What is a Firewall?

Connecting MPLS Voice VPNs Enabling the Secure Interconnection of Inter-Enterprise VoIP

WAN Traffic Management with PowerLink Pro100

Computer Networks. Introduc)on to Naming, Addressing, and Rou)ng. Week 09. College of Information Science and Engineering Ritsumeikan University

Network Address Translation (NAT) Good Practice Guideline

The BANDIT Device in the Network

Document No. FO1101 Issue Date: Work Group: FibreOP Technical Team October 31, 2013 FINAL:

Chapter 11 Cloud Application Development

MOBILE VIDEO WITH MOBILE IPv6

Routing Security Server failure detection and recovery Protocol support Redundancy

Enterprise Edge Communications Manager. Data Capabilities

Chapter 12 Supporting Network Address Translation (NAT)

A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.

Polycom. RealPresence Ready Firewall Traversal Tips

Advanced Internetworking

WAN Failover Scenarios Using Digi Wireless WAN Routers

Enabling NAT and Routing in DGW v2.0 June 6, 2012

Availability Digest. Redundant Load Balancing for High Availability July 2013

Fireware Essentials Exam Study Guide

Creating a VPN with overlapping subnets

Vulnerabili3es and A7acks

Review: Lecture 1 - Internet History

Network Configuration Settings

Variable length subnetting

vcloud Air - Virtual Private Cloud OnDemand Networking Guide

- Introduction to Firewalls -

How To Protect Your Network From Attack

NAT Traversal for VoIP. Ai-Chun Pang Graduate Institute of Networking and Multimedia Dept. of Comp. Sci. and Info. Engr. National Taiwan University

Lecture Objectives. Lecture 6 Mobile Networks: Nomadic Services, DHCP, NAT, and VPNs. Agenda. Nomadic Services. Agenda. Nomadic Services Functions

IP ALLOCATION AND USAGE POLICY FOR NETWORK SPACE FROM INTEGRA

Smart Tips. Enabling WAN Load Balancing. Key Features. Network Diagram. Overview. Featured Products. WAN Failover. Enabling WAN Load Balancing Page 1

MULTI WAN TECHNICAL OVERVIEW

Mobile IP Part I: IPv4

PowerLink Bandwidth Aggregation Redundant WAN Link and VPN Fail-Over Solutions

ΕΠΛ 674: Εργαστήριο 5 Firewalls

Network Services Internet VPN

Networking Security IP packet security

Citrix Access Gateway: Implementing Enterprise Edition Feature 9.0

7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?

Network Security Topologies. Chapter 11

Transcription:

The end-to-end principle in the Internet Jelmer Barhorst Carlos Groen Wouter Borremans Jan van Lith 15 maart 2005

Contents Introduction to e2e not to e2e NAT Discussion 1

Introduction 2

End to End principle - 1 Question where best to put functions in a communicating system Saltzer/Reed/Clark in 1984 The function can only be completly and correctly implemented with knowledge and help of the application at the end of the communication system That function is cannot be a feature of the 3

communicating system 4

Example Delivery guarantees After delivery Request for Next Message Congestion control Only new message after an recieved acknowledgement from destination 5

End to End principle - 2 Where to put the state associated with applications in the internet: Network or end nodes? End to end protocol should not rely on maintenance of the state (end to end communication) inside the network State in end points only destroyed by endpoint (fate-sharing) 6

Fate is shared between 2 applications that don t depend on anything in the network 7

End to End principle - 3 What kind of state is maintained where? Network maintains some state information: routes, session information, compression histories to perform its services. State must be self healing Volume of state must be minimized 8

Loss of the state must not result in more than a temporary denial. Soft state in network Hard state in end nodes 9

Facets - End to End principle When state in network, traffic cannot route around failures Scaling easy when state-holding to edges Security state held inside network 10

Summary Maintaining openness Increasing reliability and robustness Preserving the properties of user choice Ease of new service deployment 11

End to End - Now Mobile IPv6 Routing proxy in the mobile node s home (Home Agent) and local subnet (Foreign Agent) Maintaining the mapping, the care of addresses. Local subnet routing proxy in Mobile IPv4 but not in Mobile IPv6 12

In Mobile IPv6: end node responsable for care of address 13

to e2e 14

Trends - 1 E2e principle provides solid foundation for IETF work After RFC 1958 more and more come into question Salzer: The function in question can completely and correctly be implemented only with the knowledge and help of the application standing at the endpoints of the communication system 15

Trends - 2 Reduction in transparency due to NAT and other AT mechanisms More recently OPES (open pluggable Edge services) 16

Authentication Most important issue of the last 15 years Lack of trust Not many users, tool for ACADEMIC research and communication Users are not technological sophisticated or simply uninterested 17

E2e principle does not need trust application designers make the choice 18

New service models Implementing e2e means rethinking of service models Customer may expect some kind of service level Retail broadband and multimedia services are new service models 19

Whither the e2e principle Does the e2e principle has a future? How should it be applied? Current internet community will ignore it Seperate (academic :)) research group 20

Whither the e2e principle Consequenses Protection of innovation Reliability and trust 21

Whither the e2e principle E2e principle applicable to application design No dependencies that would break the e2e principle Internet standards as a conflict area 22

Conclusion Remains very important Unbundling of the princple leads to a distributed approach 23

Not to e2e 24

Adresruimte - 1 IPv4 adressen zijn op Organistaties krijgen te weinig adressen 25

Adresruimte - 2 Oplossing : privé adressen gebruiken RFC 1918 / BCP 5 Collisions (bijv. VPN) Niet publiekelijk routeerbaar (security?) NAT Proxies 26

Proxies... Application Level Gateways, caches, relays, etc. SMTP gateway Webcache Mail relays (met virus-/spamcontrole) Geen probleem, mits de packets onderweg niet veranderen. 27

Firewalls - 1 Schoenmaker, blijf bij je leest Bridge layer 2 filtering Router layer 3 filtering Host layer 4 filtering 28

Firewalls - 2 Een layer 4 filter op een bridge (of router) is wel makkelijk: Centraal Geen rommel op het netwerk stateful filteren niet e2e! 29

Load balancing Reverse proxying DNS round robbin Meedere servers met hetzelfde IP (anycast) 30

Minder geavanceerde gebruikers Initiëren het contact, hoeven niet extern bereikbaar te zijn Mobiel met GPRS (dataverbruik) Afspelen streaming media (one-to-many) maar ook het gros van de thuisgebruikers 31

Third-party Trust anchor (communicatie via een Trusted TP) Enforcer of good behavior (moderator) Belastingen of zelfs censuur... (brrrr) 32

Conclusie e2e is niet altijd nodig Centralisatie IPv6 is toch wel erg wenselijk 33

NAT 34

NAT Actually... NAT: Network Address Translation NAPT: Network Address Port Translation (RSIP: Realm-Specific Internet Protocol) 35

NAT Replaces source and destination address (IP) Static m internally, n externally m,n >= 1 and m = n Dynamic m,n >= 1 and m >= n 36

NAPT (masquerading) Replaces source and destination address (IP) Replaces source and destination port (TCP) m internally, n externally m >= 1 and n = 1 37

RSIP Leases external address and port to internal host m internally, n externally m,n >= 1 and m >= n 38

Advantages NAT Limited number of IPv4 addresses Maintain internal addresses Load sharing Secure... 39

Problems NAT Breaks the end-to-end principle Breaks IPsec Breaks certain applications VPN address collisions Single point of failure 40

NAT and IPv6 Delays deployment IPv6 Helps deployment IPv6 (!) 41

Discussion 42

Discussion Do we really want/need e2e? Did we ever have e2e? Will we ever have e2e? 43