[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: draft-ietf-ipsec-arch-sec-02.txt and last call
Indermohan,
Your intuition is correct. The intent of the text is that a
compliant implementation MUST support the discard fucntion, along with
bypass and IPsec processing. If IPsec is part of a box that also
implements a firewall function, then the line between the two may be
blurred and provision of the discard function elsewhere in the box would
seem reasonable. However, for a stand alone implementation, the discard
function is important, e.g., it can prevent traffic from reaching the
firewall or host and thus may provide a higher level of assurance that
would be available from the devicve behind the IPsec implementation.
Steve
References: