[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Protection of port 500
> > On Mon, 15 Jan 2001, Pervaiz Rizvi wrote:
> > > Do you mean IPsec implementations silently
> > > ignore the configured policy to protect
> > > udp/500 with IPsec?
> >
> > A configured policy which does not include an exception for UDP/500
> > (perhaps subject to other constraints) is erroneous and should be reported
> > as such.
>
> Another approach is to allow trusted applications (e.g. an IKE daemon) to
> bypass the appropriate port(s) because the application is trusted to protect
> itself.
>
> In Solaris, for example, utter "man ipsec" and look for "Per-Socket Policy".
>
Isn't this approach just looking for trouble? Can applications be trusted
to protect themselves from, let's say, from DoS attacks? I'd want at least
the option of some lower layer policy enforcement (ACLs, filters, etc.) in
additon to whatever the app layer provides.
-mdf
Follow-Ups:
References: