Re: SOI QUESTIONS: 2.3 Authentication styles

[Paul Koning <pkoning@equallogic.com>]

Excerpt of message (sent 19 June 2002) by Chinna N.R. Pellacuru:
> As I saw it, a minority of implementors who build high end security
> gateways, complained about not just the value of minimal access control in
> IPsec, but also about the inefficiency of doing this in IPsec and having
> to do it in the firewall feature processing anyway (because firewall
> provides extensive and true access control and intrution detection).

As one who worked on a product that arguably fits in this category,
I'd have to disagree.  There certainly is overlap between the
classification processes done in IPsec, in firewalls, in traffic
managers, and so on.  That doesn't mean things have to be
inefficient.  Instead, it means you have the opportunity to provide
all three functions through a single classification step.  That
requires more care in implementation, but it certainly is possible.

	 paul