Re: IPv6 RH (was Re: SPD issues)

[Bill Sommerfeld <sommerfeld@east.sun.com>]

> > We might add a flag that explicitly disallows traffic with routing 
> > headers, as a local admin control for SPD entries.  
> 
> I think this is a bad idea. the local admin should use a firewall
> to restrict traffic with routing headers if needed. he shouldnt
> use the SPD to do this. we might accidentaly turn off protocols
> which make use of routing headers.

Huh?  You might accidentally disable stuff you need at an SPD-based
policy enforcment point, or accidentally disable stuff you need with a
"firewall".  What's the difference?

Any code which consults the SPD to do policy enforcement can be
thought of as a "firewall".

						- Bill