Subject: RE: M, F, and L

From: <[email-masked]>
Date: Tue, 3 Jun 1997 12:15:50 -0700

Peter,

Thanks for your suggestion. I will see whether I can try them.

Also received word from Checkpoint that FireWall-1 2.1c does not provide
any tunnelling
capability although they think one can use address translation to
translate the multicast
addresses to regular ones on one side and translate them back on the
other side.
This method is not so practical for our application in my view.
Checkpoint says with FireWall-1 3.0's IPSec and SKIP encryption schemes
one can
tunnel whatever you want between two FireWalls (you don't need to
acctually
encrypt the data if you choose not to).

Steven

>----------
>From: 	Peter H. Tebault[SMTP:[email-masked]]
>Sent: 	Wednesday, May 28, 1997 11:51 PM
>To: 	Steven Wang
>Cc: 	[email-masked]
>Subject: 	Re: M, F, and L
>
>[email-masked] wrote:
>
>> (does it rhyme with Male, Female and Lies?)
>>
>> Real Subject: MBone, Firewall, and Linux
>>
>> Hi,
>>
>> Does FireWall-1 Secure Policy 2.1c support MBone tunnel?
>>
>> Presently UUNET does not provide us a MBone feed, so we have set up
>> then
>> remote tunnel end beyond the UUNET cloud.
>> We have enabled a MBone tunnel local end on Linux IP multicast router
>> 0.05.
>>
>> I verified the tunnel local end works when right outside the firewall:
>>
>>  Remote(cisco)--INET--UUNET--(cisco)--Ethernet--FW1--Ethernet
>>  (tunnel end)                            |
>>                                        Linux
>>                                      (tunnel end)
>>
>> But it stopped working when I moved it to inside the firewall:
>>
>>  Remote(cisco)--INET--UUNET--(cisco)--Ethernet--FW1--Ethernet--Linux
>>  (tunnel end)                                                (tunnel
>> end)
>>
>> Checkpoint VAR suggested me *try* the following which may work:
>>
>>  Remote(cisco)--INET--UUNET--(cisco)--Ethernet--FW1--Ethernet--IGMP
>> members
>>  (tunnel end)                                    |
>>                                              Ethernet(DMZ)
>>                                                  |
>>                                                Linux
>>                                              (tunnel end)
>>
>> Has anyone tried this before? Does it work?
>> Could you share the configuration procedure?
>> If there is any other recommendation, I am open to them all.
>>
>> Thank you.
>>
>> Steven
>
>Steven,
>
>There is no [secure, good] way right now to make mbone traffic traverse
>the FW without either:
>
>Compromising security by:
>o   Putting the cisco's other ethernet port on the secure side of the FW
>and enabling multicast on that ethernet port. (Very dangerous.  People
>can send malicious exploit packets to any machines subscribed to
>multicast streams.  This is a well-known problem.)  This works fine, but
>if security is an issue...
>o   Turning on routing in the Firewall for only 224.0.0.0 with a
>0xf0000000 mask?  May work, but would have exactly the same problem as
>the first suggestion.
>
>Not compromising security (quite so blatantly):
>o   Install a mbone proxy, such as the one at:
>    ftp://ftp.tis.com/pub/firewalls/toolkit/contrib/mbone-gw.tar.gz
>        which is described in:
>    http://www.tis.com/docs/research/network/mbone/mboneabs.html
>
>However, this proxy requires that all software on your house-side of the
>network have special proxy wrappers, or be proxy-aware.
>
>Some companies which provide transparent proxy gateways (which intercept
>packets as a router would, then turn around and proxy as usual) should
>be able to, once they are made multicast aware, be able to comply with
>the mbone suite of protocols.  Not yet...
>
>-Pete-
>
>Note: I'm pretty new at this myself, so if I've misspoken, please let me
>know.  I'd like to sharpen my knowledge all the time.
>
>--
>=============================================
>Peter H. Tebault, Student - [email-masked]
>fax 510 440 1770 ------ 1996 Neon Sport Coupe
>=============================================
>
>