Subject: Firewall Configuration

From: [email-masked] (Ridvan Erdogan)
Date: Tue, 9 Jul 96 00:37:10 PDT

We are protecting our net with a Cisco PIX. Is there anybody using PIX and
configured it for MBone traffic? We don't have any tunnel through the PIX. We
use PIM Dense mode only. How should we configure our firewall?

Regards Ridvan.

---

From: Marcus Fosker <[email-masked]>
Date: Tue, 09 Jul 1996 09:13:13 +0100

Talking of firewalls, does anybody know if it is possible to have the MBONE work
through an application firewall onto an RFC1980 network?

Thanks

Marcus

-- 
Marcus Fosker
NETCOM Internet Ltd.
Phone: +44 (0)1344 395500
Fax:   +44 (0)1344 420515

---

From: dave pratt <[email-masked]>
Date: Tue, 9 Jul 1996 11:25:08 +0100 (BST)

Marcus, et al,

Strictly speaking I guess the answer is no, but the firewall designers may
disagree. If you built an mrouted implementation into the firewall.....

However, in practise if you make a tiny hole in your firewall....

You need to establish a DVMRP Tunnel through the firewall, and then as a
minimum permit Ip in IP, and IGMP through the firewall, just between the two
end points of the tunnel. 

If you want mtrace, mrinfo etc, to work from outside, then you need to permit
IGMP through to all of your internal multicast routers (actually since it's
an application firewall you will need this outgoing as well, traditional
firewalls tend to permit all outgoing traffic).

If your feeling very brave, (I don't suggest this), then you could allow SNMP
through as well, thereby allowing the mstat suite of programs to work.

Cheers
Dave P 

ps RFC1980 - not released yet by ietf, but if you mean private IP numbers,
then this will indeed cause problems...but maybe you'll get incoming traffic
OK. 

 On Tue, 9 Jul 1996, Marcus Fosker wrote:

->Date: Tue, 09 Jul 1996 09:13:13 +0100
->From: Marcus Fosker <[email-masked]>
->To: [email-masked]
->Subject: Re: Firewall Configuration
->
->Talking of firewalls, does anybody know if it is possible to have the MBONE work
->through an application firewall onto an RFC1980 network?
->
->Marcus

--------
The views expressed here may or may not be my own.
WWW - doesn't that stand for "Wait a Week Word" ?
Dave Pratt      (tel: +44 1473 643840 )
[email-masked]

---

From: Bill Fenner <[email-masked]>
Date: Wed, 10 Jul 1996 10:14:50 PDT

In message <[email-masked]> you write:
>Talking of firewalls, does anybody know if it is possible to have the MBONE
>work through an application firewall onto an RFC1980 network?

Do you mean RFC1918, "Address Allocation for Private Internets"?

An application level gateway (like an RTP translator as specified in RFC1889
with a little extra glue to set up session gatewaying when needed) is the
perfect way to do this.  You could have two completely seperate multicast
routing domains, with a single host which runs the application gateway
in both domains.

As is always the case with application gateways, of course, having only an
RTP translator means that you can only participate in RTP sessions.  A
general UDP relay might be worthwhile if you also want to be able to receive
non-RTP traffic.

  Bill