Subject: M, F, and L

From: <[email-masked]>
Date: Wed, 28 May 1997 14:34:10 -0700

(does it rhyme with Male, Female and Lies?)

Real Subject: MBone, Firewall, and Linux

Hi,

Does FireWall-1 Secure Policy 2.1c support MBone tunnel?

Presently UUNET does not provide us a MBone feed, so we have set up then
remote tunnel end beyond the UUNET cloud.
We have enabled a MBone tunnel local end on Linux IP multicast router
0.05.

I verified the tunnel local end works when right outside the firewall:

 Remote(cisco)--INET--UUNET--(cisco)--Ethernet--FW1--Ethernet
 (tunnel end)                            |
                                       Linux
                                     (tunnel end)

But it stopped working when I moved it to inside the firewall:

 Remote(cisco)--INET--UUNET--(cisco)--Ethernet--FW1--Ethernet--Linux
 (tunnel end)                                                (tunnel
end)

Checkpoint VAR suggested me *try* the following which may work:

 Remote(cisco)--INET--UUNET--(cisco)--Ethernet--FW1--Ethernet--IGMP
members
 (tunnel end)                                    |
                                             Ethernet(DMZ)
                                                 |
                                               Linux
                                             (tunnel end)			

Has anyone tried this before? Does it work?
Could you share the configuration procedure?
If there is any other recommendation, I am open to them all.

Thank you.

Steven

---

From: "Peter H. Tebault" <[email-masked]>
Date: Wed, 28 May 1997 23:51:24 -0700

> If there is any other recommendation, I am open to them all.

Steven,

There is no [secure, good] way right now to make mbone traffic traverse
the FW without either:

Compromising security by:
o   Putting the cisco's other ethernet port on the secure side of the FW
and enabling multicast on that ethernet port. (Very dangerous.  People
can send malicious exploit packets to any machines subscribed to
multicast streams.  This is a well-known problem.)  This works fine, but
if security is an issue...
o   Turning on routing in the Firewall for only 224.0.0.0 with a
0xf0000000 mask?  May work, but would have exactly the same problem as
the first suggestion.

Not compromising security (quite so blatantly):
o   Install a mbone proxy, such as the one at:
    ftp://ftp.tis.com/pub/firewalls/toolkit/contrib/mbone-gw.tar.gz
        which is described in:
    http://www.tis.com/docs/research/network/mbone/mboneabs.html

However, this proxy requires that all software on your house-side of the
network have special proxy wrappers, or be proxy-aware.

Some companies which provide transparent proxy gateways (which intercept
packets as a router would, then turn around and proxy as usual) should
be able to, once they are made multicast aware, be able to comply with
the mbone suite of protocols.  Not yet...

-Pete-

Note: I'm pretty new at this myself, so if I've misspoken, please let me
know.  I'd like to sharpen my knowledge all the time.

--
=============================================
Peter H. Tebault, Student - [email-masked]
fax 510 440 1770 ------ 1996 Neon Sport Coupe
=============================================