1. PAGE 1 A Firewall Control Protocol (FCON) draft-soliman-firewall-control-00 Hesham Soliman Greg Daley Suresh Krishnan hesham@elevatemobile.com

2. PAGE 2 Objective Allow end nodes to request traffic to pass through the firewall Allow end nodes to discover the node that they send their requests to (Rolicy Decision Point, PDP) in a dynamic manner. Strong Authorisation model Allow for different deployment scenarios: Multiple firewalls within a network Different firewalls for different network paths Firewalls located anywhere in the network including the access router.

3. PAGE 3 Protocol Architecture PDP DHCP Firewall FCON Out of scope

4. PAGE 4 Protocol details Request-Response protocol that runs over ICMPv6 PDP address discovery through DHCP End nodes do not communicate directly with the Firewall. Communication is between the end node and the PDP Allows for request of IPv4 address allocation Protocol features: Security Association setup based on PK or Certificate exchange between the end node and the PDP Future requests are authenticated and protected against replay attacks. Requests contain one or more entries that describe the flow and request particular actions Authorisation of the requests takes place in the PDP based on Security credentials and local policies. Once authorised, the PDP updates the firewall(s) based on the end node’s request.

5. PAGE 5 Security Different deployment models require different levels of authorisation. Either trusted certificates or Public keys generated by the end node can be used, or both. Use of Cryptographically Generated Addresses (CGAs) to prove address ownership. CGAs are already used in other protocols (e.g. SEND, or HBAs in shim6) Liveness checks included for reachability checks.

6. PAGE 6 What’s new? Pros and Cons Authorisation model using CGAs Binary protocols that uses ICMP as transport (as opposed to SIMCO’s ABNF encoding) Signaling to a generic PDP, which knows local policies and chooses the appropriate firewall. CONs? Is this attractive for host implementers to include? API needed on the host to know when to create a new entry in FW Others ?