Great Circle Associates Firewalls
(June 1994)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Yes! Subnet on the wire
From: reh @ cs . UMD . EDU (Richard Huddleston)
Date: Mon, 6 Jun 1994 11:35:13 -0400
To: R.ROSSMAN/ARSC @ cgsmtp . comdt . uscg . mil, lacoursj @ uprc . com, paul @ hawksbill . sprintmrn . com
Cc: firewalls @ greatcircle . com

Final comments before we take this to e-mail, to correct some misconceptions
about CTOS.

* Subject: Yes! Subnet on the wire
* Date:      6 Jun 94 10:45:23 EST
* 
* Paul, Jeff, and Richard
* I agree, it seems from all other aspects that this is possible.
* But my DEC "gurus" in house working on ULTRIX say NO!

Well, it's entirely possible that dual stacks (IP/OSI) aren't available
under ULTRIX.  They are, however, available under SunOS 4.1.x and 5.x,
and I believe they're available under the latest BSD release.

A limitation of ULTRIX isn't a limitation of Unix, of course...

* Does routing _force_ interfaces to require different subnets?  

It doesn't "force" interfaces, as much as the routing operation is certainly
meaningless if the number of (sub)networks is <= one.

* In that case,
* CTOS appears not appear to route, but to bridge.  However, that would mean
* all Ethernet traffic would appear on the X25 lines.  I don't understand why
* this does not happen with CTOS?  None of the Ethernet traffic appears on X25.
* Only the X25 traffic gets there.  So, it appears as though X25 traffic is
* being routed (because of the distinct traffic patterns), and yet I don't need
* the extra subnet address the way ULTRIX and the router need two.  Since the
* network on CTOS is OSI it isn't using the TCP to do network stuff.  It only
* communicates when the connection is opened by a user.  

<Sigh>.

Here's a simplified scenario:

CTOS uses SDLC over four-wire cable to effect local-cluster communications, over
the blazing maximum transmission rate of 3.8 Mbps.  Inter-cluster communications
is done either by Ethernet, by Token-Ring, or by X.25 (other possibilities 
ignored for this scenario, since the addressing mechanism doesn't change).

The inter-cluster LAN communications is typically done via B-NET (which is a 
DECnet-like protocol), B-NET II (an OSI protocol), or even IP.  There are other
possibilities; third-party network protocols, etc.  "Workstations" on the
CTOS LAN can utilize X.25 or IP WAN gateways that reside on other LAN nodes,
by specifying the location of that node using the network-protocol syntax.

The WAN gateway wraps the LAN protocol up in the WAN protocol data field and
routes it over the WAN: IP routing is different from X.25 routing, of course.
You will not see Ethernet frames on a HCLC- or LAPB-framed data link, for
reasons that are either obvious or irrelevant. 

There's no bridging involved -- and even if there were, bridging algorithms
are commonplace that prevent devices that are bridging from acting as dumb
repeaters: 
 
* I can see how UNIX bridged between Ethernet and X25 would create a tremendous
* amount of X25 traffic.  I have been unable to get my router to duplicate my
* CTOS comms links.  If I configure the router to bridge, it would cause the
* same problem described above - massive traffic on X25.  So bridging is out of
* the question. 

Unnumbered serial interfaces and X.25 routing will let a Cisco router duplicate
your CTOS comms links.  Maybe you're not using very good routers, or not setting
them up to do what you want.  

* I have not needed a firewall until recently because CTOS is very well
* protected within the OS.  

Boy, is *that* ever a misconception.  Can you still specify a remote LAN
node by address (e.g. {G-A}) and be sitting on the remote node's master
workstation -- without any authentication whatsoever required?  Do passwords
for the volumes and user accounts still reside on disk files in unencrypted
form, and does the password stored in the UCB (user control block) still 
get written to disk in cleartext when you create or save a file?  Etc? 

* Maybe we should take this conversation to another list? .. Brent?

Or e-mail. 

Regards,

Richard


Indexed By Date Previous: Yes! Subnet on the wire
From: R.ROSSMAN/ARSC @ cgsmtp . comdt . uscg . mil
Next: Re: Yes! Subnet on the wire
From: sdw @ meaddata . com (Stephen Williams)
Indexed By Thread Previous: Re: Yes! Subnet on the wire
From: sdw @ meaddata . com (Stephen Williams)
Next: [no subject]
From: Ken Hardy <ken @ bridge . com>

Google
 
Search Internet Search www.greatcircle.com