In some mail from Peter da Silva, sie said:
>
> > As Darren pointed out, it's possible to do everything an AG does with
> > an SPS, and vice versa.
>
> However, in practical terms, you can't get a stateful packet filter that
> will do all the stuff even the simplest application level gateways do as
> a matter of course, and for a simple configuration it's much easier to
> get the existing ALGs configured right than the existing SPFs.
The simplest application gateways just forward data, in sequence.
I class things like "tcp-relay", etc, as AG's. Even plug-gw isn't that
complicated, compared to, say, ftp-gw.
> In theory, you and Darren are correct. In practice, existing implementations
> do fall into clumps with user convenience and performance being highest for
> packet filters, and administrative convenience and security being highest
> for proxies.
Time permitting, I'll make you eat those words.
References:
|
|
