Re: [fw-wiz] Layer 2 (stealth) firewalls - PBR?



On Mon, 31 Mar 2008, Darren Reed wrote:
Over in the networking community on OpenSolaris.org, a couple of
us are pondering the question of what it means to do policy based
routing (PBR) at the ethernet (MAC) layer.

For IP, the use case is well understood and people everywhere do
it with firewall software, if only to make up for the inadequacies of
their routing tables however when it comes to ethernet, we're kind
of scratching our heads....so, some questions....

Hmm... so I've got this university residence full of exuberent file
sharing sorts, and more sane and reasonable folk, all happily coexisting
on the same l2 network... and getting random IP addresses via DHCP. I
could see PBR at the ethernet layer being an adjunct to NAC as well.

... maybe I want to provide differing degrees of service or access, or
maybe I want to push some of the traffic through some sort of service
enhancing tool... (I'll grant that you can do this in other ways... but
as a thought).

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet. This is the defining metaphor of my life right now."
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards



Relevant Pages

  • DSL router when what I need is a bridge; ARP problem?
    ... My only choice for a DSL isp will only do G.lite in routing mode, ... the freebsd box handling routing and other duties for hosts connected ... to a hub on another ethernet card. ... From the arp man page, it seems like an arp -s entry should be ...
    (freebsd-questions)
  • Re: Connecting a user to AOL (anything I should know?!)
    ... not to be confused with IP routing -- and people do call it that. ... ARP may not be a routED protocol, but ethernet is. ... Bridges Bridge at layer 2 e.g. ethernet frames. ...
    (uk.comp.homebuilt)
  • Re: best tr/eth router machine?
    ... >> what machine+OS would be best for routing between my current ethernet ... and soon to be token ring networks? ... > the ethernet NIC has IP address 192.168.2.2. ... > point 192.168.0.2 as Gateway for TR hosts, ...
    (comp.sys.ibm.ps2.hardware)
  • Re: best tr/eth router machine?
    ... > what machine+OS would be best for routing between my current ethernet and soon to be token ring networks? ...
    (comp.sys.ibm.ps2.hardware)
  • Re: Connecting a user to AOL (anything I should know?!)
    ... The output from that is an example of a routing table. ... Ethernet switches do contain a MAC "routing table" which tells them ... They are still bridges doing bridging. ...
    (uk.comp.homebuilt)