<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div style="font-size:75%;color:#575757"></div>
</div>
<br>
<br>
<br>
-------- Original message --------<br>
From: Yi Sun <beyounn@gmail.com> <br>
Date: <br>
To: openstack-dev@lists.openstack.org <br>
Subject: Re: [openstack-dev] [Neutron] DVR SNAT shortcut <br>
<br>
<br>
<br>
<br>
Yi wrote:<br>
+1, I had another email to discuss about FW (FWaaS) and DVR integration. Traditionally, we run firewall with router so that firewall can use route and NAT info from router. since DVR is asymmetric when handling traffic, it is hard to run stateful firewall on
top of DVR just like a traditional firewall does . When the NAT is in the picture, the situation can be even worse.<br>
Yi <br>
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div> </div>
<br>
</div>
</div>
</div>
</blockquote>
<div class="gmail_quote">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">Don't forget logging either. In any security concious environment , particularly any place with legal/regulatory/contractual audit requirements a firewall that doesn't keep full logs of all dropped and passed sessions is worthless. </div>
<div class="gmail_quote"><br>
</div>
<div class="gmail_quote">Stateless packet dropping doesn't help at all when conducting forensics on an attack that is already known to have occured.</div>
<div class="gmail_quote"><br>
</div>
</div>
</div>
</div>
<div class="gmail_quote">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote"><br>
</div>
</div>
</div>
</div>
<br>
</body>
</html>