Firewall Configurations Responses from the ETF (the names have been changed to protect the innocent..)

Questions Where are gatekeepers w.r.t the firewall(s)? Where would you be happy with a firewall? Firewalls between resources and gatekeepers? Local access to gatekeepers trusted more? Client or server connections? Can make quick changes to the firewall? Would be selective in allowing access through the firewall?

Responses: Current F/W status Some sites with NO firewall at all Most sites have a site firewall (hardware) Some sites have different security domains Some sites run software firewalls in addition to site-wide firewalls Most sites expect firewall to become more restrictive in the future

Responses 2: Ideal F/W Position Most not happy with software firewall on the gatekeeper Most encourage use of personal firewalls Some happy with gatekeeper outside of firewall, resources inside Any firewall affecting the gatekeeper must be fast

Responses 3:Resources Most have no firewalling between gatekeeper and resources (gatekeeper on resources!) Firewalling/security between gatekeeper and resources likely to increase Local users avoid site firewall

Responses 4: Client/Server Most expect client and server access to their gatekeeper Some would prefer access based on certificate possession rather than IP address

Responses 5: Speed of Firewall Changes Site (hardware) firewalls difficult to make changes to quickly (less than 24 hours) Software firewalls can be changed more quickly

Responses 6: Access to all Selective access preferable Most prefer to be able to offer access through firewalls to small groups – project members, VOs etc. Access to some resources for all, with access to specific resource limited to collaborators etc.

Impossible? Perhaps… A Single Solution