1. Firewall Configurations Responses from the ETF (the names have been changed to protect the innocent..)

2. Questions Where are gatekeepers w.r.t the firewall(s)? Where would you be happy with a firewall? Firewalls between resources and gatekeepers? Local access to gatekeepers trusted more? Client or server connections? Can make quick changes to the firewall? Would be selective in allowing access through the firewall?

3. Responses: Current F/W status Some sites with NO firewall at all Most sites have a site firewall (hardware) Some sites have different security domains Some sites run software firewalls in addition to site-wide firewalls Most sites expect firewall to become more restrictive in the future

4. Responses 2: Ideal F/W Position Most not happy with software firewall on the gatekeeper Most encourage use of personal firewalls Some happy with gatekeeper outside of firewall, resources inside Any firewall affecting the gatekeeper must be fast

5. Responses 3:Resources Most have no firewalling between gatekeeper and resources (gatekeeper on resources!) Firewalling/security between gatekeeper and resources likely to increase Local users avoid site firewall

6. Responses 4: Client/Server Most expect client and server access to their gatekeeper Some would prefer access based on certificate possession rather than IP address

7. Responses 5: Speed of Firewall Changes Site (hardware) firewalls difficult to make changes to quickly (less than 24 hours) Software firewalls can be changed more quickly

8. Responses 6: Access to all Selective access preferable Most prefer to be able to offer access through firewalls to small groups – project members, VOs etc. Access to some resources for all, with access to specific resource limited to collaborators etc.

9. Impossible? Perhaps… A Single Solution