[Freeswitch-users] ICMP... and MTU

[Claus Andersen]

On Tue, 18 Feb 2014, Lawrence Conroy wrote:

> Problem (at least over this side of the pond) is customers using the cheapo routers provided by their ISP.
> These are often pre-configured in strange and stupid ways, or have ISPs who use TR-069 remote "configuration, for your comfort and enjoyment" that achieves the same purpose. However, at least there's a chance these can be fixed. Educating the customers is hard, but if you care, typically you CAN configure your own box to not zap PMTUD.
> It should be little surprise that the same firmware/UI that has such broken SIP ALG "support" also doesn't make it easy to block selected ICMP types.
> It sure isn't a surprise to me that these "free" routers also don't handle fragments and so get confused with some DNS traffic. Tried DNSSEC, anyone?

Each market has its own idiosyncrasies. Being on the same side of the pond 
but with subtle little addition: All ADSL lines are terminated at the CPE. 
This means that you are not allowed to supply you own DSL modem but have 
to suffer whatever (still chepo) router du jour the ISP in their infinate 
wisdom have choosen. If you are lucky you can get them to (for a fee) 
enable bridge mode where they in most(!) cases stop touching the traffic. 
To add additional pain to the suffering most of them are using 
"customized" firmwares which are often not kept timely up-to-date or they 
simply stopped caring.

That is just the usual residential and small office pains...

And then we have the "enterprise" (and wannabes). They have the proper 
equipment but the IT departments are often - shall we say - lacking. 
Lawrences observations are spot on.

So to get back to Brians original question: Where do you see the issues? I 
see them widely in both places and it comes down to the same basic issue: 
Nobody really cares! Getting things to really work *properly* is only a 
concern of a very very select few people. And most of the problems comes 
down to $$$

Residentials: The ISP only needs to push a simple product which is good 
enough for surfing. The quality of the firmswares being used on their CPE 
clearly demonstrates this. If you are into conspiracies you may not that 
many big ISPs are also telco's - but I honestly think it is more a 
question of $$$. Why supply a good CPE if most people accept the cheaper 
alternative. Sometimes you are able to configure them properly - other 
times that "feature" has been removed for simplicity

Commercial: Most firewall admins I have been in touch with have often not 
had a full understanding of their field. And those who had where often 
impaired with a "security" deparment/commitee/person/etc. Large 
organisations have the muscle to hire real networking people - but 
unfortunately they hire "security" personel at the same time.

The mainstream only learns from large mainstream problems. They have heard 
of "ping of death" which translates into ICMP=BAD! Whenever you come and 
try to educate people on the subject the typical reaction is not to 
readily embrace the more informed approach. Their stance is then that 
everything else is working and that you have a problem with your 
technology - because we know ICMP=BAD!

And along the same lines: Try arguing that NAT is bad and that IP was 
invented as a point to point protocol. Mainstream interpretation: 
NAT=firewall - "You said that we do not need firewalls!". Sorry - this was 
not meant as flamebait.

Luckily I do rarely deal with residential installs in my professional 
life. But on the commercial side we very very often end up spending more 
money on equipment rather than doing things "correctly". In the enterprise 
it is often easier to setup a seperate firewall/router for interconnect 
rather than getting the already existing infrastructure to play ball. And 
even to do that it ends up being easier to use seperate lines to avoid a 
lot of read tape! Truly a sad state of affairs...

I took the bait and ended up ranting. My apologies!

Kind Regards,
Claus Andersen