Internet2 Network Security SIG

[Andrew Gallo <>]

On 5/8/2017 5:02 PM, David Farmer wrote:
> I've been asked some questions about how campus border policy (traffic
> policy as opposed to route policy) is controlled at other institutions. So,
> I'm interested in answers to the following questions;
>
> 1. Who determines border policy?  What roles do other teams play in
> determining border policy?

Policy is primarily our Security group, with consultation from network 
engineering

> 2. Who implements border policy changes?

Network engineering
> 3. Is you border policy implemented in a router (presumably stateless) or
> firewall (presumably stateful)?
Stateless filtering at the border routers, stateful and application by 
border firewalls.

> 4. Is border policy regularly reviewed? By who? How often?
No, but I would recommend it.  There are exceptions in our filter list 
that go back over 10 years.  If there is a request to block either a 
prefix or application, there should be a time limit for removal, unless 
it really needs to be permanently blocked.  Then, any exceptions should 
be regularly reviewed.
> 5. How are exceptions handled?
A request and review process handles changes to existing policy.
> 6. Is there formal documentation of your border policy?
Maybe, but I"m not aware of it :)
> 7. Recommend list of things to include in a border policy?


> Thanks

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature