Subject: Re: [dhcwg] Re: DHCP behind NAT

From: Bernard Dugas <[email-masked]>
Date: Sat, 01 Sep 2001 13:57:07 +0200

Hello,

Ted Lemon a écrit :
> I agree with you, by the way, that your proposed way of doing this is
> better than the way that RFC2131 does it.   The problem is not that
> you're wrong, but that you're too late - this behavior was
> canonicalized in RFC951, and that's the last time it was possible to
> fix this the way you propose.   :'}

It's the 1st time that somebody tells me I've been born too late,
normally this is the opposite ;-)

Note that answering the ip source address is exactly the same that
answering the giaddr in a normal routed network, as the relay is the ip
source. So the proposed patch is not changing any behaviour in a normal
routed network, it's just changing behaviour in NAT context.

> I would recommend that you investigate the
> subnet selection option.   Send the address to which you want the
> reply sent in giaddr, and use the subnet-selection-option to store the
> address you would otherwise have stored in giaddr.

So I have to tell that to Cisco, so they change the way their NAT handle
DHCP relayed packet : only their NAT knows what is the right address to
answer to.

> There's no way to make your proposed change RFC2131 at this late date.
> Too many devices have been deployed that follow the current protocol
> specification. 

So ISC DHCPD will be the only available with a patch for NAT context,
and I will be the only ISP with a NAT service for its customers ;-)

More seriously, what is the point of a Request For Comment if valid
comments can't be  included ? Actually, I had no time to learn the
normal process of IETF, so I may have missed some points in the process.
I should spend some time on that.

Did you see the patch at :
http://www.is-pronet.com/download/dhcp-3.0rc11_NAT_patch.tar.gz

By the way, the ip source address is now in the lease struct, but not
the udp source port : a complete patch should certainly add it.

Thanks a lot for your answer, and for your work with this powerful ISC
DHCP server.
-- 

 __________ Bernard DUGAS ________________________________________
|                                                                 |
|  Technoparc Pays de Gex  mailto:[email-masked] |
|  30 Rue Auguste Piccard           Tel.: +33 450 205 105         |
| FR 01630 St Genis Pouilly         Fax : +33 450 205 106         |
|_________________________________________________________________|

_______________________________________________
dhcwg mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Ted Lemon <[email-masked]>
Date: Sat, 01 Sep 2001 09:31:15 -0400

> routed network, it's just changing behaviour in NAT context.

There's no reason to have this expectation.   A router normally has
several IP addresses, and any of them could be the source address.   I
would think it most likely that the source address would be the
IP address of the interface on which the relayed packet was sent to
the server, not the IP address of the interface on which the packet
was received.   This is of course usually a perfectly legitimate
address to which to return the packet.

> DHCP relayed packet : only their NAT knows what is the right address to

I believe that Cisco supports the subnet selection option.

> and I will be the only ISP with a NAT service for its customers ;-)

Somehow I don't think that this will be exciting news for your
customers.

> I should spend some time on that.

Of course you can make comments, but the time to do so is when the
draft comes out, which in this case would have been sixteen years
ago.   I wish you *had* made this comment then.   :'}

> http://www.is-pronet.com/download/dhcp-3.0rc11_NAT_patch.tar.gz

No, I'm not interested.   I think the subnet selection option solves
your problem, and it has the advantage of being standardized and not
requiring a patch to the server, although possibly the disadvantage of
not working with your router.   :'}

> Thanks a lot for your answer, and for your work with this powerful ISC

You're welcome!

			       _MelloN_