Subject: RE: [Mip6] concensus: issue 76: Alt CoA should not beusedwhen traversingIPv4 NAT

From: "Soliman, Hesham" <[email-masked]>
Date: Wed, 1 Nov 2006 03:41:24 -0800

This is a good idea I think. But let's save this discussion for the
separate issue handling the integrity of the packet. I'll send it out
soon. But my initial reaction is that this might be better than the
checksum option since it doesn't add anything new and doesn't add
overhead. 

Hesham

 > -----Original Message-----
 > From: Narayanan, Vidya [mailto:[email-masked]] 
 > Sent: Wednesday, November 01, 2006 5:36 PM
 > To: Vijay Devarapalli; Soliman, Hesham
 > Cc: [email-masked]; Pascal Thubert (pthubert)
 > Subject: RE: [Mip6] concensus: issue 76: Alt CoA should not 
 > beusedwhen traversingIPv4 NAT
 > 
 > 
 > I don't understand something here. Why would ESP tunnel mode 
 > not provide
 > the needed protection? Given that we already have two IP 
 > headers in this
 > case, it isn't even adding any overhead. I can't see why we need
 > anything else. 
 > 
 > I can understand not wanting to impose AH, but I don't see ESP tunnel
 > mode as a restriction at all. 
 > 
 > So, the headers would simply be:
 > 
 >   IPv4 HDR (src=natted-v4, dst=HA-addr)
 >        UDP
 >           ESP
 > 	      IPv6 HDR (src=v4-mapped-v6, dst=HA-addr)
 >               DST-OPT
 >               MH (BU)
 > 
 > 
 > What's the problem with that? 
 > 
 > Vidya
 > 
 > 
 > > -----Original Message-----
 > > From: Vijay Devarapalli [mailto:[email-masked]] 
 > > Sent: Tuesday, October 31, 2006 8:00 PM
 > > To: Soliman, Hesham
 > > Cc: Narayanan, Vidya; [email-masked]; Pascal Thubert (pthubert)
 > > Subject: Re: [Mip6] concensus: issue 76: Alt CoA should not 
 > > be usedwhen traversingIPv4 NAT
 > > 
 > > Soliman, Hesham wrote:
 > > >  > well, if there is a NAT on the path the source  > 
 > address on the 
 > > > outer IPv4 header is modified.
 > > >  > anytime a packet goes through a NAT, we have  > this 
 > > problem. this 
 > > > is a common problem. so I  > don't think we should design a 
 > > DS-MIPv6  
 > > > > specific mechanism to protect  an address that  > is 
 > > modified by the 
 > > > NAT. its not worth it.
 > > > 
 > > > => You keep repeating that and I keep answering as follows: 
 > > If there 
 > > > is an alt-coa in the packet then the HA has no way of 
 > > knowing if there 
 > > > was a NAT or not without checking it first, it can't 
 > simply compare 
 > > > the outer headers...
 > > 
 > > I actually agree with this. :)
 > > 
 > > Again, this has nothing to do with the presence of the
 > > > NAT and everything to do with the presence of the alt-CoA...
 > > > 
 > > > So it makes zero sense to say that the "HA should ignore 
 > > the alt-coa 
 > > > if a NAT were detected" because the HA can't possibly know 
 > > that a NAT 
 > > > was en route without inspecting the alt-coa....
 > > 
 > > hmmm... there is a misunderstanding. I didn't say ignore the 
 > > alt-CoA option. I said the HA should not use the contents of 
 > > the altCoA option as the CoA when it detects a NAT.
 > > 
 > > it does not matter if the HA compares the source address on 
 > > the outer IPv4 header with the source address of the inner 
 > > header or the contents of the altCoA option to detect the 
 > > presence of a NAT. its the same for me.
 > > 
 > > Vijay
 > > 
 > 
 > _______________________________________________
 > Mip6 mailing list
 > [email-masked]
 > https://www1.ietf.org/mailman/listinfo/mip6
 > 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6