Subject: RE: [Mobike] Issue 41: Mandate NAT prevention if not doing NAT-T?

From: <[email-masked]>
Date: Mon, 19 Sep 2005 18:46:22 +0300

Francis Dupont wrote:

>  In your previous mail you wrote:
> 
>    To me it looks like IKEv2 w/tunnel mode IPsec could work through
>    "Basic-NAT-PT" type v4/v6 translation [RFC2766] (even if the
>    implementations don't support IKEv2 NAT-T).
>    
>    (But I haven't gone through all the details.)
>    
> => for instance how the NAT-PT translates the inner header (:-).

Well, it can't do that, of course -- but it's not necessarily needed,
because there's no need for the IP versions in inner and outer
headers to match.

Consider a case where we have a "remote access" VPN client connected 
to, say, IPv6-only GPRS/UMTS network, and a corporate VPN gateway
connected to IPv4 Internet (and presumably some IPv4 "intranet" or 
other protected network). If the IPv6 network has "Basic-NAT-PT"
deployed, the client could contact the gateway as usual (obtaining
a new IPv4 address from the protected network using configuration
payloads, etc.).

While I'm not very familiar with NAT-PT, to me it looks like this
would actually work just fine with normal IKEv2 (without NAT-T);
and the change you're proposing would forbid that (or force the
use of IKEv2 NAT-Traversal also for IPv6 :-)

(Well, that would be needed anyway once someone starts 
deploying IPv6 NATs :-)

Best regards,
Pasi
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Francis Dupont <[email-masked]>
Date: Mon, 19 Sep 2005 18:18:22 +0200

=> if the inner header doesn't need to be translated I recommend
to use something else than NAT-PT. BTW many implementations don't
support crossed-version tunnels (they should but they don't!)

=> you are using IPsec tunnels as a transition mechanism and
in the real world it works only with NAT-T.

=> IMHO you need NAT-T exactly for the same usual reasons.

=> it is not a real IPv6 and NAT-T is needed...

=> there is no need for IPv6 NATs (this subject is as popular in
IPv6 lists than changing text for something for RFCs in the IETF one :-).

PS: the standard solution for your example is to tunnel IPv4 over IPv6
(DTSM & co). When you add IPsec you have the choice between double
encapsulation or to NAT-PT the outer header (seems simpler but you
get all the NAT and NAT-PT issues...).

Regards

[email-masked]

PS: NAT-PT is enough problematic that it is being made historic.
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike