Subject: Re: (NAT) Host NAT issues and Security Policy Servers

From: "Mike Borella" <[email-masked]>
Date: Tue, 8 Dec 1998 16:59:16 -0600

This is an issue of finding the lesser evil.  If you are in a situation in

which you require some form of NAT with end-2-end characteristics,

you can either not deploy anything, or bite the bullet and modify your
      hosts.

-Mike

Brian E Carpenter <[email-masked]> on 12/08/98 05:59:54 AM

Please respond to Brian E Carpenter <[email-masked]>

To:   [email-masked]
cc:   Michael Richardson <[email-masked]> (Mike
      Borella/MW/US/3Com)
Subject:  Re: (NAT) Host NAT issues and Security Policy Servers

Just replying to NAT list:

I want to observe that e2e IPSEC and e2e NAT share an annoying
characteristic: you have to modify the software in the hosts.

If NAT has an advantage, it's the same one as gateway IPSEC:
you only have to put the magic in the gateways. That's why
traditional NAT has been fairly widely deployed. Figuring out
how to live with traditional NAT is a very different game from
trying to deploy DNAT/HNAT/whatever.

-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.