Subject: Re: [nat66] Fwd: [BEHAVE] New NAT66 Discussion List

From: Margaret Wasserman <[email-masked]>
Date: Fri, 6 Feb 2009 07:15:14 -0500

Hi Matthew,

On Jan 15, 2009, at 6:47 AM, Matthew Ford wrote:
> If a BOF is to take place, I'd very much like to see a presentation  
> from a potential *customer* for this technology about why they think  
> they need it.

Fred Baker did include a "customer" presentation (why the Cisco IT  
department requires an IPv6 NAT) in his slides at the BEHAVE WG  
meeting in MInneapolis.

It would be great to have another one, though!  Any "customers" out  
there who could give a presentation?  If you work at a company that  
currently uses IPv4 NAT, perhaps you could ask your IT folks for their  
thoughts on transitioning to IPv6?

Margaret

---

From: Gert Doering <[email-masked]>
Date: Sun, 8 Feb 2009 21:13:52 +0100

Hi,

> department requires an IPv6 NAT) in his slides at the BEHAVE WG  

Are these slides available online?  I'd like to look at it and understand
why a company that has an IPv6 /32 - which already brings all the 
usual reasons listed, like "not renumbering, provider independence, 
stable internal addressing" - thinks they need to use NAT.

(And no, layer 3 loadbalancing gear is not something I'd consider "NAT",
even if it technically is very similar - there you might actually need
some packet munging, but this is very special-cased)

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  128645

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

---

From: Margaret Wasserman <[email-masked]>
Date: Sun, 8 Feb 2009 15:48:16 -0500

Hi Gert,

On Feb 8, 2009, at 3:13 PM, Gert Doering wrote:
> Are these slides available online?

Yes, the full set of NAT66 slides are available online in the IETF  
proceedings here:

http://www.ietf.org/proceedings/08nov/slides/behave-14.pdf

Fred's slides start a bit more than half way through with "Reasons to  
use translation: IPv6/IPv6".

> I'd like to look at it and understand

There are many companies with ample IPv4 swamp space that choose to  
use IPv4 NAT for some of all of their internal network.  There are a  
lot of reasons why they do this.

As I mentioned previously on the BEHAVE list, I once worked for a  
company with plenty of IPv4 swamp space that used NAT for most of  
their corporate network.  When I asked why, I was told that they used  
NAT because:

- They did not want to contract with their ISPs to route their  IP  
prefixes across their multi-site network.  Apparently this costs money  
and is prone to problems.
- They were unwilling to use ISP-provided addresses internally,  
because they did not want to be required to renumber if the ISP  
renumbered their network, or if they decided to change ISPs.
- They considered the "stateful firewall"-like behaviour of NAT to be  
a benefit, and they considered NAT to be part of their security  
architecture.

In some cases, companies with plenty of IPv4 swamp space use NAT only  
for small parts of their networks -- satellite offices, etc.  They do  
this because it is (in their opinion) beter to have an ISP route their  
whole IPv4 prefix to one site, and to use ISP-provided addresses (and  
NAT, to gain address independence) at other sites than it would be to  
ask their ISP to configure longer prefixes in the ISP routing tables  
(and change them over time, etc.)

In the use case that Fred explored, Cisco uses nat for business-to- 
business links with partners.  The use of NAT allows them to provide  
those partners with access to specific services, without exposing the  
internal details of the Cisco network and/or requiring the partner to  
reconfigure things on their end when something on the Cisco end is  
changed -- Cisco can just reconfigure the NAT.

It has been my experience that there are many enterprise networks that  
have plenty of IPv4 swamp space and choose to use IPv4 NAT.  It  
doesn't seem like the existence of PI space in IPv6 will change that.

Margaret

---

From: Erik Kline <[email-masked]>
Date: Sun, 8 Feb 2009 16:21:36 -0800

>> If a BOF is to take place, I'd very much like to see a presentation from a
>> potential *customer* for this technology about why they think they need it.
>
> department requires an IPv6 NAT) in his slides at the BEHAVE WG meeting in
> MInneapolis.

With all due respect, I was not convinced that the customer use case
presented was derived from actual IPv6 experience.  Specifically: I
fully believe that there's a bunch of experience with the problem in
IPv4, as described in draft-baker-v6ops-b2b-private-routing-00,
however I was unconvinced that a solution had actually been attempted
in IPv6.  Furthermore, Fred's approach in this draft is to recommend
the use of ULAs, which seems like a perfectly fine solution (the
security concerns don't seem fleshed out nor particularly convincing,
and I've never been convinced by arguments that devolve into "someone
could make a configuration error").  So it seems to me like this draft
does *not* count as a case pro IPv6 NAT.  It seems to me that ULAs +
SPI firewalling (+ optional application-layer gateways, as needed) can
be used to solve this particular problem very effectively.

I hope I'm not too rude by asking to see the actual customer pain, as
opposed to the customer fear, which I consider different.

Solving the multihoming problem, though, is still another matter...