Subject: RE: (ngtrans) call for discussion on NAT traversial

From: George Tsirtsis <[email-masked]>
Date: Wed, 18 Jul 2001 05:05:41 -0400

-----Original Message-----
From: Pekka Savola [mailto:[email-masked]]
Sent: Tuesday, July 17, 2001 6:10 PM
To: Alain Durand
Cc: [email-masked]
Subject: Re: (ngtrans) call for discussion on NAT traversial

...

Well, a crux here is whether the mechanisms are needed for the user to
tunnel IPv6 into NAT regardless of what ISP does (e.g. using a protocol
that can traverse NAT after a fashion already, like UDP, instead of IP
protocol 41), or whether "ISP-driven" approach is acceptable.

If it can be assumed that "ISP Is the Good Guy" and actually wants to
enable ipv6 if it's in any way possible, then there are various options
for this.. but I fear this may not be valid in practise for a long time
yet.

GT> But unless the ISP cooperates nothing will work. A firewall can always
block something, whatever that is...it is only a matter of parsing packets
deep enough...
I think the aim should be to provide mechanisms to end users AND ISPs so
they can deploy IPv6 over a NAT impaired IPv4 network...That would allow
people that do not have IPv4 addresses (and thus use NAT) to deploy IPv6 and
get the benefits.
The bottom line is that NAT-traversal should be for the benefit of both ISPs
and end-users...we need ISPs with use not against us. In fact I would make
sure that ISPs have clear control over this and can (IF they want)
allow/dissallow IPv6 use on a per customer bases...AAA/BURP/DHCP etc may
help here.

GT> In the process, however, we might find some clever ways to bypass
"non-cooperative" ISPs but...shhhhh...do not tell anyone ;-)

---

From: Pekka Savola <[email-masked]>
Date: Wed, 18 Jul 2001 16:41:05 +0300 (EEST)

> block something, whatever that is...it is only a matter of parsing packets

What I meant was:

1) ISP actively seeks to make IPv6 available
2) ISP does not care about IPv6 a bit

not:

3) ISP actively seeks to disallow IPv6

If you have BOFH ISP like 3), you're in rather big trouble and I doubt
anyone can do that much about it.  Sure, there are ways (ipv6 over http,
anyone...), but we shouldn't waste the time on this.

In the end, if ISP NAT/firewall policy is "default to accept" (99.9%
times at least), this can be hacked to work.

> people that do not have IPv4 addresses (and thus use NAT) to deploy IPv6 and

There are already mechanisms for this, but more automation (a 6to4 kind of
method, instead of static or semi-static tunnels in NATted network) would
be nice I suppose.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Keith Moore <[email-masked]>
Date: Wed, 18 Jul 2001 11:42:47 -0400

My assumption in writing 6overNAT was that the main problem with NATs
was not with ISPs that impose NATs, but with NATs that are deployed
in enterprise networks.    My understanding was that ISPs that impose
NATs on their customers are somewhat rare; this may have been incorrect
or the situation may have changed since then.

Naturally I'm happy if we develop a solution that works for both the
enterprise case and the case where the ISP imposes a NAT.  However 
I agree that any ISP that imposes a NAT on its customers (thereby
greatly impairing their ability to use some Internet applications) 
will not hesitate to block IPv6 traffic if they want to.  

Keith

---

From: Jim Bound <[email-masked]>
Date: Wed, 18 Jul 2001 14:18:23 -0400 (EDT)

Hi Keith,

I guess this is ok for operations work in the IETF.

In the industry for deployment of IPv6 I am working with principals to
develop examples and methods for deployment using systems integration of
config tunnels, 6to4, DSTM, and ISATAP  where NAT for IPv6 is rarely ever
needed at all.  Only in rare cases.  As its a deployment issue and the
work will be sent worldwide (and most of the world don't have enough IPv4
addreses for wide NAT use for IPv6 transition only the U.S.) and also
focuses on keeping e2e as transition objective.  I was not sure I sure
submit such work to the ngtrans group or the IETF.  And I don't believe it
should be but it is another perspective for deployment of IPv6 and that is
to avoid NAT whenever possible.  It messes up to much stuff.

regards,
/jim