Subject: (ngtrans) draft-durand-ngtrans-nat64-nat46-00.txt

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Thu, 18 Jul 2002 07:47:07 +0900

here are my comments on this document.  i'm still not sure what is the
	fundamental difference with NAT-PT - the document looks like SIIT
	(NAT64 side) and NAT-PT (NAT46 side) combined, and nothing more than
	that.

itojun

section 4.3
	i really would like to see the use of IPv4 mapped address on the
	wire be prohibited, as it has a lot of security drawbacks as presented
	in draft-itojun-ipv6-transition-abuse-01.txt and
	http://www.kame.net/dev/cvsweb.cgi/kame/kame/kame/v6test/conf/transition-abuse.conf.

	therefore, i am not in favor of the whole text in section 4.

section 4.4
	in the diagram, we see "::ffff:0/96" appears.  it should be
	"::ffff:0:0/96".

section 4.6
	the section basically means "you can distribute the load amoung multiple
	NAT64 boxes".  i think you should explicitly state that "NAT64 boxes
	are still single point of failure".

section 5
	i don't see any fundamental difference with NAT-PT.  could you
	enlighten me on this?

---

From: Alain Durand <[email-masked]>
Date: Thu, 18 Jul 2002 02:23:56 +0200

> 	i don't see any fundamental difference with NAT-PT.  could you

The key difference is that in NAT-PT, the mapping is done in the DNS 
servers
as in NAT46 it is done in the DNS resolvers.

	- Alain.

---

From: Alain Durand <[email-masked]>
Date: Thu, 18 Jul 2002 03:25:58 +0200

> 	(NAT64 side) and NAT-PT (NAT46 side) combined, and nothing more than

NAT64 is not SIIT. SIIT does not enable you to use a 'regular' IPv6 
address
as source address.

NAT46 is not NAT-PT, as I said in my previous comment,
the key difference is the mapping is done in the DNS server
in NAT-PT as it is done in the resolver in NAT46.

> 	therefore, i am not in favor of the whole text in section 4.

I'm not sure I understand how draft-itojun-ipv6-transition-abuse-01.txt
applies to IPv6-only nodes.
Also, the problems you points are in the category of
"increase complexity" for access control that can be
resolved one way or another by a cluefull implementation that care.

> 	in the diagram, we see "::ffff:0/96" appears.  it should be

Good catch, thanks.

> 	are still single point of failure".

True.

---

From: [email-masked]
Date: Sat, 20 Jul 2002 08:32:29 +0900

another comment:

	the document assumes that nodes in NAT64 cloud are IPv6-only.  this
	is not always the case - we have a lot of configuration where:
	- nodes within cloud is dual stack,
	- there's no IPv4 address configured,
	- and we want to access IPv4 resource outside.

	as most vendors ship with IPv4/v6 dual stack configuration,
	and it won't change over time i guess (more config diffs = more support
	load), applicability of NAT64 is fairly limited.

itojun