Subject: Re: (ngtrans) draft-hallin-natpt-dns-alg-solutions-00.txt

From: Suresh K Satapati <[email-masked]>
Date: Thu, 11 Jul 2002 16:06:37 -0700 (PDT)

See inline and more comments below.

>
> 1)
>    2.1 AAAA answers for A queries
>
>    ...
>
>    ---------------------------------------------------------------------
>    => NAT-PT should only be used by IPv6-only nodes.  These nodes should
>    not use IPv4 DNS (A), thus the NAT-PT should refuse any A queries
>    made by internal nodes.
>    ---------------------------------------------------------------------
>
> => Another solution is to keep a track of DNS queries (each DNS query/answer
> has an unique ID). When it was an A query from an internal node, DNS-ALG
> returns A answer to the requester (without changing to AAAA).
> I think IPv6-only nodes can send A queries and DNS-ALG can provide this
> ability.
>

I agree. Not accepting 'A' queries sent by IPv6-only nodes is not the solution
for this problem. Ofcourse, the above requires some statefulness  with an expiry
mechanism to delete the state.

>
> 2)
>    2.3 NAT-PT & IPv6 default router
>    ...
>
>    However, a more scalable approach is that IPv6-only clients connected
>    to the NAT-PT, do all IPv6 DNS resolution over translated IPv4.  The
>    IPv6-only clients set NAT-PT_PREFIX:ipv4_dns as their DNS server,
>    where NAT-PT_PREFIX is the NAT-PT prefix in the NAT-PT domain and
>    ipv4_dns is a DNS server in the IPv4 domain.  All DNS messages will
>    then be routed through the NAT-PT.  Dual-stack nodes will continue to
>    use their ordinary DNS server.  Their DNS traffic will not be routed
>    through the NAT-PT.  Thus, dual-stack nodes have no contact with the
>    NAT-PT in the network.  The NAT-PT is not required to be the default
>    IPv6 router of the site.  Only traffic in need of translation will be
>    routed through the NAT-PT.  This set up works provided that the IPv4
>    DNS server supports IPv6 DNS.
>
>    ---------------------------------------------------------------------
>    => It is not necessary for the NAT-PT to be the only default router
>    in the IPv6 domain.  The only traffic that has to go through the NAT-
>    PT is the one that needs to be translated.
>    ---------------------------------------------------------------------
>

An IPv6-only node need not always go through NAT-PT, to resolve a name (AAAA)
for another IPv6-only or a dual-stack node. This case is still not covered
by the above proposal.

In 2.2, there is a possibility that the application could give up DNS
resolution attempts due to increased DNS reply latency, thereby failing to
establish a session.

In 3.1, an assumption is made about the address extracted by removing
NAT-PT prefix. The address thus obtained need not be a valid IP address.
For e.g., suppose NAT-PT prefix is 3000::/96, an IPv4 address 192.168.10.1
could very well be mapped to 3000::1 instead of 3000::192.168.10.1
Such configurations could be expected when a user wants to assign a pool
of IPv6 addresses instead of configuring a mapping for every IPv4 node.

-Suresh

---

From: Keith Moore <[email-masked]>
Date: Thu, 11 Jul 2002 20:20:13 -0400

> of IPv6 addresses instead of configuring a mapping for every IPv4 node.

so what you are saying is that IPv6 addresses should be less stable than IPv4
addresses?  

Keith

---

From: Suresh K Satapati <[email-masked]>
Date: Thu, 11 Jul 2002 17:44:10 -0700 (PDT)

That was not the intention. Its an instance where the proposed approach
could fail.

Suresh