Subject: (ngtrans) Translation or tunneling

From: "Christian Huitema" <[email-masked]>
Date: Wed, 17 Jul 2002 01:07:51 -0700

Erik,

You made the statement about tunneling vs. translation in the WG meeting
this morning as well. While I agree that translation has many drawbacks,
I believe that we have to be careful before making sweeping statements,
in particular when evaluating the relative merits of technologies like
DSTM and NAT-PT.

For example, one of the argued advantages of DSTM is the absence of
translation; yet, I heard Jim explaining that the DHCP server for the
DSTM network could in some cases provide private IPv4 addresses. If that
is the case, then communications outside the DSTM network would involve
an IPv4 NAT, which would make the comparison argument kind of moot.
(There may still be an advantage when communicating inside the DSTM
network.)

Using private addresses in "IPv4 over IPv6" tunnels also raise another
issue, the possibility that members of two separate networks
inadvertently merge, ending up with situations where 10.0.0.1 speaks to
10.0.0.1... We should consider some protection, such as mandating that
private IPv4 addresses only be tunnelled over limited scope IPv6
addresses.

We should also look at issues such as ease of management, and set-up
time. The ease of using tunneling may vary depending of the type of
tunnel -- IPv6 over IPv4 seem to require less state than IPv4 over IPv6,
which may lead to different evaluations.

-- Christian Huitema

---

From: Pekka Savola <[email-masked]>
Date: Wed, 17 Jul 2002 11:22:56 +0300 (EEST)

Hopefully minutes will be up soon as I couldn't attend, but..

> an IPv4 NAT, which would make the comparison argument kind of moot.

This is my argument that in some (IMO many) cases private IPv4 addresses 
(which may need to be used _anyway_) via DHCP in DSTM is considerably 
better than using temporarily assigned (or worse, specific port ranges 
too) public IPv4 addresses.

I think the most important thing to remember is that people who use 
private IPv4 addresses in scenarios like this need to use them anyway on 
their IPv4-only nodes -- so nothing seems to be lost.

> (There may still be an advantage when communicating inside the DSTM

Sure.  And more.

We can look at DSTM to provide two things:

 1) Global IPv6 connectivity, good end-to-end etc.
 2) An ability to switch from IPv4 private addresses to IPv4 global 
addresses, which are shared between nodes. (Due to arguably smaller need, 
so fewer addresses will be enough).

My argument is that 2) is out of the scope.

From 1), both approaches are equal, *but* keeping to use IPv4 private 
addresses is _much_ simpler.

> private IPv4 addresses only be tunnelled over limited scope IPv6

I don't think such restrictions are necessary.  People _will_ always be 
able to shoot themselves in the foot.

We need to make sure, when creating automatic tunneling and similar 
mechanisms, that this isn't too easy, though.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 17 Jul 2002 10:27:35 +0200 (CEST)

> in particular when evaluating the relative merits of technologies like

I believe I even qualified my statement in the meeting with "all other things
being equal". I agree that there are other considerations, but I wanted
to make sure that folks don't use translation when both endpoints implement
a common version of IP, since I read things that could  be interpreted that
way.

> private IPv4 addresses only be tunnelled over limited scope IPv6

Is this prohibited for IPv4-in-IPv4 tunnels?
Suggesting that folks not do stupid things is one thing (and explaining
how they can be avoided), but prohibiting stupid things is different.
Prohibiting harmful things is something different.

> which may lead to different evaluations.

Yes, at least things like 6to4 tunnels require less configuration.

  Erik