Subject: RE: (ngtrans) draft-durand-ngtrans-nat64-nat46-00.txt

From: "Christian Huitema" <[email-masked]>
Date: Wed, 17 Jul 2002 15:26:03 -0700

> I agree with you that there is a need for a scalable solution to the
> translation interworking problem before serious deployment can happen.
> However, I don't believe that NAT-PT is irredeemably broken 
> and I think that
> several of the ideas presented in this draft could easily be 
> applied to
> NAT-PT. There are already several quite mature 
> implementations of NAT-PT and
> improvement of the spec rather than re-invention is therefore 
> extremely
> desirable in my opinion. Let's fix the NAT-PT spec rather 
> then generate yet
> another mechanism.

NAT-PT is indeed broken. Some would say that all NAT are broken, but
NAT-PT is in fact a bad NAT design. The problematic part of the design
is the reliance on DNS mungling to direct IPv6 nodes towards using the
NAT: this has side effects such as preventing IPv6 nodes from ever
learning the IPv4 address of the target, and impeding DNS security.
Also, the design would fail whenever the IPv4 address is learned by
other means than the DNS (e.g. litteral URL), or when the DNS resolution
path happens to not cross the NAT-PT. NAT64 may or may not be the right
answer, but we should definitely revise NAT-PT, and at a minimum replace
the DNS processing section by a simple reference the the NAT-PT device
"MUST NOT" alter the content of DNS packets.

-- Christian Huitema

---

From: Suresh K Satapati <[email-masked]>
Date: Wed, 17 Jul 2002 16:01:44 -0700 (PDT)

I agree there are problems with DNS-ALG part of NAT-PT, but the issues
that you have raised are easy to fix.
draft-hallin-natpt-dns-alg-solutions-00 had already pointed out a few.
An updated version (to be posted soon) will talk about this.

Suresh

---

From: Keith Moore <[email-masked]>
Date: Wed, 17 Jul 2002 19:34:40 -0400

> but we should definitely revise NAT-PT, and at a minimum replace

agree entirely.  

Keith