Subject: (ngtrans) Re: IPv6 only devices in home network

From: Caitlin Bestler <[email-masked]>
Date: Fri, 11 Oct 2002 10:06:02 -0500

Keith Moore wrote:

> No. NAT (including NAT-PT) breaks applications. a big
> reason to use IPv6 is to avoid having your applications
> broken by NAT.

I suspect this is not a real problem. By the time ISPs
are assigning their clients IPv6 addresses rather than
public IPv4 addresses virtually all public servers will
be ready to accept IPv6 connections.

More precisely, I find it hard to imagine an ISP depriving
customers who do not know what an IP address is at all
of default connectivity before the common servers are
supporting IPv6.

To whatever extent the ISPs lead the servers, however,
you are ultimately going to have to rely on NAT. If the
ISP had enough public IPv4 addresses to give out they
would never have converted to IPv6 in the first place.

While neither is desirable, it is far more realistic to
have application developers work in NAT compatible ways
than to get all NAT boxes removed.

Do you really think there is a large body of code that
is IPv6 ready that is *not* NAT tolerant?

---

From: Keith Moore <[email-masked]>
Date: Fri, 11 Oct 2002 12:09:16 -0400

> be ready to accept IPv6 connections.

I don't buy it for a millisecond.  Why in the world do people think
that all ISPs are going to migrate to IPv6 in lock step when the
evidence overwhelmingly contradicts that?  For that matter, why do 
people assume that all users use the same applications and have the
same needs, or that all applications have 'clients' and 'servers'?

> you are ultimately going to have to rely on NAT. 

NATs will have to be used in corner cases.  They are not, and cannot
be, general solutions.

> than to get all NAT boxes removed.

that's a ridiculous statement.  what is realistic for some applications
is completely infeasible for others.

> is IPv6 ready that is *not* NAT tolerant?

yes, there are many such applications.  and IPv6 will allow more 
of those applications to exist.

Keith

---

From: "Zhang haofeng" <[email-masked]>
Date: Sun, 13 Oct 2002 22:02:25 +0800

So I think it is old issue which has been discussed here for such a long time. It's a fact that NATs exist almost everywhere in the current ISP network. Maybe Teredo is a better solution?
After all, we need a convenient and not costly way to cope with NAT problems during the transition period.

---

From: Caitlin Bestler <[email-masked]>
Date: Sun, 13 Oct 2002 13:57:33 -0500

On 10/13/02, Zhang haofeng wrote:

>So I think it is old issue which has been discussed here
>for such a long time. It's a fact that NATs exist almost
>everywhere in the current ISP network. Maybe Teredo is a
>better solution?
>After all, we need a convenient and not costly way to cope
>with NAT problems during the transition period. 
>
>

My understanding is that Teredo is a solution for home
networks to use *before* their ISP is ready to assign
IPv6 addresses.

The real challenge is to convince ISPs that it is better
to assign IPv6 addresses than private IPv4 addresses.
In either case translation is required to connect with
IPv4-only hosts, but the IPv6 address is public and can
be used to connect with IPv6 hosts without restriction.

Caitlin Bestler
http://asomi.com/CaitlinBestler/

---

From: "Zhang haofeng" <[email-masked]>
Date: Mon, 14 Oct 2002 10:20:01 +0800

> The problem with Mr. Moore's arguments is that he is trying to transition
> from what he
> thinks the IPv4 network *should* have been to an IPv6 network. The real goal
> is to
> transition the real IPv4 network to IPv6. If we take an attitude that NAT is
> "impure"
> and hence not to be supported in transition plans, we will simply encourage
> corporate
> intranets to *remain* firmly behind their NAT walls.

        Yes. But the introduction of IPv6 is to move NATs which break applications, as you know. we encourage each IPv6 user to have the conception of Peer to Peer instead of Client-Server. As far as the security problems, we should find another way to cope with, which is beyond our discussion here.
        The concept of Internet is to be simple. So it's now. First, we encourage all the hosts(including corporate intranets) to support dual stack. If the host is located behind a NAT(s), it can use Teredo Service while wanting to get global IPv6 connectivity. If the host has the public IPv4 addresses, 6to4 is prefered.
        For IPv6 only hosts, when they want to communicate with IPv4 servers, NAT-PT may be the only solution.

> It's also very important to understand that most corporate system admins do
> not want
> their internal machines to be reachable as servers, or even to be easily
> identified. What
> business wants its competitors to know how many desktop machines they have
> running?
> Part of the transition is selling IPv6 features, such as the use of
> dynamically generated local
> interface IDs, that can provide the same benefits.

        I agree. I think what we are discussing now is departing from the oringinal purpose. For each transition strategy, we consider the host that it's IPv4 only, dual stack or IPv6 only. For IPv6 only hosts, we have no choice but to use NAT-PT in some scenario. Since NAT is hard to manage, NAT-PT is more confusing which should be regarded as the last sort of providing IPv6 connectivity,  in my opinion. :-)
        Am I correct?

---

From: "Zhang haofeng" <[email-masked]>
Date: Mon, 14 Oct 2002 10:38:04 +0800

> be used to connect with IPv6 hosts without restriction.

        I agree. But the real challenge I think is applications. Even translation is required when ISPs assign private IPv4 addresses, the clients have enough applications to use. But when ISPs assign IPv6 addresses, can you imagine that these IPv6 clients can only use FTP, Telnet, Traceroute, Web etc?

---

From: Keith Moore <[email-masked]>
Date: Mon, 14 Oct 2002 01:18:17 -0400

(I assume this is Caitlin Bestler's statement?)

> from what he thinks the IPv4 network *should* have been to an IPv6 network. 

It always amuses me when people publically state their assumptions about what 
I'm trying to do - especially when those assumptions are inconsistent with 
what I'm actually doing.  

The statement quoted above is particularly silly.  If the IPv4 network had been 
what I think it "should" have been, there would have been no need for IPv6,
nor for any transition tools.

Transition tools like 6to4 and my 6overNAT proposal (superficially similar to 
Teredo) were clearly and explicitly designed to transition from a world which 
includes NATs to one which does not include (or need) NATs - in other words, 
a world which supports efficient and robust operation of a wider variety of 
applications.

Keith

p.s. It's one thing to be endlessly pushing the same rock up the same hill 
only to have it fall back down; it's quite another to claim that the need to 
endlessly push the rock up the hill is somehow natural or beneficial.

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 15 Oct 2002 18:03:57 +0200

Keith Moore wrote:
...
> endlessly push the rock up the hill is somehow natural or beneficial.

Indeed. I am sitting in a Global Grid Forum meeting connected via wireless (good)
and Net 10/NAT (bad). It turns out this forces me and all my IBM colleagues
here to use a VPN solution based on IPv4 over SSL over TCP over IPv4...

If I was connected via IPv6 and NAT/PT the VPN solution would be even more
horrible no doubt. Let's not advocate such solutions except as an
absolute last resort.

   Brian