Subject: [Tsvwg] SCTP and NAT

From: "Poetzl, Joachim" <[email-masked]>
Date: Thu, 11 Apr 2002 16:43:56 +0200

Hi SCTP experts,

who can help?

Does SCTP work with NAT? 
What are the related drafts and RFCs?
Any experience on that topic?

What are advantages / disadvantages using SCTP in conjunction with TLS or IPSec?

What about the discussion on the TLS over SCTP Draft (draft-ietf-tsvwg-tls-over-sctp-00.txt)? The draft is still in version 0.

Thanks for your help in advance.

Regards

> Joachim Pötzl
........................................................................................
Deutsche Telekom AG
Zentralbereich Netzinfrastruktur (ZB NI)
NI196a13; Signalling, Gateways and Switching Systems
64307 DARMSTADT, GERMANY 
Phone:  +49 6151 83-2134
Fax:      +49 6151 83-4577
email:	[email-masked]
........................................................................................

_______________________________________________
tsvwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tsvwg

---

From: Randall Stewart <[email-masked]>
Date: Tue, 16 Apr 2002 07:57:56 -0500

A small comment or two..

> Does SCTP work with NAT?

I think Michael as pointed out a "new" RFC that discusses this in
some detail. But I will add a few rambling thoughts on the matter....

NAT's WILL work with SCTP if you are talking singly homed and the
SCTP implementation as enough address selection sense to NOT include
any addresses in the address list. I believe our implementation on
BSD will do this (available at http://www.sctp.org and soon it
will be released as part of kame). The basic idea is that the 
SCTP implementation behind the NAT must realize it has a private
address and then only send either the INIT or INIT-ACK back to
the "global" address without listing any of its addresses.

If the SCTP implementation is multi-homed and would like to 
be able to take advantage of that ... say something like:

           (Private Address)-----NAT-1-----IP-X(Global address)
    IP-P1-----+
SCTP
    IP-P2-----+
           (Private Address)-----NAT-2-----IP-Y(Global address)

The SCTP implementation would require assistance from the two
NAT's in order to make this work..

You would need the NAT's to:

1) Do stateful inspection of the address lists and substitute
    IP-P1/IP-P2 for IP-X and IP-X (in the INIT/INIT-ACK messages). 
2) Communicate with the peer NAT through some mechanism to
   allocate a COMMON port number and setup the mapping.
3) Coordinate the tear down of this state when the association
   ends.. note that EITHER side could get the tear down indication.

I don't believe there is ANY way this can be done today without
further work on NAT's which I DO NOT advocate. A far better way
to get multi-homing is to move to IPv6 and then both sides can
have nice global addresses :>

R

-- 
Randall R. Stewart
[email-masked] 815-342-5222 (cell phone)