Subject: question about draft-durand-v6ops-natv4v6v4-00

From: marcelo bagnulo braun <[email-masked]>
Date: Sun, 18 Nov 2007 20:32:30 +0100

Hi Alain,

in you draft in section 4.2 you state that:

    The first drawback is that
    some applications may have a more difficult time going through two
    levels of NAT.

Can you point some examples for this case?

Then in section 4.3 you state that:

    The implications of this second level of translation is very similar
    to those in the model above of a double IPv4->IPv4->IPv4  
translation.

There were two concerns in the previous case, the applications that  
can fail more when there are two levels of nat than when ther is one  
level of nat and that a big provider rfc1918 addrsses may not be enough.
But the concern of running out of RFC 1918 addrsses for big providers  
does not exists when using IPv6 in the internal netwrok of the  
provider, so there is only the problem with the apps thatfail more  
when there is a single level of nat than when there is 2 levels of  
nat, right?

Do you think that current nat traversal techniques would not work  
properly if multiple levels of nats need to b traversed?

Regards, marcelo

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 19 Nov 2007 10:15:15 +0100

> Can you point some examples for this case?

Hm, yes, is anyone has experiences in this area that would be good to  
know.

I'm assuming it's much worse but I have no actual data.

> properly if multiple levels of nats need to b traversed?

As far as I've been able to deduce, uPnP and NAT-PMP (not IETF work)  
that are common in consumer CPEs won't work unless there is one NAT  
and it's on the local LAN. I could be wrong, though.

---

From: james woodyatt <[email-masked]>
Date: Tue, 20 Nov 2007 14:48:39 -0800

On Nov 19, 2007, at 01:15, Iljitsch van Beijnum wrote:
> As far as I've been able to deduce, uPnP and NAT-PMP (not IETF  
> work) that are common in consumer CPEs won't work unless there is  
> one NAT and it's on the local LAN. I could be wrong, though.

This is correct.  I know of at least one real application that works  
through one layer of NAT, but not two: the Back To My Mac feature in  
Mac OS X 10.5, which relies on registering wide-area DNS-SD service  
advertisements in the members.mac.com zone for the tunnel endpoints.   
The mDNSResponder agent doesn't manage the UNSAF problem when there  
are multiple levels of NAT between the Mac OS X host and the DNS  
servers.

BTMM can use either NAT-PMP or UPnP IGD.  No other mechanisms are  
supported.

--
james woodyatt <[email-masked]>
member of technical staff, communications engineering