Re: [BEHAVE] [v6ops] protocols without need for ALG ?

[Tore Anderson <[e-mail]>]

* Toerless Eckert

> On Sat, Aug 01, 2015 at 04:52:17AM +1200, Brian E Carpenter wrote:
> > Yes, but we assume that during the phasing-in of autonomic
> > operations, we will be forced to interface to legacy NOCs.
> 
> Right. It's just like siit-dc, just the opposite: We want to enable
> the IPv6 only autonomic network (like they an IPv6 only DC) of course
> to also encourage the IPv6 centric/only NOC but to get started also
> provide a simple, isolated, and easily removed solution (hack ?) to
> connect to legacy IPv4 NOC in our case (in siit-dc some legacy IPv4
> (network)).

Yep, but be aware that with SIIT you will need to identify all
the IPv6 endpoints you want the IPv4-only NOC folks to be able to
access. These endpoints need either to be provisioned with an
IPv4-translatable IPv6 address (traditional SIIT), or get an IPv4
mapping provisioned on the protocol translator (SIIT-DC style
deployment with EAMs). You could also use Stateful NAT64 (RFC6146)
with statically configured BIB entries to accomplish pretty much the
same thing as the SIIT-DC approach, but you do get a lot of superfluous
baggage that way (all the stateful connection/session tracking stuff).

Anyway if the IPv6-only autonomic network is very dynamic in nature
and/or have a large number of managed endpoints that must be reachable
from the IPv4-only NOC, that requirement could possibly be problematic.

BTW you asked about traceroute, and I don't think anyone answered, so:
ICMPv6 packets originated by IPv6 hops behind the translator (that are
not provisioned with an IPv4-translatable IPv6 address) will appear as
originating from a "random" IPv4 address (which could repeat multiple
times in the path). That could possibly be confusing to NOC staff, so
I'd suggest giving the RFC6791 addresses descriptive PTR records in DNS
("this-apparent-ipv4-hop-really-represents-an-ipv6-router-in-the-autonomic-network-see-rfc6791.example.com").

> Actually i now think siit-eam is the easiest way - which i think is
> an extension of stateless NAT64, but i don't claim i am using all
> the terminology right.

Let me know if you want some help or pointers on how to set up a
stateless translator for testing purposes. Or you could use one of
mine, as it works just as well over the public internet too (as long as
the IPv6 endpoints you want to manage are numbered with globally
reachable addresses). I'd be happy to assist.

Tore