Re: [BEHAVE] [v6ops] protocols without need for ALG ?

[Joe Touch <[e-mail]>]

On 7/30/2015 2:07 PM, Owen DeLong wrote:
> 
>> On Jul 30, 2015, at 13:58 , Toerless Eckert <[e-mail]> wrote:
>>
>> For autonomic networking (ANIMA WG), we are planning to rely only on IPv6 for initial
>> autonomic connectivity, and the question of connecting this (at least initially)
>> to IPv4 only NOC equipment came up. Alas, IPv6 support in transport seems to be still
>> weak on a range of commonly used NOC tools.
>>
>> If i understand the NAT RFCs and behave output correctly, we primaerily
>> want ALGs to go the way of the dodo, 

NATs too, if we're taking requests...

...
>> Wrt to what seems to be important between NOC and network devices:
>>
>>   FTP     - NOK (requires ALG) - IMHO not a problem
> 
> FTP should be long deprecated for the most part anyway, however, PASV
> mode FTP (if you must use FTP) should be OK without need of an ALG.

FTP has security problems but anonymous mode access to files is still
used. As noted, PASV avoids the need for ALG in-band address translation.

All the listed protocols should be OK if the client is behind the NAT
(as noted) *or* if the NAT is configured to forward those services to a
particular private-side host.

Other ALG protocols not on your list:

	web:
		HTTP	(mostly to hijack initial login screens,
			somtimes to insert tracking or ads)

	teleconferencing/media:
		Apple iChat
		H.323
		MGCP (media gateway)
		RTSP (realtime streaming)
		SCCP (Cisco call signalling)
		SIP

	remote functions:
		RPC (Sun, Microsoft)
		SQL

	tunneling:
		PPTP

---