Re: [BEHAVE] NAPGT request for comments, THANKS!

Hi,

I'm not sure what exactly you man by "might be used as NAT".

0-1024 might be used for NAPT in a FCFS basis where port preservation (this is what we are talking about here, right?) is needed.

As a concrete example, many IPsec Servers still expect to see the source port within 0-1024 and preferably a specific source port. If that source port is used by the NAT, and more than one IPsec client is behind it, there are a some choices available.

- Some funky IPSec ALG (implemented in many products)
- Give a port above 1024 and hope for the best
- Deny the connection
- others..

Other ports for the same public IP can be used by any other internal IP address. This is very common in implementations.

thanks,

________________________________
From: behave-bounces@ietf.org [behave-bounces@ietf.org] on behalf of meng.wei2@zte.com.cn [meng.wei2@zte.com.cn]
Sent: Tuesday, July 16, 2013 8:22 PM
To: Reinaldo Penno (repenno)
Cc: behave-bounces@ietf.org; behave@ietf.org; Dan Wing (dwing)
Subject: Re: [BEHAVE] NAPGT request for comments, THANKS!

Hi Reinaldo,
  So I suppose <1-1024> might be used as NAT, <1025-65535> might be used as
dynamic NAPT.
  That is what this view says in the draft.

Cheers,
Wei

behave-bounces@ietf.org 2013-07-17 09:52:34:

> I'm not sure this is a good idea. There are still some protocols
> around that use ports < 1024 and maintaining the source port after
> translation in this range is important.
>
> From: behave-bounces@ietf.org [behave-bounces@ietf.org] on behalf of
> Dan Wing (dwing)
> Sent: Tuesday, July 16, 2013 3:30 PM
> To: meng.wei2@zte.com.cn
> Cc: behave@ietf.org
> Subject: Re: [BEHAVE] NAPGT request for comments, THANKS!

>
> On Jul 15, 2013, at 2:43 AM, meng.wei2@zte.com.cn wrote:
>
>     I have submitted a new draft. The objective is to solve a problem that
>     prevents an external client from accessing an internal server.
>
>     https://datatracker.ietf.org/doc/draft-meng-behave-napgt/
>
>     I expect your comments. Thanks a lot!
>
> Draft-meng-behave-napgt appears to describe something that is very
> similar to the long-standing "DMZ host" configuration available on
> almost all residential-class NAT devices.  I don't think we could
> standardize that behavior, but perhaps that is possible.
>
> Draft-meng-behave-napgt also describes an update to the port
> assignment behavior described in http://tools.ietf.
> org/html/rfc5382#section-7.1 (TCP) and http://tools.ietf.
> org/html/rfc4787#section-4.2.1 (UDP).  If I understand Section 4 of
> draft-meng-behave-napgt properly, it is saying that NATs should not
> assign ports below 1024 to dynamic connections.  This might be
> something worth considering for draft-ietf-behave-requirements-update?
>
> -d
> _______________________________________________
> Behave mailing list
> Behave@ietf.org
> https://www.ietf.org/mailman/listinfo/behave