Re: [BEHAVE] Comments on TCP RST handling in draft-ietf-behave-v6v4-xlate-stateful-02.txt

[Iljitsch van Beijnum <[e-mail]>]

On 26 okt 2009, at 11:29, Reinaldo Penno wrote:

> I feel that NAT64 should look and feel in terms of behavior  
> (forwarding,
> control & security) as closely as NAT44 as possible in order to be  
> deployed
> successfully.

No. A traditional NAT44 sits on an internal/external boundary, a place  
where you would naturally want to apply security policy. However, this  
is not the case for a NAT64, which sits more towards the middle of the  
network. (Same for an ISP-operated NAT44.) It makes no sense to import  
NAT44 baggage into NAT64. Also, BEHAVE has been writing up what NAT44s  
actually do, while for NAT64 we're specifying what we WANT them to do,  
which is a rather different approach.

> Are you suggesting  all those security considerations should be  
> removed from
> NAT64 to another document and/or deprecated in NAT44 documents?

Yes, I believe some of the text quoted earlier would best be removed.  
Obviously that doesn't mean a NAT64 document shouldn't have any  
security considerations, just that firewalling should be kept out of  
the NAT64 document.