Re: [BEHAVE] proprietary implementation v.s standardisedprotocols//re: draft-xu-behave-nat-state-sync-00

["Dan Wing" <[e-mail]>]

... 
> > * Cluster = A set of synchronized NAT64 boxes sharing a 
> > single Pref64::/n.
> 
> Does that mean a set of NAT64 boxes within a cluster should 
> be from a single
> vendor? If so, how to deal with the case that some abnormal 
> packets cause
> NAT boxes (using the same OS) within a cluster to crash 
> simultaneously due to a bug with that OS?

The vendor fixes the bug.

The operational complexity of running two NATs, from two different vendors, is
very high:  different CLIs, different alarming/alerting (e.g., SYSLOG, SNMP,
per-session NAT logging), different features (e.g., IPsec Passthru, SCTP),
different implementation of features (e.g., TCP MSS adjustment, fragmentation
[timeouts?  how much memory dedicated to reassembly?  out-of-order packets
supported?]), bandwidth and throughput (Mbps, pps),  make it too hard to
operate both NATs.

To my knowledge, sites do not run two different implementations of DNS servers
(e.g., ISC BIND and InfoBlox, or Microsoft and Unbound) where both DNSs back
up each other.  Like NAT, DNS needs to be rock-solid reliable, and a single
packet could take out a DNS server.

-d