Re: [BEHAVE] [v6ops] protocols without need for ALG ?

[Owen DeLong <[e-mail]>]

> On Jul 30, 2015, at 13:58 , Toerless Eckert <[e-mail]> wrote:
> 
> For autonomic networking (ANIMA WG), we are planning to rely only on IPv6 for initial
> autonomic connectivity, and the question of connecting this (at least initially)
> to IPv4 only NOC equipment came up. Alas, IPv6 support in transport seems to be still
> weak on a range of commonly used NOC tools.
> 
> If i understand the NAT RFCs and behave output correctly, we primaerily
> want ALGs to go the way of the dodo, so i was wondering if there might be
> any crucial protocols between typical NOC equipment and network devices that
> would require ALGs. And better of course:knowing which protocols would be fine
> without ALG.
> 
> Are there any lists about this (eg: what requires ALG ?)
> 
> Wrt to what seems to be important between NOC and network devices:
> 
>   FTP     - NOK (requires ALG) - IMHO not a problem

FTP should be long deprecated for the most part anyway, however, PASV
mode FTP (if you must use FTP) should be OK without need of an ALG.

>   traceroute - ??  (initiated from v4 NOC) ??
>   telnet  - OK 
>   ping    - OK ?

Should generally be OK. Requests must come from translated side of
the host pair. Responses can come from either side, but to be meaningful,
need to be responding from native side to translated side.

>   SSH/SCP - OK
>   syslog  - OK
>   TFTP    - OK ?

Should be OK, depending on which side is client. (client has to be the
private address/translated side of the connection).

>   radius  - OK ? (i ran some tests, seemed to be fine)
>   diameter/tacacs+ - OK ?

Should be OK, again, assuming favorable directionality.

If RADIUS/TACACS server is on translated side and router is on native side,
then this will not work without an ALG or some other hackery.

>   NTP     - OK ???

Same directionality considerations apply here.

>   For the following, that have extensible data-models (MIBs/OIDs, XML schema etc.),
>   i can see that some NOC tools relying on them might not support data-models
>   with IPv6, but that would be "fine" (aka: can't manage everything from such tools,
>   but transport stack works):
> 
>   netconf - OK ?
>   SNMP    - OK ?

Should be OK, assuming favorable directionality.

HTTP
HTTPs
SMTP
IMAP

sFlow/cFlow/etc.

Owen