Re: [Hipsec] Teredo compatibility

[Ari Keranen <[e-mail]>]

Hi Miika,

I think trying to predict the success of NAT traversal is not a good 
idea if you can't get close to 100% accuracy. You should rather test 
what works and act accordingly; and that's exactly what ICE does.

And if you do ICE and include the Teredo address as the highest 
prioritized ICE candidate, you'll end up doing connectivity checks only 
for that candidate before selecting it for use, so there's hardly any 
overkill. And if the Teredo candidate fails you'll end up using 
something else that works.


Cheers,
Ari

Miika Komu wrote:
> Gonzalo Camarillo wrote:
> 
> Hi,
> 
> running ICE over Teredo works but is potentially a big overkill due to 
> redundant functionality. Some of the results can be predicted as 
> depicted below (and even incorporated in the ICE module if needed).
> 
>> Hi,
>>
>> as Andrew indicates, the whole point of ICE is that it sends probes to 
>> see what works and what does not. We should not go off and specify 
>> stuff that will be discovered anyway at run time.
>>
>> Cheers,
>>
>> Gonzalo
>>
>> Andrew McGregor wrote:
>>> Ok, but in any case, candidate address probing deals with those issues.
>>>
>>> Andrew
>>>
>>> On 12/12/2009, at 1:02 AM, Miika Komu wrote:
>>>
>>>> Andrew McGregor wrote:
>>>>
>>>> Hi,
>>>>
>>>> it should be short section then, right?)
>>>>
>>>> I basically agree with you. Based on our experimentation, it works 
>>>> but there are some caveats regarding to pairing of addressing. So, 
>>>> sending of packets from src->dst:
>>>>
>>>> Teredo->Teredo: works
>>>> Teredo->IPv6: does not work without a (commercial) relay service
>>>> IPv6->Teredo: works
>>>> IPv6->IPv6: (works :)
>>>>
>>>> Samu, please comment if I got the two middle ones in wrong order.
>>>>
>>>> Also, at least the miredo implementation on linux is good, but not 
>>>> perfect. Some performance-related issues and sometimes HIP packets 
>>>> just don't go through (usually restarting of miredo works).
>>>>
>>>>> Why?  It just works, if Teredo is available it's just another IPv6 
>>>>> address.
>>>>> Andrew
>>>>> On 12/12/2009, at 12:49 AM, Miika Komu wrote:
>>>>>> Hi,
>>>>>>
>>>>>> we've done some concrete work on NAT traversal with ICE, but what 
>>>>>> about Teredo? I think RFC5201 and RFC5206 should have some 
>>>>>> statements about Teredo-based addresses?