Re: NAT and IPSEC INCOMPATIBLE???
"Hilarie Orman" <HORMAN@novell.com> Fri, 11 June 1999 00:37 UTC
Received: from lists.tislabs.com (portal.gw.tislabs.com [192.94.214.101]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id RAA15020; Thu, 10 Jun 1999 17:37:52 -0700 (PDT)
Received: by lists.tislabs.com (8.9.1/8.9.1) id TAA01428 Thu, 10 Jun 1999 19:03:09 -0400 (EDT)
Message-Id: <s75ff1d4.097@prv-mail20.provo.novell.com>
X-Mailer: Novell GroupWise 5.5
Date: Thu, 10 Jun 1999 17:11:31 -0600
From: Hilarie Orman <HORMAN@novell.com>
To: warlord@MIT.EDU, Krzysztof_Pakulski-LKP014@email.mot.com
Cc: johnbr@elastic.com, danmcd@Eng.Sun.Com, Pat.Calhoun@Eng.Sun.Com, ipsec@lists.tislabs.com, suresh@livingston.com
Subject: Re: NAT and IPSEC INCOMPATIBLE???
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by lists.tislabs.com id TAA01425
Sender: owner-ipsec@lists.tislabs.com
Precedence: bulk
Sounds like there are only two possibilities. Either all ports are unique on the incoming side P1 <-> P on host Y P2 <-> P on host Z or hosts fall into equivalence classes: P on hosts {Z, Y, W} is always the same service Hilarie >>> Derek Atkins <warlord@MIT.EDU> 06/10/99 04:20PM >>> Let me repeat my question: If a packet comes in on port X on the NAT gateway, how do you know whether the packet really goes to port X on host Y or port X on host Z? Remember, this is a protocol with a known port (port X)... It ALWAYS sits on port X. So, how do you address "port X on host Y" when "host Y" is behind a NAT gateway? -derek Pakulski Krzysztof-LKP014 <Krzysztof_Pakulski-LKP014@email.mot.com> writes: > > I believe that one of the possibilities to make static binding. > > If something comes to port X on NAT gateway, it is forwarded to port Y on > host Z, if policy allowes that. > > Krzysztof > > ---------- > > From: Derek Atkins[SMTP:warlord@MIT.EDU] > > Sent: Thursday, June 10, 1999 3:45 PM > > To: pcalhoun@eng.sun.com > > Cc: Pyda Srisuresh; danmcd@Eng.Sun.Com; johnbr@elastic.com; > > ipsec@lists.tislabs.com > > Subject: Re: NAT and IPSEC INCOMPATIBLE??? > > > > How can you do port address translation on known incoming ports? For > > example, what do I do if I need to get to port X on your host, which > > is sitting behind a NAT firewall? Obviously I don't know you're > > sitting behind a NAT gateway; how is the NAT gateway supposed to know > > that a packet coming to port X is destined for host Y or host Z, both > > of whom may be using these NAT-unfriendly protocols? > > > > And no, an answer of "don't use NAT-unfriendly protocols" is not a > > valid answer, as many of these protocols were developed years (or > > decades) before NAT. > > > > -derek > > > > "pcalhoun@eng.sun.com" <Pat.Calhoun@Eng.Sun.Com> writes: > > > > > > > > agreed, but my comment was directed to the use of NAT in hotels. It was > > not > > > inteded to be IPSec specific. I had *assumed* that they were doing port > > > translation (to conserve addresses). > > > > > > > > > PatC > > > > > > > > Pat, > > > > > > > > The accessability provided by NAPT (Network Address Port Translator) > > > > is not any less than the accessibility provided by a host with a > > > > single address. > > > > > > > > Further, Bidirectional-NAT does not preclude inbound connections. > > > > It simply does address multiplexing - optimal use of limited > > > > addresses available. > > > > > > > > I suggest you take a look at <draft-ietf-nat-terminology-03.txt> > > > > prior to spreading misinformation. > > > > > > > > cheers, > > > > suresh > > > > > > > > > > > > > > And just to make matters worse, I could not have anyone connect > > directly to me > > > > > thanks to NAT (i.e. ftp, SIP, etc). > > > > > > > > > > PatC > > > > > > > > > > > > > By the way, there are certain markets where NAT is a > > requirement (such as > > > > > > > > running IP to the guest rooms in hotels) > > > > > > > > > > > > Until the hotels get more customers like Pat, who say that... > > > > > > > > > > > > > hmm... so I HAVE to trust my hotel? What kind of customers are > > they looking > > > > > > > for? If they are looking for the commuter, then NAT is a bad > > thing since I > > > > > > > will want to encrypt my data back to my corporate network. > > > > > > > > > > > > And by then they'll be looking for another alternative. > > > > > > > > > > > > > > and IPSec is also extremely high profile. It would help > > everyone out if > > > > > > > > there was a built-in method to scale arbitarily > > > > > > > > large for address translated IPSec connections - just with > > ESP, I don't > > > > > > > > think that AH is as important to these users. > > > > > > > > > > > > And that alternative is IPv6. ESP works just fine over that. > > > > > > > > > > > > Dan > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > Member, MIT Student Information Processing Board (SIPB) > > URL: http://web.mit.edu/warlord/ PP-ASEL N1NWH > > warlord@MIT.EDU PGP key available > > -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL N1NWH warlord@MIT.EDU PGP key available
- NAT and IPSEC INCOMPATIBLE??? John Hawkins
- Re: NAT and IPSEC INCOMPATIBLE??? Bill Sommerfeld
- Re: NAT and IPSEC INCOMPATIBLE??? Makoto Kubota
- Re: NAT and IPSEC INCOMPATIBLE??? Umesh Muniyappa
- Re: NAT and IPSEC INCOMPATIBLE??? Pyda Srisuresh
- Re: NAT and IPSEC INCOMPATIBLE??? Pyda Srisuresh
- Re: NAT and IPSEC INCOMPATIBLE??? Tim Lyons
- RE: NAT and IPSEC INCOMPATIBLE??? Brothers, John
- RE: NAT and IPSEC INCOMPATIBLE??? pcalhoun@eng.sun.com
- RE: NAT and IPSEC INCOMPATIBLE??? Stephane Beaulieu
- RE: NAT and IPSEC INCOMPATIBLE??? Gabriel Montenegro
- Re: NAT and IPSEC INCOMPATIBLE??? pcalhoun@eng.sun.com
- Re: NAT and IPSEC INCOMPATIBLE??? Dan McDonald
- Re: NAT and IPSEC INCOMPATIBLE??? tcosenza
- Re: NAT and IPSEC INCOMPATIBLE??? Pyda Srisuresh
- Re: NAT and IPSEC INCOMPATIBLE??? pcalhoun@eng.sun.com
- Re: NAT and IPSEC INCOMPATIBLE??? Derek Atkins
- RE: NAT and IPSEC INCOMPATIBLE??? pcalhoun@eng.sun.com
- Re: NAT and IPSEC INCOMPATIBLE??? Derek Atkins
- Re: NAT and IPSEC INCOMPATIBLE??? pcalhoun@eng.sun.com
- Re: NAT and IPSEC INCOMPATIBLE??? Pyda Srisuresh
- Re: NAT and IPSEC INCOMPATIBLE??? Hilarie Orman
- Re: NAT and IPSEC INCOMPATIBLE??? Derek Atkins
- Re: NAT and IPSEC INCOMPATIBLE??? Pyda Srisuresh
- RE: NAT and IPSEC INCOMPATIBLE??? Brothers, John
- RE: NAT and IPSEC INCOMPATIBLE??? Pakulski Krzysztof-LKP014
- RE: NAT and IPSEC INCOMPATIBLE??? CTrobridge
- Re: NAT and IPSEC INCOMPATIBLE??? Michael C. Richardson