Re: [IPv6] External address discovery (Was: Adoption call for draft-bctb-6man-rfc6296-bis)

[[e-mail]]

Re-,

There is no need for explicit configuration for typical LAN topo. The rule is that the default router(s) will be assumed as the PCP server, unless servers are explicitly configured (RFC7291). Clients may also use the anycast address 2001:1::1/128 for discovery.

Cheers,
Med

> -----Message d'origine-----
> De : Ole Troan <[e-mail]>
> Envoyé : mardi 2 avril 2024 14:31
> À : BOUCADAIR Mohamed INNOV/NET <[e-mail]>
> Cc : Ted Lemon <[e-mail]>; Brian E Carpenter
> <[e-mail]>; 6man WG <[e-mail]>
> Objet : External address discovery (Was: [IPv6] Adoption call for
> draft-bctb-6man-rfc6296-bis)
> 
> Hi Med,
> 
> Thanks for that!
> PCP; does that require some sort of PCP server discovery?
> Or can one send a packet to e.g. the intended destination following
> the default route?
> 
> Best regards,
> Ole
> 
> 
> > On 2 Apr 2024, at 13:55, [e-mail] wrote:
> >
> > Hi Ole,
> >  Please see inline.
> >  Cheers,
> > Med
> >  De : Ole Trøan <[e-mail]> Envoyé : mardi 2 avril 2024
> > 12:29 À : BOUCADAIR Mohamed INNOV/NET <[e-mail]>
> > Cc : Ted Lemon <[e-mail]>; Brian E Carpenter
> > <[e-mail]>; 6man WG <[e-mail]> Objet : Re:
> [IPv6] Adoption call for draft-bctb-6man-rfc6296-bis
> >   An additional point is the “traversal “ point.
> > Ie how should the node on the inside discover its outside address.
> >  [Med] This can be done by sending a MAP request such as:
> >     Version: 2
> >    R bit: Request (0)
> >    opcode: MAP (0x01)
> >    Requested Lifetime: 36000 sec
> >    PCP client's IP Address: fd01:203:405:1::1234
> >    MAP Request:
> >     Mapping Nonce: 15685
> >     Protocol: 0
> >     Internal Port: 0
> >     Suggested External Port: 0
> >     Suggested External IP Address: ::
> >  And get a response like the following:
> >     Version: 2
> >    R bit: Response (1)
> >    opcode: MAP (0x01)
> >    Result Code: 0
> >    Lifetime: 36000 sec
> >    Epoch Time: 1250
> >    MAP Response:
> >     Mapping Nonce: 15685
> >     Protocol: 0
> >     Internal Port: 0
> >     Assigned External Port: 0
> >      Assigned External IP Address: 2001:db8:1:D550::1234
> >   Another approach to discover the external address is to use a
> short-lived request against “discard service” (udp/9):
> >  ==
> > Version: 2
> > R bit: Request (0)
> > Opcode: MAP (0x01)
> > Requested Lifetime: 5 sec
> > PCP Client's IP Address: fd01:203:405:1::1234 MAP Request:
> > Protocol: UDP (17)
> > Internal Port: 9
> > Suggested External Port: 9
> >  Suggested External IP Address: ::
> > ==
> >   And also should there be any signalling to the node to indicate
> that it sits behind an NPTv6 instance.
> >  [Med] That was the spirit of draft-boucadair-pcp-capability as an
> IPv6 host can sit behind an IPv6 firewall, NAT64 or NPTv6. But that’s
> not mandatory given that  the client can build two requests: one with
> “Suggested External IP Address: ::” (NPTv6/IPv6FW) and another one
> with “Suggested External IP Address: ::ffff:0.0.0.0” + PREFIX64
> (RFC7225) for NAT64. The client can infer the type of the controlled
> device based on the response it will get.
> >  Cheers
> > Ole
> >
> >
> > On 2 Apr 2024, at 10:28, [e-mail] wrote:
> >  Hi Ted, all,
> >  On the PCP point, I confirm that the spec supports NPTv6
> (protocol=0, internal port=0).
> >                   internal  external  PCP remote peer  actual remote
> peer
> >                  --------  -------   ---------------  --------------
> ----
> >    IPv4 firewall   IPv4      IPv4         IPv4              IPv4
> >    IPv6 firewall   IPv6      IPv6         IPv6              IPv6
> >            NAT44   IPv4      IPv4         IPv4              IPv4
> >            NAT46   IPv4      IPv6         IPv4              IPv6
> >            NAT64   IPv6      IPv4         IPv6              IPv4
> >            NPTv6   IPv6      IPv6         IPv6              IPv6
> >                 Figure 5: Address Families with MAP and PEER
> >  Note that some optimization were made in the past to help building
> PCP requests as a function of the PCP-controlled device: draft-
> boucadair-pcp-capability (CAPABILITY Option) and  draft-cheshire-pcp-
> unsupp-family (UNSUPP_FAMILY Error), but were not adopted by the WG at
> the time. See also slide#5
> ofhttps://https://eur03.safelinks.protection.outlook.com/?url=http%3A%
> 2F%2Fwww.ietf.org%2Fproceedings%2F83%2Fslides%2Fslides-83-pcp-
> 3.pdf&data=05%7C02%7Cmohamed.boucadair%40orange.com%7C4d62f7af67844de7
> b14708dc5310dfbb%7C90c7a20af34b40bfbc48b9253b6f5d20%7C0%7C0%7C63847658
> 0692628083%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzI
> iLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=h6LSXlEeYchiMAdIoiP
> APnxKtu55tf05bhvzbtiyMj0%3D&reserved=0.
> >  Cheers,
> > Med
> >  De : ipv6 <[e-mail]> De la part de Ted Lemon
> > Envoyé : jeudi 28 mars 2024 20:43
> > À : Brian E Carpenter <[e-mail]>
> > Cc : 6man WG <[e-mail]>
> > Objet : Re: [IPv6] Adoption call for draft-bctb-6man-rfc6296-bis
> >   Part of the problem here is that the camel's nose is sticking
> under the tend and we have to ask ourselves if we really want the
> camel in the tent. Clearly if NPTv6 is operational on a network, and
> we want devices on the network to be able to set up listeners, then we
> may need extensions to PCP to make that work. Or possibly PCP already
> does what we need—I'm not sure. But if we need to extend PCP, now
> NPTv6 is being further legitimized by yet another bit of standards
> work done to support it.
> >  This isn't a problem if this is a niche solution that doesn't
> impact most general use cases, but if we standardize it and it starts
> seeing wider deployment, now we're stuck having to do more protocol
> work to support it. IMO this is a bad outcome.
> >  One of the things that worries me about this is that there is
> always an economic tension between peer-to-peer and client-server.
> Toll collection is a lot easier for the client-server case than for
> the peer-to-peer case. And so there is a clear economic incentive to
> create solutions that make peer-to-peer impossible. You may have heard
> the term "over the top" used by ISPs. I always found this scandalous—
> this is the ISP saying "I want to collect a toll from the provider of
> a service on top of the money I'm charging for the service I'm
> actually providing, simply because I'm on-path and so I can." To me
> this is security issue, which the IETF should be working to prevent,
> not to facilitate.
> >  Of course this is completely orthogonal to the stated use case, and
> I am not suggesting that the proponents of the stated use case here at
> the IETF are secretly plotting to block over-the-top services. Really
> I am not. But that's one of the things that this standard will do, and
> if you are getting pressure to do this from people who can't state a
> clear use case, you might want to ask yourself what /their/ motivation
> is.
> >  On Thu, Mar 28, 2024 at 2:36 PM Brian E Carpenter
> <[e-mail]> wrote:
> > On 29-Mar-24 06:02, Nick Buraglio wrote:
> > >
> > >
> > > On Thu, Mar 28, 2024 at 9:45 AM Nick Buraglio
> <[e-mail]<mailto:[e-mail]>>
> wrote:
> >
> > <snip>
> >
> > >      >>>>
> > >      >>>> The benefit of NAT class mechanisms, is that cost and
> benefit are aligned. Only one side needs to deploy it.
> > >      >>>
> > >      >>>
> > >      >>> Actually, the benefit of NAT class mechanisms is that one
> party deploys them and another party incurs the costs. NAT is great
> for the network operator, because it moves a number of problems out of
> the network operator's domain. But it doesn't do that by solving the
> problem, it does so by making the application's job more difficult.
> > >      >>
> > >      >>
> > >      >> I don't think that is typically true.
> > >      >
> > >      >
> > >      > For client/server applications, where the client is on the
> inside of the NAT with a private address, and the server is on the
> outside with a public address, that wouldn't be typically true.
> > >      >
> > >      > However, for applications where the communications model is
> peer-to-peer, or a mix of client/server and peer-to-peer, the
> application developer has to implement RFC 8445 ICE using STUN and
> TURN for NAT traversal, incurring additional development, debugging
> and testing costs.
> > >
> > >     Is that still accurate for a device behind NPTv6? RFC3235
> section 3.1.5 points out that statically configured NAT bindings are
> largely exempt from the problems of port mapping, and NPTv6 is only a
> non-stateful translation that does not require the transport header to
> be re-written, simply translating the first 64 bits, so unless the
> communication embeds an address, which is problematic for all of the
> obvious reasons we see with things like legacy FTP, the peer-to-peer
> applications should work - assuming no security policy is in place to
> prevent it.  In fact, vendor documentation specifically calls out one
> of the advantages of NPTv6 as keeping peer-to-peer networking
> accessible:
> > >
> > >     /The NPTv6 support allows you to redirect or forward packets
> from one network to another in an IPV6 environment. The NPTv6 support
> on is an algorithmic translation function which provides a 1:1
> relationship between the addresses within the inside and outside
> network. When NTPv6 is used, you can interconnect different networks
> and support multihoming, load balancing, peer-to-peer networking. The
> NPTv6 does not create any state in the data plane and hence can
> operate using minimal memory and also supports high availability by
> default./
> > >
> > >     Of course, it's vendor documentation so take it with a grain
> of salt, but I would not expect that to remain in published
> documentation unless it actually had some validity.
> > >
> > >      >
> > >      > Alternatively the application developer adopts a
> client/server communications model for the application, even though a
> peer-to-peer model would be more scalable and more robust against a
> centralised server failure and server performance problems.
> > >      >
> > >      > This is why I say that NAT (of any type) imposes a default
> client (inside NAT) /server (outside NAT) communications model at the
> IPv4 or IPv6 network layers, rather than the default peer-to-peer
> model that can then accommodate both client/server and peer-to-peer
> applications communications models.
> > >      >
> > >      > NPTv6 may be stateless, however since hosts behind the
> NPTv6 will have to discover their public addresses via ICE if they
> want to be peers, NPTv6 still imposes those ICE costs on application
> developers and the applications' end-users.
> > >
> > >     Do they need to discover that? If the mapping is 1:1 it is
> functionally the same address unless there is an embedded address in
> the protocol communications, right? Or am I missing something obvious?
> > >
> > >
> > > I talked to some developer friends that helped me understand this
> a bit better, thanks for giving me the terms to build from to dig
> deeper. Specifically, the need for determining the actual address for
> a peer to peer application is required because there may be peers both
> inside and outside of the translation boundary and a given application
> needs to know what those are in order to avoid things like tromboning
> traffic or blackholing connectivity. This makes much more sense now
> that I have had someone walk me through it.
> > > My question back which I think is still a valid question and is
> couched in a dichotomy of ideal vs pragmatic debate is "does this
> extra work implementing the overhead of the ICE/STUN/TURN impose
> significant overhead compared to existing application development
> requirements to support how networks work on average today?"
> > > I am not knowledgeable enough to answer that question. At face
> value it *seems* that there will be a need to support these tools
> (ICE/STUN/TURN) already in order to support port address translation
> that is likely required for the foreseeable future for environments
> that are devoid of public addressing and are behind some kind of a
> port address translation device for v4. And, how does that map into a
> NPTv6 deployment using one of the specific use cases? Does the lack of
> state make that easier or harder or make no difference?
> > > Myself and others have pointed out very clear and very specific
> use cases where NPTv6 solves a real operational problem, and has been
> in operation for quite some time.
> > >
> > > As an aside, I don't think we should "what if" about ISPs
> deploying NPTv6 at their edges or all home users insisting on using it
> as they are functionally forced to do with NAPT, those use cases for
> NAPT are a forced function caused be a problem we don't currently have
> (address exhaustion) and any guessing about exploding use is all
> speculation. Operators are going to do what they are going to do, but
> what we could do is be very clear about the problems that this solves,
> and the places where it does not add value and is discouraged.
> >
> > Which is exactly why changing NPTv6 from experimental to
> informational status, with information added about which scenarios
> this assists and which scenarios it damages, based on experience, is
> the right thing to do.
> >
> >      Brian
> >
> > >
> > >
> > >      >
> > >      > Network engineers who deploy NATs aren't directly exposed
> to or pay any of these additional application development costs (other
> than when they're the application users), which is why it appears that
> NAT is a simple and low impact technology to deploy.
> > >
> > >     Given that nearly every application must be written to support
> dual-stack, and therefore must implement these techniques for port
> address translation, is that cost not already incurred by default? I
> understand that it may take some work to add IPv6 support to
> applications that require ICE/STUN/TURN, however, assuming (and that's
> a big assumption on my part), that the 1:1 stateless nature of NPTv6
> and a lack of an embedded address, what is the surface area of
> applications that need to incur that cost specifically for IPv6 where
> it does not currently exist?
> > >     Is it 90% of applications? Is is 10%? I don't actually know
> but would like to. Likelihood of occurrence is a key in making design
> decisions, at least in my world.
> > >
> > >     I fully admit that I am not an application developer, and
> there are undoubtedly aspects here that I do not understand, so pardon
> my potentially basic questions - I simply don't have the background
> but would like to fully understand. Knowing the likelihood and actual
> need at an application level where it does not already exist as part
> of a normal development workflow to support existing environments, and
> specifically where it is required where NPTv6 is a valid design model
> would be very, very useful, especially with the use cases for NPTv6
> being fairly specific.
> > >
> > >      >
> > >      > Regards,
> > >      > Mark.
> > >      >
> > >      >>
> > >      >> I will definitely say from experience that there is a
> significant operational cost to deploying any translation tool, and
> more so when there is active state tracking and overload involved.
> There are often (but not always) logging requirements to do these
> things at scale, and there are definitely operational costs in dealing
> with state table tracking and scaling. These don't exist at the same
> level for mechanisms that do not track state and that do not
> masquerade using port address translation. They may still incur
> application cost, or they may not, that is always going to be based on
> the application stack and is more likely in real time applications
> that don't use a third party intermediary, as you have stated.
> > >      >>
> > >      >> There are similarities in the translation toolkits, yes,
> they all perform translation at some level. However, what is generally
> referred to as "NAT" in the general term is typically PAT or NAPT or
> Masquerading, depending on the nomenclature. That said, *because* it
> is significantly easier to deploy NAPT, I do not believe that it is an
> apples to apples comparison. They're all tools in the "translation"
> category, but they're definitely not all created equally. NPTv6 does a
> 1:1 translation, the NAT that folks seem to be referencing in the IPv4
> world does not, and I do not believe it is a reasonable comparison.
> It's a far better comparison to say that NPTv6 is like a traditional
> one-to-one NAT (which does still have notable, albeit significantly
> fewer considerations, which I believe are noted in the draft).
> > >      >>
> > >      >>
> > >      >> nb
> > >      >>
> > >      >> ----------------------------------------------------------
> ----------
> > >      >>>
> > >      >>> IETF IPv6 working group mailing list
> > >      >>> [e-mail] <mailto:[e-mail]>
> > >      >>> Administrative Requests:
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.
> ietf.org%2Fmailman%2Flistinfo%2Fipv6&data=05%7C02%7Cmohamed.boucadair%
> 40orange.com%7C4d62f7af67844de7b14708dc5310dfbb%7C90c7a20af34b40bfbc48
> b9253b6f5d20%7C0%7C0%7C638476580692642374%7CUnknown%7CTWFpbGZsb3d8eyJW
> IjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%
> 7C%7C&sdata=OXHoSqggAvT9Cr8sq4PbYAXmk0yuydXuU9XWvmG8fUY%3D&reserved=0<
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.
> ietf.org%2Fmailman%2Flistinfo%2Fipv6&data=05%7C02%7Cmohamed.boucadair%
> 40orange.com%7C4d62f7af67844de7b14708dc5310dfbb%7C90c7a20af34b40bfbc48
> b9253b6f5d20%7C0%7C0%7C638476580692654312%7CUnknown%7CTWFpbGZsb3d8eyJW
> IjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%
> 7C%7C&sdata=wVrVT%2FwCrT0JegUypbCDTPKVsJzPvWecKGVfQGLFcII%3D&reserved=
> 0>
> > >      >>> ---------------------------------------------------------
> -----------
> > >      >>
> > >      >> ----------------------------------------------------------
> ----------
> > >      >> IETF IPv6 working group mailing list
> > >      >> [e-mail] <mailto:[e-mail]>
> > >      >> Administrative Requests:
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.
> ietf.org%2Fmailman%2Flistinfo%2Fipv6&data=05%7C02%7Cmohamed.boucadair%
> 40orange.com%7C4d62f7af67844de7b14708dc5310dfbb%7C90c7a20af34b40bfbc48
> b9253b6f5d20%7C0%7C0%7C638476580692664436%7CUnknown%7CTWFpbGZsb3d8eyJW
> IjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%
> 7C%7C&sdata=WlN6zC1VFdXYTAsdVbsuzUTkUGXaHOFqSYAeR2k50Ec%3D&reserved=0<
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.
> ietf.org%2Fmailman%2Flistinfo%2Fipv6&data=05%7C02%7Cmohamed.boucadair%
> 40orange.com%7C4d62f7af67844de7b14708dc5310dfbb%7C90c7a20af34b40bfbc48
> b9253b6f5d20%7C0%7C0%7C638476580692675683%7CUnknown%7CTWFpbGZsb3d8eyJW
> IjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%
> 7C%7C&sdata=fHqsEjQXalPL6rn6g1QrbuQKo2A2pHk1pJGXeBP0NOQ%3D&reserved=0>
> > >      >> ----------------------------------------------------------
> ----------
> > >
> > >
> > > ------------------------------------------------------------------
> --
> > > IETF IPv6 working group mailing list
> > > [e-mail]
> > > Administrative Requests:
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.
> ietf.org%2Fmailman%2Flistinfo%2Fipv6&data=05%7C02%7Cmohamed.boucadair%
> 40orange.com%7C4d62f7af67844de7b14708dc5310dfbb%7C90c7a20af34b40bfbc48
> b9253b6f5d20%7C0%7C0%7C638476580692690461%7CUnknown%7CTWFpbGZsb3d8eyJW
> IjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%
> 7C%7C&sdata=8G4q1eMKlNNDlu6sqkMB4Geam1nXpF82rzh%2BW0kKNKA%3D&reserved=
> 0
> > > ------------------------------------------------------------------
> --
> > --------------------------------------------------------------------
> > IETF IPv6 working group mailing list
> > [e-mail]
> > Administrative Requests:
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.
> ietf.org%2Fmailman%2Flistinfo%2Fipv6&data=05%7C02%7Cmohamed.boucadair%
> 40orange.com%7C4d62f7af67844de7b14708dc5310dfbb%7C90c7a20af34b40bfbc48
> b9253b6f5d20%7C0%7C0%7C638476580692700162%7CUnknown%7CTWFpbGZsb3d8eyJW
> IjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%
> 7C%7C&sdata=lo%2BQaRjzgJWpRalKvzxOtnniUvu4zZqrh7IBcwHmmhA%3D&reserved=
> 0
> > --------------------------------------------------------------------
> >
> ______________________________________________________________________
> ______________________________________
> > Ce message et ses pieces jointes peuvent contenir des informations
> confidentielles ou privilegiees et ne doivent donc
> > pas etre diffuses, exploites ou copies sans autorisation. Si vous
> avez recu ce message par erreur, veuillez le signaler
> > a l'expediteur et le detruire ainsi que les pieces jointes. Les
> messages electroniques etant susceptibles d'alteration,
> > Orange decline toute responsabilite si ce message a ete altere,
> deforme ou falsifie. Merci.
> >
> > This message and its attachments may contain confidential or
> privileged information that may be protected by law;
> > they should not be distributed, used or copied without
> authorisation.
> > If you have received this email in error, please notify the sender
> and delete this message and its attachments.
> > As emails may be altered, Orange is not liable for messages that
> have been modified, changed or falsified.
> > Thank you.
> > --------------------------------------------------------------------
> > IETF IPv6 working group mailing list
> > [e-mail]
> > Administrative Requests:
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.
> ietf.org%2Fmailman%2Flistinfo%2Fipv6&data=05%7C02%7Cmohamed.boucadair%
> 40orange.com%7C4d62f7af67844de7b14708dc5310dfbb%7C90c7a20af34b40bfbc48
> b9253b6f5d20%7C0%7C0%7C638476580692709737%7CUnknown%7CTWFpbGZsb3d8eyJW
> IjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%
> 7C%7C&sdata=FPmQ%2BKFaGhyhe63jitjHn%2B6GW1h3Re6ZF5nuWHtiD5M%3D&reserve
> d=0
> > --------------------------------------------------------------------
> >
> ______________________________________________________________________
> ______________________________________
> > Ce message et ses pieces jointes peuvent contenir des informations
> confidentielles ou privilegiees et ne doivent donc
> > pas etre diffuses, exploites ou copies sans autorisation. Si vous
> avez recu ce message par erreur, veuillez le signaler
> > a l'expediteur et le detruire ainsi que les pieces jointes. Les
> messages electroniques etant susceptibles d'alteration,
> > Orange decline toute responsabilite si ce message a ete altere,
> deforme ou falsifie. Merci.
> >
> > This message and its attachments may contain confidential or
> privileged information that may be protected by law;
> > they should not be distributed, used or copied without
> authorisation.
> > If you have received this email in error, please notify the sender
> and delete this message and its attachments.
> > As emails may be altered, Orange is not liable for messages that
> have been modified, changed or falsified.
> > Thank you.
> 

____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.