Re: [IPv6] Adoption call for draft-bctb-6man-rfc6296-bis

[Nick Buraglio <[e-mail]>]

On Wed, Mar 27, 2024 at 8:34 PM Mark Smith <[e-mail]> wrote:
>
>
>
> On Thu, 28 Mar 2024, 02:50 Nick Buraglio, <[e-mail]>
wrote:
>>
>>
>>
>> On Tue, Mar 26, 2024 at 8:31 PM Lorenzo Colitti <lorenzo=
[e-mail]> wrote:
>>>
>>> On Tue, Mar 26, 2024 at 6:33 PM Ole Troan <[e-mail]> wrote:
>>>>
>>>> The benefit of NAT class mechanisms, is that cost and benefit are
aligned. Only one side needs to deploy it.
>>>
>>>
>>> Actually, the benefit of NAT class mechanisms is that one party deploys
them and another party incurs the costs. NAT is great for the network
operator, because it moves a number of problems out of the network
operator's domain. But it doesn't do that by solving the problem, it does
so by making the application's job more difficult.
>>
>>
>> I don't think that is typically true.
>
>
> For client/server applications, where the client is on the inside of the
NAT with a private address, and the server is on the outside with a public
address, that wouldn't be typically true.
>
> However, for applications where the communications model is peer-to-peer,
or a mix of client/server and peer-to-peer, the application developer has
to implement RFC 8445 ICE using STUN and TURN for NAT traversal, incurring
additional development, debugging and testing costs.

Is that still accurate for a device behind NPTv6? RFC3235 section 3.1.5
points out that statically configured NAT bindings are largely exempt from
the problems of port mapping, and NPTv6 is only a non-stateful translation
that does not require the transport header to be re-written, simply
translating the first 64 bits, so unless the communication embeds an
address, which is problematic for all of the obvious reasons we see with
things like legacy FTP, the peer-to-peer applications should work -
assuming no security policy is in place to prevent it.  In fact, vendor
documentation specifically calls out one of the advantages of NPTv6 as
keeping peer-to-peer networking accessible:

*The NPTv6 support allows you to redirect or forward packets from one
network to another in an IPV6 environment. The NPTv6 support on is an
algorithmic translation function which provides a 1:1 relationship between
the addresses within the inside and outside network. When NTPv6 is used,
you can interconnect different networks and support multihoming, load
balancing, peer-to-peer networking. The NPTv6 does not create any state in
the data plane and hence can operate using minimal memory and also supports
high availability by default.*

Of course, it's vendor documentation so take it with a grain of salt, but I
would not expect that to remain in published documentation unless it
actually had some validity.

>
> Alternatively the application developer adopts a client/server
communications model for the application, even though a peer-to-peer model
would be more scalable and more robust against a centralised server failure
and server performance problems.
>
> This is why I say that NAT (of any type) imposes a default client (inside
NAT) /server (outside NAT) communications model at the IPv4 or IPv6 network
layers, rather than the default peer-to-peer model that can then
accommodate both client/server and peer-to-peer applications communications
models.
>
> NPTv6 may be stateless, however since hosts behind the NPTv6 will have to
discover their public addresses via ICE if they want to be peers, NPTv6
still imposes those ICE costs on application developers and the
applications' end-users.

Do they need to discover that? If the mapping is 1:1 it is functionally the
same address unless there is an embedded address in the protocol
communications, right? Or am I missing something obvious?

>
> Network engineers who deploy NATs aren't directly exposed to or pay any
of these additional application development costs (other than when they're
the application users), which is why it appears that NAT is a simple and
low impact technology to deploy.

Given that nearly every application must be written to support dual-stack,
and therefore must implement these techniques for port address translation,
is that cost not already incurred by default? I understand that it may take
some work to add IPv6 support to applications that require ICE/STUN/TURN,
however, assuming (and that's a big assumption on my part), that the 1:1
stateless nature of NPTv6 and a lack of an embedded address, what is the
surface area of applications that need to incur that cost specifically for
IPv6 where it does not currently exist?
Is it 90% of applications? Is is 10%? I don't actually know but would like
to. Likelihood of occurrence is a key in making design decisions, at
least in my world.

I fully admit that I am not an application developer, and there are
undoubtedly aspects here that I do not understand, so pardon my potentially
basic questions - I simply don't have the background but would like to
fully understand. Knowing the likelihood and actual need at an application
level where it does not already exist as part of a normal development
workflow to support existing environments, and specifically where it is
required where NPTv6 is a valid design model  would be very, very useful,
especially with the use cases for NPTv6 being fairly specific.

>
> Regards,
> Mark.
>
>>
>> I will definitely say from experience that there is a significant
operational cost to deploying any translation tool, and more so when there
is active state tracking and overload involved. There are often (but not
always) logging requirements to do these things at scale, and there are
definitely operational costs in dealing with state table tracking and
scaling. These don't exist at the same level for mechanisms that do not
track state and that do not masquerade using port address translation. They
may still incur application cost, or they may not, that is always going to
be based on the application stack and is more likely in real time
applications that don't use a third party intermediary, as you have stated.
>>
>> There are similarities in the translation toolkits, yes, they all
perform translation at some level. However, what is generally referred to
as "NAT" in the general term is typically PAT or NAPT or Masquerading,
depending on the nomenclature. That said, *because* it is significantly
easier to deploy NAPT, I do not believe that it is an apples to apples
comparison. They're all tools in the "translation" category, but they're
definitely not all created equally. NPTv6 does a 1:1 translation, the NAT
that folks seem to be referencing in the IPv4 world does not, and I do not
believe it is a reasonable comparison.  It's a far better comparison to say
that NPTv6 is like a traditional one-to-one NAT (which does still have
notable, albeit significantly fewer considerations, which I believe are
noted in the draft).
>>
>>
>> nb
>>
>> --------------------------------------------------------------------
>>>
>>> IETF IPv6 working group mailing list
>>> [e-mail]
>>> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
>>> --------------------------------------------------------------------
>>
>> --------------------------------------------------------------------
>> IETF IPv6 working group mailing list
>> [e-mail]
>> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
>> --------------------------------------------------------------------