RE: NAT64 in RA, draft-ietf-6man-ra-pref64

["Mudric, Dusan (Dusan)" <[e-mail]>]

Thanks Jen. 

In your example " IPv4-only client needs to talk to the Ipv6-only server". If IPv4-only client needs to talk to the Ipv6-only client, the call flow will be the same? In the other direction, IPv6-only client calling IPv4-only client needs to use DNS64/NAT64, as in your previous example (attached). This means, for bi-directional communication NAT46/DNS46 and NAT64/DNS64 need to be used (may be my terminology is not quite correct). 

However, Jordi said that the problem is not fully solved yet ("the *actual* implementation of 464XLAT/NAT64 doesn't allow IPv4-only hosts to connect to IPv6-only hosts.") and he is writing draft-palet-v6ops-464xlat-opt-cdn-caches. What is in the current technology that prevents bi-directional call flow between IPv4-ony and IPv6-only hosts?

Dusan

> -----Original Message-----
> From: Jen Linkova <[e-mail]>
> Sent: Monday, July 8, 2019 9:34 PM
> To: Mudric, Dusan (Dusan) <[e-mail]>
> Cc: Manfredi (US), Albert E <[e-mail]>; IPv6
> Operations <[e-mail]>; 6man <[e-mail]>
> Subject: Re: NAT64 in RA, draft-ietf-6man-ra-pref64
> 
> On Tue, Jul 9, 2019 at 1:50 AM Mudric, Dusan (Dusan) <[e-mail]>
> wrote:
> > [Dusan] What if IPv4only client needs to initiate the session to IPv6only
> client? What is the solution for that use case?
> 
> https://urldefense.proofpoint.com/v2/url?u=https-
> 3A__tools.ietf.org_html_rfc7755&d=DwIBaQ&c=BFpWQw8bsuKpl1SgiZH64Q
> &r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=_cWRsdzof5dXI
> 9yTQH51H_KHtcSRcMAtARArKVcdnWM&s=wDxWEwS-e-N-I0oAfcdi-
> 5GucNiCQpR32t9Rw4RZyn0&e= mentioned before.
> 
> IPv4-only client -- IPv4-enabled network--- SIIT translator ---- IPv6-only LAN -
> -- IPv6-only server.
> 
> Let's say  your IPv4-only client needs to talk to the Ipv6-only server, ipv6-
> only.example.net.
> For this to happen the owner of the Ipv6-only server needs to configure the
> translator (SIIT box in the diagram above).
> The owner would create a DNS A RR for  ipv6-only.example.net. - let's say,
> 192.0.2.2 Ipv6-only server would have an IPv6 address which has that IPv4
> address encoded - for example, 2001:db8:1::192.0.2.2 That IPv4 address (or
> the prefix most likely) will be routed to the translator.
> 
> So your Ipv4-only client sends a DNS request to resolve ipv6-
> only.example.net, gets 192.0.2.2 back, sends a packet to 192.0.2.2.
> The packet reaches the translator. The translator translates IPv4 packet to
> IPv6 packet and sends it to the server (note that the destination IPv6 address
> can be easily constructed as the translator knows the prefix and just adds the
> IPv4 address - 192.0.2.2 - to that prefix to get the destination IPv6 address.
> IPv6 source address is synthesised in the same way from the client IPv4
> address).
> 
> Here is a nice talk Tore Anderson gave at RIPE 7 years ago:
> https://urldefense.proofpoint.com/v2/url?u=https-
> 3A__ripe64.ripe.net_presentations_67-2D20120417-2DRIPE64-2DThe-
> 5FCase-5Ffor-5FIPv6-5FOnly-5FData-
> 5FCentres.pdf&d=DwIBaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJ
> xhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=_cWRsdzof5dXI9yTQH51H_KHtcS
> RcMAtARArKVcdnWM&s=GsPTdPr_ZwWYK13LIrhTv9rYM6dYJfgbT8HtLwVRk
> Zo&e=
> 
> 
> 
> > > For IPv4 to IPv6, if you must allow the IPv4 client to initiate the
> > > session, you'd have to have preconfigure something.
> > [Dusan] Where and how is this configuration done?
> 
> On the translator which connects IPv6-only network to dual-stack/IPv4-only
> one.
> In general, when you need to let one protocol talk to another, you'd have a
> point (or the edge) where those two networks meet each other.
> Usually you'd have a box (or boxes) interconnecting them - quite often it's
> exactly the box you'd need to configure ;)
> 
> --
> SY, Jen Linkova aka Furry

--- Begin Message ---

Hi Dusan,

On Fri, Jul 5, 2019 at 6:19 AM Mudric, Dusan (Dusan) <[e-mail]> wrote:
> What is the best reference document for a Translator that facilitates:
>
> - IPv4only - to - IPv6only, and

https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_rfc7755&d=DwIBaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=rXn-qcfSIhjB1FVZq9fT0HWKIE4FsVW55Pw4ufcd4Qc&s=6jgy81ePeiWaBFML3XwPC3wDxGkyDrvzWG0Jg9Oog_w&e=

> - IPv6only - to - IPv4Only

https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_rfc6146&d=DwIBaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=rXn-qcfSIhjB1FVZq9fT0HWKIE4FsVW55Pw4ufcd4Qc&s=SobSFuvzPm9XQ3bWhSELbnhk4KtAaYJ7yB5QWf70A6A&e=

> clients message exchanges?
>
> Is this communication bidirectional or works only from IPv6only-to-IPv4only client (meaning IPv6only client has to initiate the communication)?
>
> How can Translator or DNS64 tell IPv6 only client the IP of IPv4 only client, and vice versa?

In a nutshell:

IPv6-only client asks DNS64 server for AAAA for, let's say, ipv4only.example.net
As that server is IPv4-onl, does not have AAAA RR, the DNS64 server
synthesise a new AAAA using an IPv6 prefix (usually /96 - the
Well-Known Prefix is 64:ff9b::/96) and IPv4 address from the A
RR. The algorithm described in rfc6147

So if ipv4only.example.net has an IPv4 address 192.0.2.2, then DNS64
will return 64:ff9b::192.0.2.2 as AAAA RR.
The ipv6-only client would initiate a connection to that address . As
NAT64 prefix is supposed to be routed to the NAT64 device, that device
would translate IPv6 packet to IPv4 packet using the algorithm
described in https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_rfc6052&d=DwIBaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=rXn-qcfSIhjB1FVZq9fT0HWKIE4FsVW55Pw4ufcd4Qc&s=XTCYMjY3HOKEx535PU_IOra8JAiRD_Uayt1SwrJnWv8&e=.


> > -----Original Message-----
> > From: Fred Baker <[e-mail]>
> > Sent: Wednesday, July 3, 2019 3:32 PM
> > To: Mudric, Dusan (Dusan) <[e-mail]>
> > Cc: 6man <[e-mail]>; IPv6 Operations <[e-mail]>
> > Subject: Re: NAT64 in RA, draft-ietf-6man-ra-pref64
> >
> >
> >
> > > On Jul 3, 2019, at 12:01 PM, Mudric, Dusan (Dusan) <[e-mail]>
> > wrote:
> > >
> > > [Dusan] Please clarify how IPv4-only host can reach IPv6 only host, and vice
> > versa. Also, how IPv6 only host can know IPv4 address of IPv4 only host,
> > assuming IPv4 only host is in a public domain?
> >
> > Simple. Using a Translator, either at layer 3 or above it. Any other way
> > doesn't work.
> > --------------------------------------------------------------------------------
> > The fact that there is a highway to hell and a stairway to heaven is an
> > interesting comment on projected traffic volume...
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_ipv6&d=DwIBaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=rXn-qcfSIhjB1FVZq9fT0HWKIE4FsVW55Pw4ufcd4Qc&s=GHcNdEhtOVJ_cLvOIIb6oNNDJIgpb8m_oqHiePqYicg&e=
> --------------------------------------------------------------------



--
SY, Jen Linkova aka Furry

--- End Message ---