Re: [IPv6] Adoption call for draft-bctb-6man-rfc6296-bis

[Ole Troan <[e-mail]>]

Brian,

>>> I don't support adoption.
>>> 
>>> When NAT was first introduced, I experienced a lot of trouble. There may be fewer problems these days, but I think the reason is that applications are built with NAT in mind. In other words, I think it limits the ability to create applications.
>>> 
>>> I think it is undesirable that something works in an environment without NAT but does not work in an environment with NAT. If this happens, should I fix the application or the network?
>>> 
>>> I think it would be desirable to regain an environment where applications can be created without restrictions, and I think that would make the Internet better.
>>> 
>>> Even though IPv6 can eliminate this restriction, I do not agree with restricting applications with NPTv6.
>> Could you say a little more about _how_ NPTv6 restricts applications?
> 
> That's a slightly strange question since the draft already has a "Implications for Applications" section. Possibly it needs modernisation.

Perhaps I should have phrased it better. I meant what concerns he has outside of what’s already in the application section of the document.

> But I think Naoki is missing the trade-off here, and the comparison with our bad experience with NAPT44
> and even with NAT444 is too simple.
> 
> There are a few scenarios where NPTv6 makes things better for a user, because otherwise they will lose connectivity. Outside those scenarios, NPTv6 is a bad thing and should not be enabled.
> 
> It's quite different from NAPT44. I could not use any IPv4-only resource without NAPT44. I can use every IPv6 resource without NPTv6. That's the situation for the majority of users.

I think we are somewhat glossing over the complexities of what a native IPv6 application would have to deal with if it was acting as server.
And I don’t know if we have written this down or we have good patterns in implementations to follow.

An IPv6 host has multiple addresses with different reachability properties and lifetimes. And they may or may not be ephemeral. No way for the host to know.
It has to pick one, and avoid picking one that leaks any of the temporary addresses, and somehow get that registered in DNS.
Or exchange the right set of addresses through something like ICE.
Deal with the consequences when these addresses change.

And if stuck behind a stateful firewall, an IPv6 application would have to do some sort of firewall traversal.
And if the destination is behind a NAT64, it would have to do the full set of IPv4 NAPT traversal techniques (and most of these are now going to be endpoint dependent NATs).

All this, without even involving NPTv6.
In my NPTv6 setup, I have a single IPv6 address. With infinite lifetime.
From an application implementation perspective I am not convinced that this is not a lot easier to implement than the above with ephemeral global addressing.

Cheers,
Ole