Re: [v4tov6transition] [Softwires] ISP support of Native IPv6 across NAT44 CPEs -Proposed 6a44 Specification

[Rémi Després <[e-mail]>]

Le 7 oct. 2010 à 21:28, Ole Troan a écrit :
> ...
> issues I have with host tunneling:
> - how to communicate with native IPv6 nodes on the same network?

The 6a44-S decapsulates IPv6 packets coming from a 6a44 host and, if not destined to another 6a44 host of its network, forwards them in IPv6, in this case on the same network.

   
> - how to communicate to another 6a44 host on a different link in the same home?

6a44 is only for hosts on a LAN behind a NAT44 attached to a 6a44-capable ISP network.
If the LAN has several bridged links, it does apply.
Links that are behind extra NATs in the site are out of scope.

As I said to Olivier Vautrin in a previous mail on this thread, these extra NATs should be configured so that hosts behind them never receive 6a44 IPv6-Address-Indication messages. (e;g. with the 6a44 well-known port bound to an unassigned internal address.
This point isn't in the draft yet but, if co-authors agree, should be in the next version.


> - do you need non-congruent topology multi-homing policy?
>   http://tools.ietf.org/html/draft-troan-multihoming-without-nat66-01
>   how do you distribute that policy when you don't have a on-link router?

Not sure to understand the question.
The answer should be NO: 6a44 only needs classical topologies.


> - a general unease that now every host is supposed to have a "VPN" connection?
>   how do I configure my own firewall and other network border policy?

If the NAT binds the 6a44 well-known port to an unassigned internal address, no host will be able to receive a 6a44 IPv6 address. 
Besides, a firewall could filter all packets having this port, source or destination.

> how much would a new CPE cost the customer? 80USD? that's only 5 pints of beer (if bought in Norway.)
> I really liked the dongle idea by the way. perhaps with a L2TP LAC.

The dongle idea of 6rd-UDP, if without a stateful NAT66 in the dongle, needs an assigned /16 to the function. (The /64 subnet prefix has to contain the site IPv4 address plus the port of the tunnel).
This is in general not realistic.

Now, if there is a NAT66 in the dongle, it can work with a 6a44 external address.


I hope it helps to understand that 6a44 isn't just one more design for the pleasure to make one, but a pragmatic solution to a real problem, specified after an in depth study. 

Cheers,
RD

> 
> cheers,
> Ole