Re: [v4v6interim] [46translation] [BEHAVE] Proposal for new BEHAVE charter

On 20 okt 2008, at 23:41, Fred Baker wrote:

> On Oct 20, 2008, at 7:21 PM, Iljitsch van Beijnum wrote:

>> Of course the IETF could also come out and say that it will not  
>> accommodate any type of IPv6 NAT.

> That will travel about one meter and nose-dive. Remember the IETF  
> being deluded into thinking that if it didn't work on lawful  
> intercept the problem would go away?

Didn't it? This is now "solved" outside the IETF AFAIK.

> Good solutions help, like what RFC 4864 tries to be. Delusional  
> thinking and rants about what we don't like don't help.

Please read carefully. What I said that the IETF could decide that it  
wouldn't _accommodate_ any type of IPv6 NAT. In the past, the IETF has  
come up with numerous protocols that can't work through NAT. These  
days, working through NAT is always a consideration for end-to-end  
protocols that run on top of IPv4. This is often a hard problem, and  
there are many backward compatibility issues with older protocols.

Although we won't be able to make a completely clean break with IPv6,  
we do have the ability to do better than we've done in the past with  
IPv4. I basically see three options for IPv6:

1. We come to the conclusion that port overloading NAT is now part of  
the IP architecture so if at all possible, all protocols must work  
that type of NAT.

2. Since there are alternative mechanisms to reach the same goals in  
IPv6 that people use NAT for in IPv4, the IETF will not address NAT in  
protocols that run on top of IPv6. If end-users implement NAT66  
anyway, they are solely responsible for implementing the workarounds  
necessary to make this work.

3. Because we expect NAT66 to happen anyway, but because the port  
overloading is the most harmful part that we can possibly avoid, we  
specify a stateless, transport-agnostic 1-to-1 NAT66 and make sure  
protocols that run on top of IPv6 can work through that. In case  
people decide to run a port overloading NAT66, see 2.

Also note that the ship has already sailed on unrestricted end-to-end  
connectivity in IPv6, not only in practice but also by IETF mandate  
when the recommendation to use a stateful firewall between IPv6 nodes  
and the internet reached rough consensus. So some level of middlebox  
awareness is already a requirement for IPv6. (And the NAT64 efforts  
add to this to some degree.) The only question is if we want to extend  
this or not.

In my opinion, it would be good if the IETF or IAB (I'll CC them just  
in case they're looking for work) could come to some kind of  
conclusion regarding the above so that we can formulate  
recommendations for transport and application protocol developers.
_______________________________________________
v4v6interim mailing list
v4v6interim@ietf.org
https://www.ietf.org/mailman/listinfo/v4v6interim