Re: [v4v6interim] [46translation] [BEHAVE] Proposal for new BEHAVE charter

[" Rémi Denis-Courmont" <[e-mail]>]

On Friday 24 October 2008 09:10:24 ext Iljitsch van Beijnum, you wrote:
> For every new session, the NAT66 box creates a new 1-to-1 maping. So
> for every new session it must choose a new address from a pool map
> that address to the internal source address of the host in question.
> As long as the external addresses checksum to the same value as the
> internal address, the transports that use the normal checksum over the
> pseudo header are happy and don't have to be modified by the
> translator. In IPv6 sessions can of course be identified by the flow
> label so this will work for transports that the translator doesn't
> know. Since the mappings are 1-to-1, incoming sessions can still work
> with help from STUN. The translator does need to keep and time out
> state for translation mappings, though.

Yes.

> This will burn through very many addresses,

Not necessarily. You only need as many addresses as you have hosts. A 
single /64 would be sufficient for any single NAT. You only need a large 
address space if you want STATELESS mappings.

> but even with the checksum 
> restriction this shouldn't be much of a problem if the translator
> "owns" a reasonable size prefix, i.e. the prefix is routed to the
> translator so no neighbor discovery is necessary. This kind of
> obfuscation would work really well with a very large prefix and very
> many hosts, such as a /48 for a large site, although in that case the
> state maintenance could be an issue.

I don't think it's an issue. This is still less state (one mapping per host) 
than contemporary NAT44 (one mapping per flow).

-- 
Rémi Denis-Courmont
Maemo Software, Nokia Devices R&D
_______________________________________________
v4v6interim mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/v4v6interim