Re: [v6ops] IPv6 mostly for DS-Lite

[Brian Candler <[e-mail]>]

On 20/03/2024 10:56, Gert Doering wrote:
> I tend to disagree - NAT64 could happen on the CPE for ipv6-mostly
> "behind the CPE" networks, and then going ahead with DS-Lite'ing the
> resulting IPv4 packet.  Yes, NAT4444, but for legacy things only.

Unfortunately, that would imply that the CPE would also have to do 
stateful NAT44, prior to encapsulating packets to the AFTR.

In a traditional DS-Lite, the encapsulation on the CPE can be stateless, 
since the AFTR uses the combination of (CPE) source IPv6 + tunnelled 
source IPv4 to distinguish NAT sessions. Of course, the CPE hands out 
distinct IPv4 addresses to each client via DHCPv4.

But if you're doing NAT46 on the client and NAT64 on the CPE, all the 
clients will be using 192.0.0.2, so you can't just pass the source 
address as-is to the AFTR.  You'd need either to allocate and map a fake 
IPv4 address for each IPv6 CLAT client address, or do NAT-PT where the 
local state table also includes CLAT IPv6 address.

Not saying it's impossible - but it ain't pretty.