Re: [v6ops] draft-ietf-v6ops-enterprise-incremental-ipv6 WGLC

[Lorenzo Colitti <[e-mail]>]

On Tue, Aug 13, 2013 at 2:34 AM, Arie Vayner (avayner) <[e-mail]>wrote:

>  Actually, you can use NPTv6 to protect against it… ****
>
> If I have an external pool per site, traffic egressing that site would get
> a source routed back only to that site… Am I missing something?
>
As I said, NPTv6 by itself doesn't protect against this problem.

It only protect against this problem if each egress point is only reachable
using one prefix, and all the prefixes are different. To people used to
deploying NAT44 networks, this will likely be the only deployment model
that comes to mind, and thus it will appear to them that NPTv6 does solve
this problem.

But in fact, NPTv6 was supposed to be deployed statelessly. The very first
words of RFC6296 are "This document describes a stateless [...] function
[...] preserving end-to-end reachability at the network layer.". In the
introduction, it then goes on to say it "this specification provides a
mechanism that has fewer architectural problems than merely implementing a
traditional stateful NAT". If you were to deploy it statelessly, you would
have this problem.

The interesting point here, really, is that when the IETF says "NPTv6"
people hear "NAT66", when in fact they are supposed to be different. Out of
curiosity: Fred, as the co-author of RFC 6296, were you anticipating that
people would do this? Or was the belief actually that people would
understand the difference?