Re: [v6ops] combination of NAT64/DNS64 and NAT44

[Simon Perreault <[e-mail]>]

Le 2013-04-17 12:23, Mikael Abrahamsson a écrit :
> A device has dual stack access on its WAN access, with IPv4 RFC1918
> addresses or 100.64.0.0/10 address space on WAN side, and a CGN NAT44
> gateway for sharing these addresses towards the Internet, and GUA IPv6
> addresses. There is also a NAT64 gateway in the network, and a DNS64
> resolver reachable over IPv6. There is a regular resolver reachable over
> IPv4. A dual stack client will get both types of resolvers.
>
> Now, aim is to support all kinds of devices, IPv4 only, IPv6 only, and
> dual stack. The single stack cases are pretty obvious (IPv4 single stack
> will use NAT44, IPv6 single stack will use NAT64/DNS64 and require
> 464XLAT for "proper" function), but my question relates to the dual
> stack case. With a DNS64 based resolver, only IPv4 literals will go over
> the NAT44, if the device uses the IPv6 based resolver.

This is not quite true. Happy-eyeballs algorithms will direct some 
traffic over IPv4 even if IPv6 is available. It could even be a lot of 
traffic, or even most traffic, depending on traffic patterns.

> If it uses the
> IPv4 based resolver, it will use the NAT44 device for IPv4 only sites.
>
> So my questions are:
>
> 1. Is there a case where the above setup will cause problems?

It should work, but it will not be fun to operate.

> 2. Does it make sense to turn on DNS64 even on the IPv4 based resolver?
> This would cause AAAA lookups over IPv4 to steer traffic towards the
> NAT64 gateway, in case a client chooses to use the IPv4 based resolver
> for lookups even if it's dual stacked. As far as I understand, a DNS64
> based resolver will forward A quaries unmodified so this shouldn't cause
> any problems for single stacked IPv4 clients?

It makes a lot of sense, especially since some implementations do happy 
eyeballs at the DNS level and cache the first result received. So an 
otherwise perfectly dual stack node might end up not using the NAT64 if 
it happens to obtain results from the IPv4 resolver first and that 
resolver doesn't do DNS64.

> 3. Did I miss anything?

It might not be immediately useful to you, but you should know about 
this draft:
https://tools.ietf.org/html/draft-ietf-behave-nat64-discovery-heuristic

Other than that, my main feedback would be: you want to provide NATed 
IPv4 alongside NAT64, doesn't that defeat the purpose of NAT64, i.e. 
operating an IPv6-only network?

Simon