Re: [v6ops] draft-ietf-v6ops-ula-usage-recommendations - work or abandon?

[Fernando Gont <[e-mail]>]

Owen,

On 11/13/2015 03:21 AM, Owen DeLong wrote:
> 
>> On Nov 10, 2015, at 06:13 , Eric Vyncke (evyncke) <[e-mail]
>> <mailto:[e-mail]>> wrote:
>>
>>> Nope. It is much easier to establish a connection across a diode
>>> firewall than to establish one across a NAT. In the former case, all
>>> the endpoints need to do is send each other packets at about the same
>>> time. In the latter, they need to implement NAT traversal via relays.
>>
>> It is only 'slightly' easier... Because guessing the TCP sequence
>> number of the other party... Well good luck :-)
> 
> With a diode firewall, you don’t have to guess. Most diode firewalls
> don’t look at TCP sequence numbers actively. They look only at the L3
> and L4 identifiers to determine state.
> Some look at SYN bits and toss SYN packets going in the wrong direction,
> but most just look for an ACK bit.
> 
> Nonetheless, it’s also much easier because a diode firewall can easily
> be given an exception to permit a particular flow or the initiation of a
> class of flows to a particular protected host or set of hosts.

The problem is how to do this automagically.


> In the case of a NAT, however (more specifically a NAPT), it is not
> possible to program multiple port 80 terminations to land on different
> hosts behind the NAT.

That's like saying that the problem with cars is that they cannot fly --
yes, that's what a NAT is.

I might also add that this is another kludge that is made evident by
NAT: there's no reason whatsoever for which a given service should run
in any specific transport protocol port. Consider that a kludge or
shortcut than a principle.


> I retain my perspective that one of the worst and most ultimate forms of
> layering violation is for a forwarding system not residing on either of
> the end-hosts in a session to impersonate an end-host and mutilate
> unexpected portions of the datagram in flight.

I might grant that one if you want. But virtualy everything that you
mentioned that NAT breaks are shortcuts (or flawed design) rather than
"principles" we should stick to.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492