Re: [v6ops] IPv6-Only Preferred DHCPv4 option

[Fred Baker <[e-mail]>]

On Dec 4, 2019, at 4:09 AM, Jen Linkova <[e-mail]> wrote:
> One of the biggest issue in deploying IPv6-only LANs is how to do it
> incrementally, when some hosts work just fine in NAT64 environment
> while some legacy devices still need IPv4.

A general comment - I don't think this is "devices" as much as it is "applications". I'm thinking here of issues raised in RFC 2993 among others.

I would argue that NAT64 is subject to the same issues as NAT44; there is a coupling between the network and application layers in that an IP address is used as an application layer identifier, and a coupling between addressing domains in the network in that hosted applications presume that an address they use is meaningful to and means the same to an application in another domain. RFC 3439 talk about coupling primarily in terms of time, but couplings such as I describe are also dangerous, and I would argue that the issues raised in RFC 2993 are direct results of coupling. So, whenever an address is embedded in application data and interpreted or used by the peer application, there will be a NAT issue.

What would I want to do about it? I would not want to see an ALG (to my mind, that works against higher layer security such as TLS or IPSec), but rather see the application use an application layer identifier such as a DNS name. 

Of course, my opinion plus some loose change might obtain a cup of coffee...