Re: [v6ops] [BEHAVE] protocols without need for ALG ?

Toerless Eckert <eckert@cisco.com> Fri, 31 July 2015 17:44 UTC

Return-Path: <eckert@cisco.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C6871ABC0F; Fri, 31 Jul 2015 10:44:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -13.511
X-Spam-Level:
X-Spam-Status: No, score=-13.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, J_BACKHAIR_37=1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mlTjdUHke0aY; Fri, 31 Jul 2015 10:44:23 -0700 (PDT)
Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 85BF01A89B5; Fri, 31 Jul 2015 10:44:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3154; q=dns/txt; s=iport; t=1438364663; x=1439574263; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=E6BOS8pbXJqyf4NZPVw19xH7s95wQevpjk41OzIkAWc=; b=QD4I8W+rPDnWCR1vWNjToF8fEBpR1eQPW0BzITiuz6HRvbdetMT+scOz 83y5dHVYoKTNw8RvfR7mjnhoSAF5VbHKlNkl+/6nLZgFPhZoqKW3fA7ib Ft58Mh2zIt9ZE1nLtKkaScb6mM3LkTKxxbcNfDvGrpV6wI/t68wu0EnqQ A=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0BrAwAKs7tV/4wNJK1bgxpUabw1CYF6CoUvSgKBMjgUAQEBAQEBAYEKhCMBAQEDAQEBASQTNAsFCwsYCSUPBRM2ExuICwgNx2kBAQEBAQEBAQEBAQEBAQEBAQEBAQETBItOhQcHgxiBFAWNQIc4h12EagKZPyaEHR4xgkwBAQE
X-IronPort-AV: E=Sophos;i="5.15,585,1432598400"; d="scan'208";a="16707908"
Received: from alln-core-7.cisco.com ([173.36.13.140]) by rcdn-iport-4.cisco.com with ESMTP; 31 Jul 2015 17:44:23 +0000
Received: from mcast-linux1.cisco.com (mcast-linux1.cisco.com [172.27.244.121]) by alln-core-7.cisco.com (8.14.5/8.14.5) with ESMTP id t6VHiMWP032708 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 31 Jul 2015 17:44:22 GMT
Received: from mcast-linux1.cisco.com (localhost.cisco.com [127.0.0.1]) by mcast-linux1.cisco.com (8.13.8/8.13.8) with ESMTP id t6VHiLwi011016; Fri, 31 Jul 2015 10:44:21 -0700
Received: (from eckert@localhost) by mcast-linux1.cisco.com (8.13.8/8.13.8/Submit) id t6VHiL9E011015; Fri, 31 Jul 2015 10:44:21 -0700
Date: Fri, 31 Jul 2015 10:44:21 -0700
From: Toerless Eckert <eckert@cisco.com>
To: Brian E Carpenter <brian.e.carpenter@gmail.com>
Message-ID: <20150731174421.GA9032@cisco.com>
References: <20150730205806.GI1667@cisco.com> <CAD6AjGSKc0jGSkgSKdMsY1gZwYYguJQ06f4nZsWEqBdR9J3e6w@mail.gmail.com> <55BBA7C1.3000502@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <55BBA7C1.3000502@gmail.com>
User-Agent: Mutt/1.4.2.2i
Archived-At: <http://mailarchive.ietf.org/arch/msg/v6ops/_XvpKPBneoZxBkSMXfdTaShBr9s>
Cc: "behave@ietf.org" <behave@ietf.org>, "v6ops@ietf.org" <v6ops@ietf.org>
Subject: Re: [v6ops] [BEHAVE] protocols without need for ALG ?
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Jul 2015 17:44:25 -0000

On Sat, Aug 01, 2015 at 04:52:17AM +1200, Brian E Carpenter wrote:
> > Ehhh. For something as forward looking as anima , it is unfortunate that
> > you believe you will need to bring this technical debt with you.
>
> 
> Yes, but we assume that during the phasing-in of autonomic operations,
> we will be forced to interface to legacy NOCs.

Right. It's just like siit-dc, just the opposite: We want to enable
the IPv6 only autonomic network (like they an IPv6 only DC) of course
to also encourage the IPv6 centric/only NOC but to get started also provide
a simple, isolated, and easily removed solution (hack ?) to connect to
legacy IPv4 NOC in our case (in siit-dc some legacy IPv4 (network)).

> Personally I think I
> disagree with NAT46 and NAT64 as the way to handle this

Actually i now think siit-eam is the easiest way - which i think is
an extension of stateless NAT64, but i don't claim i am using all
the terminology right.

> but Toerless
> is asking the right questions in order to have this debate over on the
> Anima list.

Right. once i'm back from PTO after next week...


Cheers
    toerless

> 
>     Brian
> 
> > 
> > My suggeation is that you require ipv6 for this case. If you do not shed
> > this requirement now, you will carry it with you forever.
> > 
> > The iphone can require ipv6 apps, so can anima.
> > 
> > CB
> > 
> > 
> >> If i understand the NAT RFCs and behave output correctly, we primaerily
> >> want ALGs to go the way of the dodo, so i was wondering if there might be
> >> any crucial protocols between typical NOC equipment and network devices
> >> that
> >> would require ALGs. And better of course:knowing which protocols would be
> >> fine
> >> without ALG.
> >>
> >> Are there any lists about this (eg: what requires ALG ?)
> >>
> >> Wrt to what seems to be important between NOC and network devices:
> >>
> >>    FTP     - NOK (requires ALG) - IMHO not a problem
> >>    traceroute - ??  (initiated from v4 NOC) ??
> >>    telnet  - OK
> >>    ping    - OK ?
> >>    SSH/SCP - OK
> >>    syslog  - OK
> >>    TFTP    - OK ?
> >>    radius  - OK ? (i ran some tests, seemed to be fine)
> >>    diameter/tacacs+ - OK ?
> >>    NTP     - OK ???
> >>
> >>    For the following, that have extensible data-models (MIBs/OIDs, XML
> >> schema etc.),
> >>    i can see that some NOC tools relying on them might not support
> >> data-models
> >>    with IPv6, but that would be "fine" (aka: can't manage everything from
> >> such tools,
> >>    but transport stack works):
> >>
> >>    netconf - OK ?
> >>    SNMP    - OK ?
> >>
> >> Whats the next most important NOC<->network management protocols... ?
> >>
> >> Thanks!
> >>     Toerless
> >>
> >> _______________________________________________
> >> v6ops mailing list
> >> v6ops@ietf.org <javascript:;>
> >> https://www.ietf.org/mailman/listinfo/v6ops
> >>
> > 
> > 
> > 
> > _______________________________________________
> > Behave mailing list
> > Behave@ietf.org
> > https://www.ietf.org/mailman/listinfo/behave
> > 

-- 
---
Toerless Eckert, eckert@cisco.com