Re: Comments on the NAT66 draft

[[e-mail]]

Gert, 

4 years ago we had this discussion on the v6OPS and in spite of the various 
arguments Site Local addresses were depreciated, and RFC4864 -  Local 
Network Protection for IPv6 was approved. 

Back then I proposed that we just allocate 0::(RFC 1918 address) as a 
necessary fix to the perceived need for NAT. After much debate and 
discussion I joined the team writing RFC 4864 on why NAT was not needed and 
thus was not part of v6. 

Unlike the historical development of 1918, here the WG took a serious look 
and made a preemptive decision about NAT addresses and thus should not need 
to back fill to fit a solution that will be industry dictated due to lack of 
available addresses. 

I have yet to hear one serious reason why we need NAT in v6 given that all 
of the requirements that lead to it and have kept it alive for years in v4 
do not exist in v6 and in some cases using it will break v6 functionality. I 
agree that NAT64 and NAT46 are needed during the transition period, but why 
break v6 as it is being adopted to meet some outdated technical and 
extensive marketing related requirements? 

Gert Doering writes: 

> We have seen in IPv4 how well that approach works "close our eyes and
> pretend that NAT is not going to happen". 
> 
> I agree with those posts that said "NAT66 will appear, and the IETF should
> make sure that it's done in a way that will have predictible effects on
> applications". 
> 
Yes I anticipate that people will try to find a loophole to get the 
perceived benefits of NAT in v6, and yes I am sure that some vendors will be 
willing to put marketing over good engineering. But I think we need to make 
a clear statement that v6 NAT IS NOT supported and WILL cause unpredictable 
problems that can lead to loss of connectivity or failure of services, 
otherwise v6 is just v6 on steroids and loosed most of the end-to-end 
connectivity and security features that will make it useful for the next 
generation of applications. 

> As for the specifics: having 1:1 NAT without port rewriting, maybe even
> just swapping the first /64 bits, is what should serve the purpose of
> "I want to be able to change providers, on a whim, without renumbering
> my internal network", while at the same time having fairly little impact
> on applications.   
> 

This is why they have DHCPv6, one small change on the DHCP server and the 
whole network should renumbered. 

> Regarding the "topology hiding" argument - well, people can use privacy 
> extentions on their hosts, no? 
>

Yes, and it does away with one of the myths that NAT is needed for security. 

Eric