Re: [v6ops] draft-palet-v6ops-464xlat-opt-cdn-caches **Call for Adoption**

[Ca By <[e-mail]>]

On Fri, Jan 10, 2020 at 8:41 AM Fernando Gont <[e-mail]> wrote:

> On 9/1/20 11:22, Ca By wrote:
> >
> >
> > On Thu, Jan 9, 2020 at 5:09 AM Fernando Gont <[e-mail]
> > <mailto:[e-mail]>> wrote:
> >
> >     On 8/1/20 11:11, JORDI PALET MARTINEZ wrote:
> >     > Hi Chongfeng,
> >     >
> >     >
> >     >
> >     > In 464XLAT, the way you allocate ports to customers in the NAT64 is
> >     > typically much more efficient than in pre-allocation as done
> >     commonly in
> >     > CGN or even MAP.
> >
> >     How do you mitigate the potential of DoS if you don't pre-allocate a
> >     range or number of ports to each customer?
> >
> >
> > Same way you do it in NAT44, you set an upper bounds on number of
> > sessions a user can dynamically create.
>
> That's the point. WHy would efficiency be different, then?
>

I can limit each subscriber to some number of dynamic ports.

I can use 1 scarce public ipv4 to support, let’s say, 1,000 subscriber
giving each sub 3,000 ports. In the worst case, this is 3,000,000 ports
that can be demanded.

Because of 5 tuple overloading of a single ip in a NAT pool, it not a
technical challenge

This is an efficiency of public ipv4 use that can only be achieved with a
centralized stateful NAT.

The above scenario is an extreme, but it is an example of maximum
efficiency.


> Thanks,
> --
> Fernando Gont
> SI6 Networks
> e-mail: [e-mail]
> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
>
>
>
>
>