Re: [v6ops] Supporting IPv6-only Networks with NAT64 and DNS64 section of draft-ietf-v6ops-rfc6555bis-01

[Fred Baker <[e-mail]>]

> On Jun 29, 2017, at 7:52 AM, Mark Andrews <[e-mail]> wrote:
> 
> There are other mechanisms to reach IPv4 machines from IPv6-only
> networks.  DS-Lite in host mode is one such mechanism.

Thinking through my comments a little further. I'm not portraying the issue well. Let's start out with a picture.

I have three hosts that need to talk with each other. They are running the same application or compatible applications, but two (Hosts A and B) are on an IPv6-only network and the third (Host C) is on an IPv4-only network.
                                                 +------+
                                                 |Host A|
                                                 +------+
                                                 /
             ,-----.                      ,---. /
 +------+   /       \   +------------+   /     \
 |Host C+--(   IPv4  )--+Interconnect+--( IPv6  )
 +------+   \       /   +------------+   \     /
             `-----'                      `---'\
                                                \+------+
                                                 |Host B|
                                                 +------+

So, contrary to what I said a few moments ago, the application is IPv6-capable. My error.

What you propose is that Host A somehow know that Host B is IPv6-capable and that Host C is not, and choose an alternative and not-widely-deployed mechanism such as DS-Lite in Host Mode for access to Host C. This requires the administrator of the network Host A is in to give it relevant software and whatever is required to communicate that distinction.

What a translation model proposes is that Host A sees both Host B and Host C as IPv6-capable and talk with them the same way. Host C's IPv6 address is in a certain prefix and contains an embedded IPv4 address. Host A doesn't necessarily realize that - it sees a 128 bit address and uses it. The network changes the underlying Internet Protocol to make that work.

Is that a perfect solution? NAT is never a perfect solution, and I don't think anyone here is saying anything different. But operationally, the administrator doesn't have to change Host A or do anything magical to make this work. It has issues, specifically with DNSSEC as you point out. One could argue that the Interconnect is a perfect MITM, and one would argue correctly. But using a translator allows most of what needs to happen without saddling the administrator with a gargantuan task. If he has a huge task, he is unlikely to do it at all. If he can do something relatively simple, he can take baby steps.

Recall that Host C is presumably not under his/her control, but he presumably has business reasons to enable access between the hosts.