Re: [v6ops] Thoughts about wider operational input

[Joe Maimon <[e-mail]>]

Vasilenko Eduard wrote:
> Hi Joe,
>
> What about the capability to initiate connectivity from the outside?
> It is easy for the Firewall - just a rule on the CPE.
> It is more difficult in NAT44 where the rule should be on the centralized CGNAT.
> It restricts the potential list of services that is possible through NAT.
>
> Eduard
>
Hey Vasilenko,

Not a fan of CGNAT, most of the positives of NAT shrink dramatically 
once it is being inflicted from one administrative domain onto another, 
leaving them overshadowed by the negatives.

Not sure what you are getting at. Does CGNAT up the stakes for security? 
Not for the worm scenario. Does it make backdoor re-configuration of end 
user CPE less of a desirable or achievable target? Probably, for 
whatever that is worth.

Joe