Re: [v6ops] draft-ietf-v6ops-enterprise-incremental-ipv6 WGLC

[Lorenzo Colitti <[e-mail]>]

On Fri, Aug 9, 2013 at 2:21 PM, Arie Vayner (avayner) <[e-mail]>wrote:

>  Many enterprises rely on NAT on the Internet edge as their
> multi-homing/traffic engineering mechanism with IPv4.
>
> ** **
>
> If we recommend against ULA+NPTv6 (or just NPTv6 for traffic engineering),
> then we need to highlight the symmetry requirement due to stateful security
> layers.****
>
> Traffic leaving from an Internet gateway site to the Internet has to come
> back through the same site, or the stateful firewalls would break the flow
> (well, has to hit the same stateful security layer)
>

By itself, NPTv6 doesn't protect against this problem because it's not
stateful. It only protects against this problem if each egress point is
only reachable using one prefix (which is not a requirement for doing NPTv6
- you could just as well do it by configuring all multiple exit points to
use the same prefix, or to use all prefixes from all exit points).

What does protect you against this is using source+destination routing,
which is what this draft should recommend instead of recommending NPTv6.