Re: [v6ops] double nat

Hi,

I am reviving this thread, as (AFAIK) nobody mentioned the following issue:

"Other aspects of NAT behaviour, notably the NAT binding lifetime and 
the form of NAT
"cone behaviour" for UDP take on the more the more restrictive of the 
two NATs in sequence.
The binding times are potentially problematical in that the two NATs are 
not synchronised in
terms of binding behaviour. If the CGN has a shorter binding time, it is 
possible for the CGN to
misdirect packets and cause application level hang ups. However this is 
not overly different to
a single level NAT environment where aggressively short NAT binding 
times will also run the
risk of causing application level hang ups when the NAT drops the 
binding for a active session
that has been quiet for an extended period of time."

(Geoff Huston, 
http://www.potaroo.net/ispcol/2011-03/transtools-part2.pdf, page 7)

So binding lifetime desynch can be quite harmful here? Any real-world 
experience on this?

Thanks,
Nejc

On 2.10.2012 13:54, Randy Bush wrote:
>>> so, is double nat really worse than single nat?  is it formally
>>> different?  except in the case of overlapping spaces, of course.
>> One of the problems with "someone else controls your NAT" is that
>> you can't add port mappings.  This seems to be an inevitable side
>> effect of NAT444 (but can happen with single NAT44 as well, of
>> course, depending on where it's placed).
> i asked *formally*.  i am not concerned with all the ops, social,
> stuff.  and not about issues not directly connected to the nat.
> what does double translation do that single does not?
>
> randy
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops