Re: [v6ops] Thoughts about wider operational input

[Joe Maimon <[e-mail]>]

Ackermann, Michael wrote:
> This message was sent securely using Zix® 
> <http://www.zixcorp.com/get-started/>
>
>
> Great points Jordi!
>
> IMHO, the biggest problem is #2 (appropriately designated 😊)
>
> This is very old thinking and Security professionals will say this is 
> no longer a good idea for any security reason.    But yet this 
> thinking persists.    To the extent that we can educate these thoughts 
> away,  and make enterprises realize that NATs are not desirable,  I 
> believe that would be effective.
>
> Thanks
>
> Mike
>

I dont see any mention that Enterprises like abstraction of addressing 
that places them in control of it, not any vendor or even some external 
standards body that may or may not have their interests in mind and that 
they may or may not have any interest in participating.

NAT is indeed a security layer, because it fails closed and requires 
explicit permission to allow traffic. Enterprises like that.

You will not succeed in educating Enterprises why NAT's are undesirable 
until your understand the reasons they desire them.

Joe

> *From:* v6ops <[e-mail]> *On Behalf Of * JORDI PALET 
> MARTINEZ
> *Sent:* Wednesday, March 30, 2022 3:25 AM
> *To:* v6ops list <[e-mail]>
> *Subject:* Re: [v6ops] Thoughts about wider operational input
>
> [External email]
>
> I bet that in the majority of the cases for enterprises willing to 
> continue using NAT with IPv6, the reasons are:
>
>  1. We are using to it in IPv4, why changing it in IPv6 (mental change
>     when adopting IPv6 = lack of proper training).
>  2. Wrong perception that NAT (and hiding addresses) = security.
>  3. Vendors of equipment continue to lie and say “yes” to customers
>     when they ask for NAT66, even if they are supporting an
>     experimental protocol (NPT) and they don’t tell customers “yes we
>     have it, but note that it is an experimental protocol, so not
>     proven interoperability and you’re exposed to consequences than we
>     don’t know yet with apps or services, and same problems as in NAT44”.
>
> Regards,
>
> Jordi
>
> @jordipalet
>
> El 30/3/22, 8:32, "v6ops en nombre de Chongfeng Xie" 
> <[e-mail] <mailto:[e-mail]> en nombre de 
> [e-mail] <mailto:[e-mail]>> escribió:
>
> Hi，Mark，
>
> Some enterprises do not want to expose their real address in the 
> network to the outside, so they will use NAT, whether nat44 or nat64 
> or even nat66 in the future. Therefore, NAT may always exist with the 
> needs of customers.
>
> The technology itself is not right or wrong. It is inappropriate to 
> directly state whether a technology is good or bad, but whether the 
> technology is appropriate for specific scenarios. You said there was a 
> lot of issues with IPv6+NAT，under what scenario? What's are the 
> issues ? Is it a stateless IPv6+NAT or a stateful IPv6+NAT?
>
> Thanks
>
> Chongfeng
>
>     2022年3月30日 上午11:22，Mark Smith <[e-mail]
>     <mailto:[e-mail]>> 写 道：
>
>     On Wed, 23 Mar 2022, 01:55 JORDI PALET MARTINEZ,
>     <jordi.palet=[e-mail]
>     <mailto:[e-mail]>> wrote:
>
>         Hi Eduard,
>
>         What I meant is that I will like to avoid the issues that NAT
>         creates for apps. We must aim for something better.
>
>     This.
>
>     IPv6+NAT creates a lot of the issues that IPv4+NAT does, so why
>     bother deploying IPv6 when you've already got the equivalent via
>     IPv4 today?
>
>     People need to understand why enterprises go to the expense of
>     deploying technologies.
>
>     Technology is a means to an end, not the end itself. Technology in
>     business either saves money or makes money for the business.
>
>     Enterprises in the 1990s didn't really deploy IPv4, they deployed
>     global email and WWW access. Deploying IPv4 was the means to
>     reaching those ends, because IPv4 underpinned them.
>
>     So the questions to think about in the context of businesses and
>     enterprises and IPv6 are:
>
>     - What business problem does or can IPv6 solve better than
>     existing IPv4?
>
>     - IPv6 is the technology means to an end, so what is or are the
>     ends that are of value to a business, where IPv6 is the better
>     underpinning technology than IPv4 to reach those ends?
>
>     - How can deploying IPv6 save or make money for a business?
>
>     Regards,
>
>     Mark.
>
>         On the other side, using an experimental protocol for
>         production networks, in my opinion is a big “NO”.
>
>         Regards,
>
>         Jordi
>
>         @jordipalet
>
>         El 22/3/22, 13:04, "v6ops en nombre de Vasilenko Eduard"
>         <[e-mail] <mailto:[e-mail]> en
>         nombre de vasilenko.eduard=[e-mail]
>         <mailto:[e-mail]>> escribió:
>
>         Hi Jordi,
>
>         I understand the desire to fix broken things. (I doubt it is
>         possible)
>
>         But why NPT+ULA is not enough for MHMP now?
>
>         It is very similar to what Enterprises and small businesses
>         have now.
>
>         They would be happy.
>
>         Eduard
>
>         *From:* v6ops [mailto:[e-mail]
>         <mailto:[e-mail]>] *On Behalf Of *JORDI PALET
>         MARTINEZ
>         *Sent:* Tuesday, March 22, 2022 12:34 PM
>         *To:* [e-mail] <mailto:[e-mail]>
>         *Subject:* Re: [v6ops] Thoughts about wider operational input
>
>         You’re right. Let’s say it in a different way, as may be my
>         first email was not clear on this.
>
>         1.I don’t think we want again to repeat the NAT problems, so
>         NPT is not a valid solution for me.
>
>         2.I think in the future almost every site could want to be
>         multihomed, in some cases “n” links active, many other cases
>         just as a backup.
>
>         3.This means that renumbering is not (probably) a valid choice
>         in any cases.
>
>         4.Can we make PI work in such “huge scale” scenario?
>
>         5.Can source-address forwarding work and solve all that, or we
>         need that and/or something else.
>
>         Only if we solve this, organizations could learn that NAT with
>         IPv6 is not the solution, but something better that provides
>         the same results, and no need to have “private” addresses,
>         because the way NAT is offering a “different” addressing
>         inside and outside is not NAT per-se, but statefull firewalling.
>
>         Regards,
>
>         Jordi
>
>         @jordipalet
>
>         El 22/3/22, 10:27, "v6ops en nombre de Ted Lemon"
>         <[e-mail] <mailto:[e-mail]> en
>         nombre de [e-mail] <mailto:[e-mail]>> escribió:
>
>         Is it really hncp that we needed here?  I think the key tech
>         we need is source-address-based forwarding, and babel i think
>         has delivered that. Granted, getting that into soho routers is
>         a problem.
>
>         On Tue, Mar 22, 2022 at 10:11 JORDI PALET MARTINEZ
>         <jordi.palet=[e-mail]
>         <mailto:[e-mail]>> wrote:
>
>             Maybe the terminology is not the most appropriate and we
>             should talk about "organizations", because there are many
>             types of networks that have the same problem and those are
>             not enterprises (such as government sites, NGOs, etc.).
>
>             The problem is the same regardless of the "size" of the
>             organization. The difference is that "today" most SMEs
>             don't have that problem because they don't have PI, but it
>             may turn the same when they realize that not being PI have
>             renumbering issues if changing the ISP. Of course, again,
>             if we talk about a "small" SME, then may not be an issue,
>             they only have 40 or 50 devices to renumber (your mileage
>             will vary), not easy but not "terrible".
>
>             On the rest of Gert comments, definitively I agree, and
>             specially on our big mistake not working further on HNCP.
>
>             Regards,
>             Jordi
>             @jordipalet
>
>
>
>             El 22/3/22, 9:31, "v6ops en nombre de Gert Doering"
>             <[e-mail] <mailto:[e-mail]> en
>             nombre de [e-mail] <mailto:[e-mail]>> escribió:
>
>                 Hi,
>
>                 On Tue, Mar 22, 2022 at 11:42:12AM +1300, Brian E
>             Carpenter wrote:
>                 > I agree with Jordi that multihoming is a genuine
>             impediment. What isn't generally realised is that it's a
>             problem of scale when considering at least 10,000,000
>             enterprises, much more than it's a problem of IPv6 itself.
>
>                 What is "an enterprise"?
>
>                 My stance on this is that for "largely unmanaged SoHo
>             networks" - which
>                 could be called "small enterprise" - dual-enduser-ISP
>             with dual-/48 or
>                 NPT66 gets the job done in an easy and scalable way
>             (HNCP would have
>                 been great, but IETF politics killed it).
>
>                 "Enterprise that truly need their own independent
>             fully managed network
>                 with multiple ISP uplinks and fully routed independent
>             address space"
>                 are probably way less than 10 million...
>
>                 Half of them do not want Internet access anyway, just
>             access to their
>                 ALGs that will do the filtering and TLS inspection and
>             everything, and
>                 then out to the Internet as a new TCP session (= could
>             be done with
>                 DMZ islands of upstream-provider-allocated space just
>             fine).
>
>
>                 We need to work on our marketing regarding
>             multihoming.  "What is it that
>                 you get, what is the cost, which of the variants do
>             you want, and why...?"
>
>                 Gert Doering
>                         -- NetMaster
>                 --
>                 have you enabled IPv6 on something today...?
>
>                 SpaceNet AG     Vorstand: Sebastian v. Bomhard,
>             Michael Emmer
>                 Joseph-Dollinger-Bogen 14     Aufsichtsratsvors.: A.
>             Grundner-Culemann
>                 D-80807 Muenchen      HRB: 136055 (AG Muenchen)
>                 Tel: [phone]      USt-IdNr.: DE813185279
>
>             _______________________________________________
>                 v6ops mailing list
>             [e-mail] <mailto:[e-mail]>
>             https://www.ietf.org/mailman/listinfo/v6ops
>
>
>
>             **********************************************
>             IPv4 is over
>             Are you ready for the new Internet ?
>             http://www.theipv6company.com <http://www.theipv6company.com/>
>             The IPv6 Company
>
>             This electronic message contains information which may be
>             privileged or confidential. The information is intended to
>             be for the exclusive use of the individual(s) named above
>             and further non-explicilty authorized disclosure, copying,
>             distribution or use of the contents of this information,
>             even if partially, including attached files, is strictly
>             prohibited and will be considered a criminal offense. If
>             you are not the intended recipient be aware that any
>             disclosure, copying, distribution or use of the contents
>             of this information, even if partially, including attached
>             files, is strictly prohibited, will be considered a
>             criminal offense, so you must reply to the original sender
>             to inform about this communication and delete it.
>
>
>
>             _______________________________________________
>             v6ops mailing list
>             [e-mail] <mailto:[e-mail]>
>             https://www.ietf.org/mailman/listinfo/v6ops
>
>         _______________________________________________ v6ops mailing
>         list [e-mail] <mailto:[e-mail]>
>         https://www.ietf.org/mailman/listinfo/v6ops
>
>
>         **********************************************
>         IPv4 is over
>         Are you ready for the new Internet ?
>         http://www.theipv6company.com <http://www.theipv6company.com/>
>         The IPv6 Company
>
>         This electronic message contains information which may be
>         privileged or confidential. The information is intended to be
>         for the exclusive use of the individual(s) named above and
>         further non-explicilty authorized disclosure, copying,
>         distribution or use of the contents of this information, even
>         if partially, including attached files, is strictly prohibited
>         and will be considered a criminal offense. If you are not the
>         intended recipient be aware that any disclosure, copying,
>         distribution or use of the contents of this information, even
>         if partially, including attached files, is strictly
>         prohibited, will be considered a criminal offense, so you must
>         reply to the original sender to inform about this
>         communication and delete it.
>
>         _______________________________________________ v6ops mailing
>         list [e-mail] <mailto:[e-mail]>
>         https://www.ietf.org/mailman/listinfo/v6ops
>
>
>         **********************************************
>         IPv4 is over
>         Are you ready for the new Internet ?
>         http://www.theipv6company.com <http://www.theipv6company.com/>
>         The IPv6 Company
>
>         This electronic message contains information which may be
>         privileged or confidential. The information is intended to be
>         for the exclusive use of the individual(s) named above and
>         further non-explicilty authorized disclosure, copying,
>         distribution or use of the contents of this information, even
>         if partially, including attached files, is strictly prohibited
>         and will be considered a criminal offense. If you are not the
>         intended recipient be aware that any disclosure, copying,
>         distribution or use of the contents of this information, even
>         if partially, including attached files, is strictly
>         prohibited, will be considered a criminal offense, so you must
>         reply to the original sender to inform about this
>         communication and delete it.
>
>         _______________________________________________
>         v6ops mailing list
>         [e-mail] <mailto:[e-mail]>
>         https://www.ietf.org/mailman/listinfo/v6ops
>
>     _______________________________________________
>     v6ops mailing list
>     [e-mail] <mailto:[e-mail]>
>     https://www.ietf.org/mailman/listinfo/v6ops
>
> _______________________________________________ v6ops mailing list 
> [e-mail] <mailto:[e-mail]> 
> https://www.ietf.org/mailman/listinfo/v6ops 
> <https://www.ietf.org/mailman/listinfo/v6ops>
>
>
> **********************************************
> IPv4 is over
> Are you ready for the new Internet ?
> http://www.theipv6company.com
> The IPv6 Company
>
> This electronic message contains information which may be privileged 
> or confidential. The information is intended to be for the exclusive 
> use of the individual(s) named above and further non-explicilty 
> authorized disclosure, copying, distribution or use of the contents of 
> this information, even if partially, including attached files, is 
> strictly prohibited and will be considered a criminal offense. If you 
> are not the intended recipient be aware that any disclosure, copying, 
> distribution or use of the contents of this information, even if 
> partially, including attached files, is strictly prohibited, will be 
> considered a criminal offense, so you must reply to the original 
> sender to inform about this communication and delete it.
>
>
> The information contained in this communication is highly confidential 
> and is intended solely for the use of the individual(s) to whom this 
> communication is directed. If you are not the intended recipient, you 
> are hereby notified that any viewing, copying, disclosure or 
> distribution of this information is prohibited. Please notify the 
> sender, by electronic mail or telephone, of any unintended receipt and 
> delete the original message without making any copies.
>
> Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan 
> are nonprofit corporations and independent licensees of the Blue Cross 
> and Blue Shield Association.
>
>
>
> This message was secured by *Zix <http://www.zixcorp.com>^® *.
>
>
> _______________________________________________
> v6ops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/v6ops