Re: [v6ops] IPv6-Only Preferred DHCPv4 option

[Jen Linkova <[e-mail]>]

On Thu, Dec 5, 2019 at 7:49 AM Fred Baker <[e-mail]> wrote:
> > One of the biggest issue in deploying IPv6-only LANs is how to do it
> > incrementally, when some hosts work just fine in NAT64 environment
> > while some legacy devices still need IPv4.
>
> A general comment - I don't think this is "devices" as much as it is "applications". I'm thinking here of issues raised in RFC 2993 among others.

You are right, it's applications getting broken w/o IPv4 indeed. The
text is saying 'devices' just for the sake of brevity: as a network
engineer I see *devices* connecting to the network, and IPv4 addresses
being assigned to the devices. A device just a box with a number of
applications (+ an OS) running inside.
However there are cases when an application needs an IPv4 address to
operate while the whole device does not. Think of a device with
464XLAT  enabled (e.g. an Android phone). The same application might
work perfectly fine on a mobile phone connected to an IPV6-only WiFi
but gets broken if I run it on my macbook connected to the same
network.

Would it be better if the sentence you quoted would be saying 'while
some legacy devices still need IPv4 addresses as their OSes and/or
applications depend on IPv4'?

> I would argue that NAT64 is subject to the same issues as NAT44; there is a coupling between the network and application layers in that an IP address is used as an application layer identifier, and a coupling between addressing domains in the network in that hosted applications presume that an address they use is meaningful to and means the same to an application in another domain. RFC 3439 talk about coupling primarily in terms of time, but couplings such as I describe are also dangerous, and I would argue that the issues raised in RFC 2993 are direct results of coupling. So, whenever an address is embedded in application data and interpreted or used by the peer application, there will be a NAT issue.
>
> What would I want to do about it? I would not want to see an ALG (to my mind, that works against higher layer security such as TLS or IPSec), but rather see the application use an application layer identifier such as a DNS name.

NAT64 is not perfect and is not a silver bullet but I do not think we
have any better tool right now. At least NAT64 is used for iPv4-only
destinations only so damage is contained (and the footprint will be
reducing over time, I hope).
-- 
SY, Jen Linkova aka Furry