Subject: [BEHAVE] Are NATs routers?

From: Philip Matthews <[email-masked]>
Date: Mon, 23 Apr 2007 12:00:53 -0400

[Starting a new thread and trimming the CC list]

On 22-Apr-07, at 20:35 , Cullen Jennings wrote:
>
> On Apr 22, 2007, at 10:45 AM, Joe Touch wrote:
>
>> NATs are not routers. Using a code defined in RFC1812 for this  
>> purpose
>> is to inappropriately imply that a router is generating the code.
>
> agree - and point out this has been said many times by several  
> different people in Behave.

I am guessing that this came up before I started attending BEHAVE  
meetings,
but I would be interesting in hearing more about why NATs are not  
routers,
or at least router-like.

As I see it, most NAT boxes have different subnets on their public  
and private sides,
so they look rather similar to a router to me.

Regarding the TTL, perhaps I am missing something, but wouldn't we  
want a NAT
to decrement the TTL field as the packet passes through?  Perhaps  
this is a new
requirement?

- Philip

_______________________________________________
Behave mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/behave

---

From: Joe Touch <[email-masked]>
Date: Mon, 23 Apr 2007 09:23:40 -0700

>>> NATs are not routers. Using a code defined in RFC1812 for this purpose
> I am guessing that this came up before I started attending BEHAVE meetings,
> but I would be interesting in hearing more about why NATs are not routers,
> or at least router-like.
> 
> As I see it, most NAT boxes have different subnets on their public and
> private sides,

NATs translate IP headers; that's something routers never do.

From the public side, a NAT is (or should be) equivalent to a network
endpoint; it sources and sinks packets with its public IP address. What
it does with those packets on the back end is its own business, and if
it is never visible to the public Internet it's irrelevant.

From the private side, NATs don't look like either a router or a host;
they should look like an invisible wire to the net a NAT connects to -
or at least that's the goal of many NATs (to be invisible).

Although packets are forwarded, there is no "network level" forwarding
going on; packet translation is NOT routing.

> Regarding the TTL, perhaps I am missing something, but wouldn't we want
> a NAT
> to decrement the TTL field as the packet passes through?  Perhaps this
> is a new
> requirement?

NATs often want to appear "invisible" - decrementing the TTL would make
them very visible, and thus defeats that goal.

Joe

---

From: Cullen Jennings <[email-masked]>
Date: Mon, 23 Apr 2007 09:40:33 -0700

A more specific question might be why NATs don't meet the  
requirements of a devices that does RFC 1812.

---

From: "Medhavi Bhatia" <[email-masked]>
Date: Mon, 23 Apr 2007 12:46:08 -0400

I think if NATs were like routers, then everything which looks like a NAT
would start looking like a router as well. These would be things like ALGs,
SBCs (which may or may not decrement the SIP Max Fwd) etc. NATs deal with
routing issues like all these entities do at layer 3 and above I am sure,
but can you call all these things a router?

On the other hand it would be good if NATs were to follow rules which are a
superset of those of routers.

---

From: Jim Dixon <[email-masked]>
Date: Mon, 23 Apr 2007 17:46:26 +0100 (BST)

> NATs translate IP headers; that's something routers never do.

Have you told Cisco?  I just googled on 'cisco nat' and got 1,630,000
hits.  The first sets out the use of NAT in IOS.  The second begins
with 'network Address Translation allows a single device, such as a
router, to act as an agent between the Internet (or "public network")
and a local (or "private") network.'

--
Jim Dixon  [email-masked]  cellphone 415 / 570 3608

---

From: Philip Matthews <[email-masked]>
Date: Mon, 23 Apr 2007 12:47:21 -0400

On 23-Apr-07, at 12:23 , Joe Touch wrote:
>> Regarding the TTL, perhaps I am missing something,
>> but wouldn't we want a NAT
>> to decrement the TTL field as the packet passes through?
>> Perhaps this is a new requirement?
>

I don't think NATs are really invisible.
There is a lot of work going on to make applications work
through NATs, and a lot of work going on to  discover
NATs and their properties.

So I think this goal is now obsolete.

- Philip

---

From: Joe Touch <[email-masked]>
Date: Mon, 23 Apr 2007 09:54:03 -0700

Jim Dixon wrote:
> hits.  The first sets out the use of NAT in IOS. 

We all know that there are boxes called routers that have - packaged
inside - the functions of a NAT. These boxes also terminate connections,
and to that end are hosts.

Some sell such boxes that even connect to and network other
technologies, like SNA.

> The second begins

That's all focused on a single *physical* device. That's not relevant
here. We're talking about the NAT functions, not the physical box.

The router part of a box never translates headers; to do so is to
violate RFC1812, and **by definition** renders whatever component does
that "not a router". You can couple that box to an 1812-compliant router
and sell it as a single box, but that is irrelevant.

Joe

---

From: Joe Touch <[email-masked]>
Date: Mon, 23 Apr 2007 09:55:18 -0700

> So I think this goal is now obsolete.

There is *some* work in trying to make the functions of these boxes
visible and controllable, but that doesn't cover the entirety of what
makes a NAT a NAT.

In general, NATs do their best to be as invisible as possible, and
visible only when that fails.

Joe

---

From: Jim Dixon <[email-masked]>
Date: Mon, 23 Apr 2007 18:13:07 +0100 (BST)

> >> NATs translate IP headers; that's something routers never do.

This is plain English: routers never translate IP headers.

> and to that end are hosts.

This is obfuscation.  I do believe that every router that I have ever
used has NAT functionality.  That is, they are all capable of translating
IP headers.  And they are all routers.

> and sell it as a single box, but that is irrelevant.

Sorry, you can't mistreat the English language in this way ;-)

When I buy a router, I _expect_ it to have NAT functionality.  I am
not buying a 'box'.  I am buying a router and in so doing I am buying
its NAT capabilities.

Lewis Carroll, 'Through the Looking Glass', Chapter VI, is relevant.

---

From: Joe Touch <[email-masked]>
Date: Mon, 23 Apr 2007 10:30:41 -0700

Jim Dixon wrote:
...
> When I buy a router, I _expect_ it to have NAT functionality. 

You do; others expect ATM interfaces, ethernet interfaces, etc. That's
your issue, but doesn't define what a router is; RFC1812 does that.

> I am

You also expect Ethernet functionality, but that has nothing to do with
RFC1812 functions either.

Joe

---

From: Jim Dixon <[email-masked]>
Date: Mon, 23 Apr 2007 19:10:04 +0100 (BST)

> your issue, but doesn't define what a router is; RFC1812 does that.

Sorry, but this is absurd.  Common use defines what any word means.
We all know who the large router manufacturers are.  Those manufacturers
sell routers.  Those routers have NAT functionality.

> RFC1812 functions either.

I have actually bought routers without an Ethernet interface.  But I don't
recall ever buying one that wasn't capable of Network Address Translation.

> NATs translate IP headers; that's something routers never do.

This is simply wrong.  It's not true.  Routers route, and routers
sometimes translate IP headers.  They don't suddenly become "boxes"
when they do so.

---------------------------------------------------------------------------
'When I use a word,' Humpty Dumpty said, in a rather scornful tone, 'it
means just what I choose it to mean -- neither more nor less.'
  Lewis Carroll, _Through the Looking Glass_
---------------------------------------------------------------------------

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Tue, 24 Apr 2007 09:08:05 +0300

On Monday 23 April 2007 19:00:53 ext Philip Matthews wrote:
> meetings, but I would be interesting in hearing more about why NATs
> are not routers, or at least router-like.

The NATting function is pretty much independant/orthogonal to the routing 
function. Many NATs are *also* routers in terms of 
implementations/architecture, though they do not obey the official IETF 
requirements for a router. There are also NATs that are ARP proxies which 
deviates a bit from a normal router.

You can also put the NAT function within a bridge (in IEEE802.3 sense), though 
again, a bridge is not supposed to mangle the frames payload. And I have also 
seen hybrid NATs that operated at a link-layer on the "internal" side, and at 
the socket-layer on the external side: such a NAT is Host in IETF sense on 
the external side.

-- 
Rémi Denis-Courmont

---

From: Pyda Srisuresh <[email-masked]>
Date: Tue, 24 Apr 2007 05:12:16 -0700 (PDT)

> visible only when that fails.

[suresh] From a routing persepctive, NAT are are not invisble. A NAT is as
visible as any router is in a network. What NATs do is to make the private
networks invisble to the public side. I agree, The adddress/port assignment
part in a NAT is often not visible to the outside. But, that does not effect
the routing function. 

regards,
suresh

---

From: james woodyatt <[email-masked]>
Date: Tue, 24 Apr 2007 11:01:08 -0700

> part in a NAT is often not visible to the outside. But, that does  

I remember the days when we would have said that a NAT is a kind of  
gateway between separate address realms.  Did the phrase "address  
realm" fall out of favor again?

--
j h woodyatt <[email-masked]>

---

From: Pyda Srisuresh <[email-masked]>
Date: Wed, 25 Apr 2007 06:34:04 -0700 (PDT)

> realm" fall out of favor again?
[suresh] No, the phrase has not fallen out of favor, AFAIK. NAT fucntions as
transparant router to hosts in different realms, by mapping addresses from one
realm to another. 

regards,
suresh

---

From: Cullen Jennings <[email-masked]>
Date: Wed, 25 Apr 2007 21:52:23 -0700

On Apr 23, 2007, at 9:46 AM, Jim Dixon wrote:

> I just googled on 'cisco nat' and got 1,630,000

Cisco thinks everything is a router - except the 1/2 of cisco that  
thinks everything is a switch - and the part that thinks everything  
is a Unified Communication Device - and I should not forget the large  
part that disagrees with all of the above.... I googled 'cisco dog'  
and got about the same number of hits. Cisco often call thing that  
take VoIP calls and puts them on the PSTN as routers - I get  
1,780,000 hits for "cisco router voip".  And linksys sell things they  
call routers that are not capable of speaking any IP routing  
protocol.  The only conclusion I can come to is Cisco not exactly  
sure what they think a router is but they would be glad to sell you  
one - regardless of whatever it is you want a router to be.

Anyways - I think that people use the term router to mean many things  
in many contexts. I assumed we were using it in terms of the RFC that  
seem most related to this but I understand the confusion now.

So unless someone has a better canonical definition of what a router  
is, I propose we define it as a device that is compliant with RFC  
1812 and be clear about what we mean by the term "router".

Cullen <with my individual hat on>

---

From: Jim Dixon <[email-masked]>
Date: Thu, 26 Apr 2007 23:02:59 +0100 (BST)

> Cisco thinks everything is a router - except the 1/2 of cisco that

Juniper also routinely does NAT.  Everybody does NAT.

This conversation follows from a statement that routers never do
address translation, which is simply nonsense.  It's not true.  It's
false.  Routers do network address translation every day, everywhere.

It is sensible to talk about where routing functionality or switching
functionality or NAT resides in a system such as a router.  But to
assert that the boxes everyone spends so much money on are not routers
is absurd.  It says 'router' on the box, it says 'router' on the
purchase order, it says 'router' on the inventory.  It's a router.

Does anyone have a router than _doesn't_ do NAT?

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 26 Apr 2007 15:56:28 -0700

At Thu, 26 Apr 2007 23:02:59 +0100 (BST),
> Does anyone have a router than _doesn't_ do NAT?

I'm sure I'm going to regret jumping in here, but...

I think you're confusing the device's capabilities with the role it
plays in the network. To take a concrete example, I'm typing this on a
FreeBSD box with two NICs, one wireless and one wireline.  It not
forwarding between those interfaces now, but making it do so is a
simple matter of setting a sysctl, at which point you would have every
right to expect it to obey 1812. Is it a router or not? I assure you
it doesn't say so on the box.

-Ekr

---

From: Jim Dixon <[email-masked]>
Date: Fri, 27 Apr 2007 00:10:33 +0100 (BST)

> it doesn't say so on the box.

To say that an elephant is a mammal is not to say that all mammals are
elephants.  Your FreeBSD box is capable of routing.  It is also capable
of doing network address translation.  (I have exactly this setup at
home in the UK, BTW - a PC with a cable connection on one side and a
couple of home networks on the other.  It routes traffic and also does
NAT.)  But it's not a dedicated router and it's not being used as such.

The question here is whether all of these gazillions of machines which
are bought and sold as routers are actually such.  The claim is that
if they do NAT they cannot be called routers - even though that's exactly
what everyone calls them.

A long time ago some US state legislature decided that it would be more
convenient if pi had a value of 3 and legislated accordingly.  Another
futile gesture ;-)

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 26 Apr 2007 16:14:45 -0700

At Fri, 27 Apr 2007 00:10:33 +0100 (BST),
> NAT.)  But it's not a dedicated router and it's not being used as such.

I've used FreeBSD boxes as dedicated routers plenty of times.

> what everyone calls them.

No. The claim here is that if they are *configured* as NATs then they
do not need to comply with RFC 1812.

-Ekr

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Thu, 26 Apr 2007 16:14:54 -0700

> Does anyone have a router than _doesn't_ do NAT?

Yes, this model does not do NAT:

http://www.amazon.com/DEWALT-DW616-Heavy-Fixed-Router/dp/B00006JKX9/ref=pd_bbs_5/102-7320701-6896967?ie=UTF8&s=hi&qid=1177628771&sr=8-5

Well, it says router on the box.

-- 
Marc Petit-Huguenin           [                                 ]
Home: [email-masked] [RFC1855-compliant space for rent ]
Work: [email-masked]            [                                 ]

---

From: Jim Dixon <[email-masked]>
Date: Fri, 27 Apr 2007 00:18:40 +0100 (BST)

> Well, it says router on the box.

I experimented and found that if you put a network address on a piece of
paper under this router, it will translate it into tiny little bits of
paper.  Unfortunately the translation is fairly random.

:-|

---

From: Jim Dixon <[email-masked]>
Date: Fri, 27 Apr 2007 00:33:06 +0100 (BST)

> I've used FreeBSD boxes as dedicated routers plenty of times.

As have I.  So?

> do not need to comply with RFC 1812.

The claim which got me involved in this conversation was:

---------------------------------------------------------------
> NATs translate IP headers; that's something routers never do.
---------------------------------------------------------------

It's a simple claim.  And it's simply wrong.

To me, if you use a FreeBSD machine as a router, well then it's a router.
The fact that it also does network address translation doesn't change this
at all.  It routes, so it's a router.

I have had arguments with people about this and can generally understand
the other side's position.  They want to restrict the use of the term
'router' to dedicated bits of hardware that are sold as routers and used
as such.

However, the argument on this list has been much more extreme:  that all
of these boxes sold as and bought as routers aren't routers, even though
the manufacturers, the operators, and everyone else thinks that they are.

---

From: Spencer Dawkins <[email-masked]>
Date: Thu, 26 Apr 2007 20:27:57 -0500

Isn't this thread getting a little "off" for an IETF working group?

Perhaps we could focus back a bit.

Thanks,

Spencer

---

From: Lars Eggert <[email-masked]>
Date: Fri, 27 Apr 2007 18:51:25 +0100

> what everyone calls them.

People can _call_ these boxes whatever they like.

If the box in question does not fully implement RC1812, it _is not_ a  
standards-compliant IP router.

(And yes, some boxes that you buy can be configured to obey or not  
obey all of RFC1812, depending on what functions are enabled.)

Lars

---

From: <[email-masked]>
Date: Fri, 27 Apr 2007 13:12:29 -0500

>> if they do NAT they cannot be called routers - even though that's 
>> exactly what everyone calls them.
>
>If the box in question does not fully implement RC1812, it _is 
>not_ a standards-compliant IP router.
>
>(And yes, some boxes that you buy can be configured to obey or 
>not obey all of RFC1812, depending on what functions are enabled.)

I agree. A few years ago, I bought a home 'router' with built in 
'firewall' functionality.  It turns out, there was no firewall,
just a NAT.  I guess the marketing department though 'firewall' was
more of a value add, than NAT.

I think in this working group, we should really follow standard
definations
of what a NAT, router (and firewall) are, not just what is listed as 
functionality on product literature.

John

---

From: Cullen Jennings <[email-masked]>
Date: Sat, 28 Apr 2007 21:16:40 -0700

> Perhaps we could focus back a bit.

+1

All jokes aside - the important thing is that we mean the same thing  
when we use a word. Luckily we seem to mostly agree what a NAT is and  
I will attempt to be more precise when I use the R word in this group  
in the future.

Cullen