Subject: [BEHAVE] Whether or not need to distinguish the primary and the backup NAT boxes?

From: xuxiaohu 41208 <[email-masked]>
Date: Thu, 25 Mar 2010 15:04:03 -0700

Hi all,

I will try to answner a comment raised by somebody during my presentation.

If you only consider the hot standby mode, yes, it's not neccessary to distinguish them. However, as for the cold standby mode, it's not true. Keep in mind they are stateful NATs, rather than stateless NATs.

Best wish,
Xiaohu

---

From: Shin Miyakawa <[email-masked]>
Date: Fri, 26 Mar 2010 07:46:08 +0900 (JST)

Xiaohu,

> I will try to answner a comment raised by somebody during my presentation.

OK. I am the somebody :-) 

Thanks for your answer.
Let me clarify my comment too.

> If you only consider the hot standby mode, yes, it's not neccessary to distinguish them. However, as for the cold standby mode, it's not true. Keep in mind they are stateful NATs, rather than state…

"Cold Stanby" means that, once one NAT fails, the other one will be 
activated after that, but by definition of "Cold Stanby" it takes time.
This means some packets and even NAT translation status could be lost.
If NAT tranlation status losts, sessions passing through the BOX should
be re-started. This means lots of customers could be frastrated,
especially if they're using VPN or any applications which are running
on some kind of "persistent" TCP or so.

Then, Cold Stanby may not be a good enough HA scheme for operators 
aiming at high quality service.

Of course, we know that many portion of our traffic is HTTP which uses
usually short life time TCP session per HTTP message then it would work
with cold stanby. But please note well that people who uses VPN are
most likely people who will call our service center to make a claim.

So, we'd like to use STATUFULL NATs working parallelly with
fast enough synchronization between boxes bi-directional 
(even we could not say this is hot "standby" because multiple boxes
running equally) as the ideal solution for us, 
as long as the business model allows us to use it.

In addition to this technical discussion, 
some NAT444 vendors have already succeeded to implement this feature
and delivered to us to be evaluated in our actual environment.

Frankly speaking, still we do not know if this make sense from business 
model point of view, because NAT444 is usually expensive today
(Yeah, without HA, it could be lower price and it make sense maybe).

So, please do not think that the case you're thinking is the "standard" 
situation. I'd like to point out that the situation would be more
complexed or complicated.

Thanks,

Shin Miyakawa, Ph.D
Director, Core Network Technology Team, Network Systems and Technologies, 
Innovative IP Architecture Center /
Corporate Planning Department (concurrent position)
NTT Communications Corporation

---

From: xuxiaohu 41208 <[email-masked]>
Date: Thu, 25 Mar 2010 19:17:30 -0700

Hi Shin,

----- 原邮件 -----
发件人: Shin Miyakawa <[email-masked]>
日期: 星期四, 三月 25日, 2010 下午3:46
主题: Re: [BEHAVE] Whether or not need to distinguish the primary and the backup NAT boxes?
收件人: [email-masked]
抄送: [email-masked]

> OK. I am the somebody :-) 

The somebody in my mind means some important person. Anyway I should have confirmed your name.

> > If you only consider the hot standby mode, yes, it's not 
> neccessary to distinguish them. However, as for the cold standby 
> mode, it's not true. Keep in mind they are stateful NATs, rather 
> than stateless NATs.
> 
> activated after that, but by definition of "Cold Stanby" it takes 
> time.This means some packets and even NAT translation status could 
> be lost.
> If NAT tranlation status losts, sessions passing through the BOX 
> shouldbe re-started. This means lots of customers could be frastrated,

Good point. I fully agree.

> usually short life time TCP session per HTTP message then it would 
> workwith cold stanby. But please note well that people who uses 
> VPN are

Yes, different ISPs have different requirements/tastes. That's the reason why we defined two modes of redundancy.

> as long as the business model allows us to use it.

Yes, the administrators can use them in that way. However, IMHO, it is still better to assure the traffic of a given session traverse the identical NAT box in normal case.

> complexed or complicated.

Agree. Thanks a lot for your valuable comments.

Best regards,
Xiaohu

> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/behave
>

---

From: Shin Miyakawa <[email-masked]>
Date: Fri, 26 Mar 2010 17:39:47 +0900 (JST)

Xuxiaohu,

> Yes, the administrators can use them in that way. However, IMHO, it is still better to assure the traffic of a given session traverse the identical NAT box in normal case.

Usually one ISP network is big enough to have mutiple EBGP routers to have
redundancy, then, packets go through a box A and their responses
return through the box B other than A.

So that's the reason why I said at the mic that it depends on the network design.

Also, I think that "Cold Stand-by" means that the stand-by box is just 
"sleeping" usually. Even if you think "normal case" is for small size of 
Enterprise or so, it sounds like waste of investiment.
We should be noticed that "running parallelly" often means "load balancing" too.

Best wishes,

Shin Miyakawa

---

From: xuxiaohu 41208 <[email-masked]>
Date: Fri, 26 Mar 2010 02:14:44 -0700

<skiped>

> > most likely people who will call our service center to make a claim.

Your observation is correct. What level of HA is enough heavily depends on how important the services are. I believe the HA requirement for CGN is absolutely different from that for ordinary NAT which is used by enterprises.

> > (Yeah, without HA, it could be lower price and it make sense maybe).

Oh, yes, the cost is the another consideration. If the Internet access fee is still much high today, I think the multi-homing will not become so popular that it becomes one of the major factor for the routing table scalability issue. CIDR is not useful anymore to deal with this case. 

Initially, a single NAT as exit is enough, later, the dual NAT (w/o state sync)usage becomes a popular choice, and now, some ISPs even require state synchronization among a group of NATs (from a single vendor), then what about the case of tomorrow?

By the way, I have even heard that some companies have such a regulation as the employees of VP level or above are not permitted to take the identical flight... 

Best regards,
Xiaohu

<skiped>

---

From: xuxiaohu 41208 <[email-masked]>
Date: Fri, 26 Mar 2010 02:30:19 -0700

Hi Shin,

----- 原邮件 -----
发件人: Shin Miyakawa <[email-masked]>
日期: 星期五, 三月 26日, 2010 上午1:40
主题: Re: [BEHAVE] Whether or not need to distinguish the primary and the backup NAT boxes?
收件人: [email-masked]
抄送: [email-masked]

> Xuxiaohu,
> 
> > Yes, the administrators can use them in that way. However, IMHO, 
> it is still better to assure the traffic of a given session 
> traverse the identical NAT box in normal case.
> 

Symmetric path usage is beneficial in some cases, e.g., traffic monitoring.

> "sleeping" usually. Even if you think "normal case" is for small 

No, the standby box is not sleeping, you can deploy redundancy and load-balancing together, just like what VRRP does for multiple VRRP groups. For more details, please see the load-balancing section of draft-xu-behave-stateful-nat-standby.

BR,
Xiaohu

> size of

---

From: Shin Miyakawa <[email-masked]>
Date: Sat, 27 Mar 2010 01:44:50 +0900 (JST)

Xuxiaohu,

> Symmetric path usage is beneficial in some cases, e.g., traffic monitoring.

My text was bat enough to be misread . Sorry. Following the right text, I think.

 Usually one ISP network is big enough to have mutiple EBGP routers to have
 redundancy, then, packets MAY go through a box A and their responses
 return through the box B other than A.

Even if an ISP A thinks symetric way, but if other peering ISPs B,C and D 
may use different path to send returning packets towards A.
Only the god of BGP knows fate of packets.

Shin Miyakawa

---

From: Shin Miyakawa <[email-masked]>
Date: Sat, 27 Mar 2010 02:52:35 +0900 (JST)

Xuxiaohu,

>> Usually one ISP network is big enough to have mutiple EBGP 
>> routers to have redundancy, then, packets MAY go through 
>> a box A and their responses return through the box B other than A.
>> 
>> Even if an ISP A thinks symetric way, but if other peering ISPs 
> 
> If ISP A wants that, it can achieve that by configuring different external address pool w/o address overlapping on different NAT boxes. 

OK. I think this is true and I think I got your point, thanks.

Shin

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Sat, 27 Mar 2010 07:12:36 -0700

Asymmetric routing with NAT or any stateful feature presents a new set of issues. There are some techniques like making sure the 
packets belonging to the same flows are routed back to the same NAT device and spliting the address pool are possible,  there are requirements to make the asymettric routing work through NAT boxes. It is a solvable issue to make this work but has its own implications.

Senthil

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Shin Miyakawa
Sent: Friday, March 26, 2010 1:53 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [BEHAVE] 回复:Re: Whether or not need to distinguish the primary and the backup NAT boxes?

Xuxiaohu,

>> Usually one ISP network is big enough to have mutiple EBGP routers to 
>> have redundancy, then, packets MAY go through a box A and their 
>> responses return through the box B other than A.
>> 

Shin