Subject: RE: NATs *ARE* evil!

From: Dave Robinson <[email-masked]>
Date: Fri, 15 Dec 2000 12:11:29 -0500

What's the problem with locally significant addresses?  Having thousands of
10 networks will never present a problem unless those networks at some point
would like to talk to each other.  Is that where this whole discussion is
going (or coming from) - that ultimately the more NAT'ing we do, the more
headaches we're creating for ourselves en route to true global connectivity?

Dave

-----Original Message-----
From: Keith Moore [mailto:[email-masked]]
Sent: Friday, December 15, 2000 10:56 AM
To: Dave Robinson
Cc: Keith Moore; M Dev; Sean Doran; [email-masked]; [email-masked]
Subject: Re: NATs *ARE* evil! 

because in a NATted network the same addresses are used in different
parts of the network.  addresses are meaningless.

---

From: Keith Moore <[email-masked]>
Date: Fri, 15 Dec 2000 12:24:29 -0500

> would like to talk to each other.  

right.  if net 10 networks stay completely isolated from one another,
then there's no problem.  the problem only exists when people want to
tie those networks together. but it's inevitable that the vast majority 
of private networks *will* want to communicate with the public Internet
in ways that NAT does not facilitate.

> Is that where this whole discussion is

in a nutshell, yes.

Keith

---

From: [email-masked]
Date: Fri, 15 Dec 2000 12:54:40 -0500

> What's the problem with locally significant addresses?  Having thousands of

Hmm.. this from a guy posting from endtoend.com?  I'm not sure if the
right word is "ironic" or "sarcastic".  In any case, didn't we just
release an RFC detailing in excruciating detail?
-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 15 Dec 2000 11:55:13 -0600

Bingo!

RFC 2775, RFC 2993

  Brian

---

From: "Stephen Sprunk" <[email-masked]>
Date: Fri, 15 Dec 2000 13:35:13 -0600

Thus spake "Keith Moore" <[email-masked]>
> in ways that NAT does not facilitate.

In my experience, the addressing problem hasn't even been with people
trying to communicate across the Internet...  It's private corporate
connections.

Imagine there are n companies using 10/8.  Now, each of these n
companies wants to talk (privately) with the other n-1 companies.  Since
each company uses the same addresses, they must put a pair of NAT
devices facing each other at each boundary, resulting in 2n(n-1) NATs
(more for redundancy).  Also, since each company must see non-10/8
addresses for each of its n-1 peers, you will need locally-unique blocks
of address space for each NAT-NAT link.

Now, this address space can be private, requiring extensive coordination
between all n companies on who can use what where, or it can be public,
requiring n(n-1) blocks of space from ARIN/RIPE/APNIC.

When n was small, NAT was feasible.  At today's value for n, it is
conceivable that we may consume fewer address blocks without NAT.

> Keith

S

     |          |         Stephen Sprunk, K5SSS, CCIE #3723
    :|:        :|:        Network Design Consultant, GSOLE
   :|||:      :|||:       New office: RCDN2 in Richardson, TX
.:|||||||:..:|||||||:.    Email: [email-masked]