Subject: Re: Number of Firewall/NAT Users

From: "J. Noel Chiappa" <[email-masked]>
Date: Sat, 20 Jan 2001 18:14:56 -0500

> From: "Jim McMurry" <[email-masked]>

    > Then it seems we will have to create an ever expanding bandwidth to
    > support all the overhead associated with NAT and these multiple layers.
    > If not we could wind up with OC-192's that feel like 56k modems :(

I'm kind of confused. Perhaps you can enlighten me.

Exactly how does use of NAT use bandwidth? The packets are the same size, no?
I can't see how NAT has any effect on the effective throughput of the links
(which is the element you seem to be alluding to with your reference to
OC-192's).

It is true that a NAT box is a somewhat more complex switching device, but
depending on a large number of factors, including exactly which protocols it
supports, and how, along with the implementation technology used (people seem
to be happy to throw 100K's of transistors at switching boxes these days),
NAT may or may not have any effect on the throughput of the box.

Which is not to say I'm happy about the concept of nested NAT boxes, but let's
keep our analysis grounded in reality, eh?

	Noel

---

From: [email-masked] (Sean Doran)
Date: Tue, 23 Jan 2001 00:31:59 +0100 (CET)

Valdis Kletnieks writes:

| On Mon, 22 Jan 2001 23:53:30 +0100, Sean Doran said:
| > Nobody really constrains protocols from carrying a local IP address
| > around any more than anyone constrains from putting local addresses
| > into a text message.  It's just that communicating by naively replying
| > to such an embedded address is unlikely to work.
|
| The problem with NAT is the same problem as people who put locally usable
| addresses in their .signature files - the NAT *doesnt* fix those up when
| it becomes a non-local address BY VIRTUE OF PASSING THROUGH THE NAT.

Is it just me, or do these two message fragments have identical semantics?

If so, I'm having major trouble with the idea of constraining something
by letting it pass through in an un-rewritten form...

Maybe the problem here is that "protocols" is too large; I meant things
that ride around as a client of the IP network layer.

In any event, the solution is a standard representation of "who" that
is readily convertible into "where" in many different types of transport
networks.  IP addresses no longer qualify on that front, no matter what
your NAT politics are like.

	Sean.