Subject: RE: FW: Why?

From: "Michel Py" <[email-masked]>
Date: Fri, 11 Mar 2005 09:47:52 -0800

> Ralph Droms wrote:
> Would someone with first-hand knowledge of the reasons "several
> major corporations publicly indicate that they intend to use NAT
> with IPv6" be willing to compare those reasons with the reasons
> listed in draft-vandevelde-v6ops-nap-01, and identify any reasons
> that might be missing from Gunter's document? Might be useful to
> consider extending draft-vandevelde-v6ops-nap-01 to address all
> the known reasons for IPv6 NAT.

I'm not into this anymore, but two of the reasons are:

1. Significant numbers of enterprise network operators do not want
multiple addresses per host. It makes everything more complex: access
control, troubleshooting, internal firewalling, documentation, etc. And
during the transition, it also creates a network with two different
models. NATting at the edge instead is not a free lunch, but it is
well-known and maintains a single-model, simpler network. Stateful
firewalls capable of dealing with multi-address hosts that change IP
addresses on the fly will be a significant challenge.

2. Renumbering. There are enough people that have renumbered on a flag
day that will tell why they won't do it again, and renumbering without a
flag day is a huge amount of work, which is why organizations that had
to renumber moved behind NAT, with a sentence that I heard many times:
"I don't want to go through this <bleep> again".

It is my guess that on networks that deploy IPv6 ULAs will be successful
as the unique host address on the inside, and be NATted if they can't be
routed. IPv6 NAT is easier than IPv4 NAT (no ambiguity); I don't see how
you could prevent its deployment, it won't take long to port v4 NAT
helpers to v6 as soon as there is market demand.

Michel.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 11 Mar 2005 12:53:40 -0500

In message <[email-masked]
>addresses on the fly will be a significant challenge.

Actually, NATting at the edge is a disaster for a lot of those reasons, 
because of the difficulty it causes when you receive external trouble 
reports -- who caused it?

		--Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb

---

From: Keith Moore <[email-masked]>
Date: Fri, 11 Mar 2005 23:39:40 -0500

Bingo.

Perhaps we should hold ourselves to our own standards for standards, 
which include "no known technical omissions" for Proposed standards and 
above.  These are two serious technical omissions with IPv6.  They are 
not solved, even though IPv6 is now at Draft.

What we should do in the long term is remedy these problems in the IPv6 
architecture.

In the near term, we should recommend more liberal address assignment 
policies so that multiple prefixes and renumbering are not needed until 
such time as we have demonstrated technology that allows a wide 
diversity of applications and networks can handle them seamlessly.  
Yes, we're working on such technologies, but the bottom line is we 
don't even know how we're going to solve those problems yet, much less 
ready to ship running code.

The market is often shortsighted, but in this case it's right.  People 
aren't adopting IPv6 in large numbers in part because there are still 
some kinks that need to be worked out.

-Keith

> models.