Subject: RE: [mobile-ip] I-D ACTION:draft-shahrier-mobileip-nat-00.txt

From: "Shahrier, Sharif M." <[email-masked]>
Date: Mon, 18 Jun 2001 15:12:19 -0400

Mingguey,

Sharif,

Thank you for clarifying the term.
So, it is indeed one of the globally unique IP addresses reserved by the NAT
for
address translation.

Would you please also clarify my another confusion?
With the nat-binding-update message (sent from the MN to the NAT) and
mobile-location-solicitation message (sent from the CN to the
mobile-database),
you obviously assume that both CN and MN are aware of that the MN is a
private
node. But this is against the principle of using NAT.

Before the MN sends out its first packet, a binding has estabished between
the local address and
the global address of the NAT.  If the MN moves during the session, a new
binding must be established,
so that correct mapping can be performed by the NAT. I made the assumption
in my model, that once a binding is set up, the session must continue to use
the same global address for the duration of that session.
Thus, "nat-binding-update"  must be sent to th NAT to configure a new
binding.
The "mobile-location-solicitation" is sent to the mobile-database to
ascertain whether the MN is currently at 
its local network or in a foreign network, so that:

(1) The CN can set up a binding in its NAT  to receive packets from MN.
(2) Packets can be sent directly to MN without any "triangle  routing"
action neccessary.

As stated in RFC 3022, NAT is a method by which IP addresses are mapped from
one
group to another, transparent to end users. That is, both the CN and MN have
no
idea of the existence of the NAT. The NAT translates the MN's private
address to
a global address (i.e., NAT-translated address) in all the outgoing IP
packets
from the MN, and vice versa for the IP packets in the reverse flow. 

Yes, that is true. I will needto make  a minor modification to conform with
this. When the MN sends a 
"dbase-binding-update", the mobile-database will in turn send the
"nat-binding-update" to the NAT.
This way the MN will never need to be aware of the NAT and any address
mappings that it may employ.
I will send a -01.txt update.

The CN only
sees the MN as a public node because the NAT-translated global address is
shown
in the source address field of all the packets from the MN. The MN never
realizes that its private address has been mapped to a global address and
the CN
can only recognize it by its NAT-translated global address. Most
importantly,
the MN has no idea of the existence of the global address. Otherwise, the MN
should have used it instead of its private address to communicate with the
CN in
the first place.

I find a solution using a "NAT-translated global address" a little
problametic. This is because
every node within the private network that sends to the CN would use the
same global address, which will
make it difficult for the CN to determine the identity of the sender (assume
that we're using Basic-NAT, not NATP).
Thus I felt as one option that the CN shoul know about the local address of
the MN aslo using "mobile-location-solicitation"
allowing it to set up a binding of the <global,local> address of the MN.
Thus, knowing the <global,local> address binding, 
the CN's NAT can do the resverse mapping of the global -> local address of
MN, allowing CN to itentify the MN precisely 
(because both global address and local address of MN is known).

Thanks.

-Sharif
Would you plase explain this confliction?
Thanks.

Mingguey

"Shahrier, Sharif M." wrote:

> The meaning of term "Global IP Address of NAT" is:
>
> (1) It is an address from the registered public address space.
> (2) It is statically assigned to the NAT as a global address for
> communication over the backbone.
>
> Sharif
>
> -----Original Message-----
> From: Mingguey M. Yang [mailto:[email-masked]]
> Sent: Friday, June 15, 2001 12:04 PM
> To: [email-masked]
> Subject: Re: [mobile-ip] I-D ACTION:draft-shahrier-mobileip-nat-00.txt
>
> Sharif,
>
> I just want to clarify what the "Global IP Address of NAT" means in the
> format
> of a binding of NAT.
> Is it the registered IP address of the NAT-enabled router itself or one of
> the
> globally unique IP addresses reserved by the NAT located in the router?
> Would you please identify which one it stands for?
>
> Mingguey
>
> "Shahrier, Sharif M." wrote:
>
> > Mingguey,
> >
> >         I don't see the distinction between the two cases, since both
> cases
> > would statically assign a few global addresses
> > to the NAT-box, for mapping and transfer over the public backbone. Are
you
> > saying that in the second case the global IP addresses are NOT
statically
> > assigned?
> >
> > Sharif
> >
> > -----Original Message-----
> > From: Mingguey M. Yang [mailto:[email-masked]]
> > Sent: Friday, June 15, 2001 10:48 AM
> > To: [email-masked]
> > Subject: Re: [mobile-ip] I-D ACTION:draft-shahrier-mobileip-nat-00.txt
> >
> > Sharif,
> >
> > Then you mean that the format of a binding in the NAT should be (A
Global
> IP
> > Address Reserved by NAT, Local IP
> > Address) instead of (Global IP Address of NAT, Local IP Address), right?
> >
> > Mingguey
> >
> > "Shahrier, Sharif M." wrote:
> >
> > > Mingguey,
> > >
> > >         If you look at RFC 3022, it describes a "traditional NAT",
where
> > > only registered IP addresses are used in the translation, not port
> > numbers.
> > > That is the model that my proposal is based on. However, it can be
> > extended
> > > to NAPT as well.
> > >
> > > Sharif.
> > >
> > > -----Original Message-----
> > > From: Mingguey M. Yang [mailto:[email-masked]]
> > > Sent: Thursday, June 14, 2001 4:38 PM
> > > To: [email-masked]
> > > Subject: Re: [mobile-ip] I-D ACTION:draft-shahrier-mobileip-nat-00.txt
> > >
> > > Sharif,
> > >
> > > In your proposed architecture, Basic Static NAT-routers are used. This
> > means
> > > that a set of globally unique IP addresses (i.e., a set of registered
> > > addresses) is reserved by each NAT device (located in a NAT-enabled
> > router)
> > > just for the purpose of  for address translation, i.e., mapping the
> > private
> > > address of each local private node that wants to communicate with an
> > > external
> > > node (i.e., CN) to one of the reserved global addresses. This is an
> > > one-to-one
> > > mapping within not only the NAT table but also the entire private
> network.
> > >
> > > Your proposal says that the format of a binding in the NAT is (Global
IP
> > > Address of NAT, Local IP Address). Is the "Global IP Address of NAT"
the
> > > registered IP address of the NAT-enabled router itself or one of the
> > > globally
> > > unique IP addresses reserved by the NAT located in the router? If it
is
> > the
> > > former, then NAPT is used (instead of basic static NAT), where port
> > numbers
> > > are
> > > involved in the address translation. If it is the later, then the
format
> > of
> > > a
> > > binding in the NAT should be (A Global IP Address Reserved by NAT,
Local
> > IP
> > > Address).
> > >
> > > Mingguey
> > >
> > > "Shahrier, Sharif M." wrote:
> > >
> > > > The binding is one global address to one private address for a given
> > > > session.
> > > >
> > > > -----Original Message-----
> > > > From: Mingguey M. Yang [mailto:[email-masked]]
> > > > Sent: Thursday, June 14, 2001 3:18 PM
> > > > To: [email-masked]
> > > > Subject: Re: [mobile-ip] I-D
ACTION:draft-shahrier-mobileip-nat-00.txt
> > > >
> > > > Sharif,
> > > >
> > > > In the "System Architecture" section:
> > > >    ...
> > > >    The NAT tables have to be set up, to reflect the correct binding
> > > >    between the global address of NAT-A and the local address of the
> > > >    sender in A...
> > > >
> > > > Is the binding of one global address to one private address mapping?
> Or
> > > one
> > > > global
> > > > address to many private addresses mapping?
> > > >
> > > > Mingguey

---

From: "jshukla" <[email-masked]>
Date: Tue, 19 Jun 2001 09:43:02 -0700

We have a ID on making IPSec compatible with NATs
and it is very similar to this draft. However, there are
some important differences that are explained inline.

----- Original Message -----
From: "Shahrier, Sharif M." <[email-masked]>
> Thus, "nat-binding-update"  must be sent to th NAT to configure a new

As mentioned in Section 2 of your draft, the NAT-B must be able
to reverse the effect of NAT-A to obtain the local address of MH.
However, you have not described this mechanism. We describe
this mechanism in our draft on NAT and IPSec compatibility.
Our proposed method works with NAPT as well. You can take a
look at our draft. The new version will come out in a month.

http://search.ietf.org/internet-drafts/draft-shukla-ipsec-nat-qos-compatible
-security-00.txt

I am very happy to see that someone else also realized that
NAT can be used to provide mobility. A great advantage of
this approach is that the security protocol can also provides
mobility.

regards,
Jayant