Subject: Re: [nat66] Revision: Harmfulness Analysis of Address Translator Designs

From: Roger Marquis <[email-masked]>
Date: Thu, 16 Jul 2009 20:59:57 -0700 (PDT)

Christian Vogt wrote:
> I would like to notify you about a revision of the NAT design analysis
> that I had presented at the NAT66 BOF at IETF 74.  The revision
> addresses the feedback I had received, and adds the missing references
> to the document.
> http://tools.ietf.org/html/draft-vogt-address-translation-harmfulness
> Further comments are welcome.

In the Acknowledgment section you forgot to mention the ILECs who no doubt
sponsored this piece of rubbish.  Those would be the same ILECs who will
profit mightily from IPv4 address exhaustion, and who would like to also
profit from non-portable and non-private addresses.

Not to fear though.  There is zero chance NAT will be any less popular in
IPv6 than it is in IPv4.  This is because the market demands NAT.  That
market is defined by those of us whose lives are greatly simplified by NAT
i.e., about 95% of systems and network managers.  Some of us were network
managers before there was such a thing as NAT and you can bet we will not
allow that to happen again.  It will not happen because we will not
purchase services or products that do not support NAT.

Good the with your RFC, though I fear it will substantially limit your
employability should you be imprudent enough to list it on your resume.

Roger Marquis

---

From: Keith Moore <[email-masked]>
Date: Fri, 17 Jul 2009 06:08:27 -0400

reading this, it's hard to escape the impression that you are out to
make the IPv6 Internet as dysfunctional as the IPv4 Internet.

Roger Marquis wrote:
> _______________________________________________
> nat66 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nat66

---

From: "Wes Beebee (wbeebee)" <[email-masked]>
Date: Fri, 17 Jul 2009 10:30:04 -0400

While I agree that people will continue to use NAT even if we tell them
not to, just like some people will continue to smoke even when public
policy statements say that smoking is harmful, that does not mean that
we shouldn't say that it's harmful.  What's more productive than just
saying that it's harmful is to be specific about what causes the most
problems - and how to work around them - and I applaud this draft's
effort at doing that.  However, I think that a lot of the draft repeats
RFC 4864.  Therefore, I suggest the author look closely at RFC 4864,
refer to it, and describe how this draft updates RFC 4864 with more
recent information.  Also, I think that Margaret's NAT66 draft is a
specific embodiment of a sincere attempt to make a better NAT for IPv6.
So I think this draft should refer to that effort and describe what
Margaret got right and where her draft needs more work.

- Wes

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Roger Marquis
Sent: Friday, July 17, 2009 12:00 AM
To: [email-masked]
Subject: Re: [nat66] Revision: Harmfulness Analysis of Address
Translator Designs

> Further comments are welcome.

In the Acknowledgment section you forgot to mention the ILECs who no
doubt sponsored this piece of rubbish.  Those would be the same ILECs
who will profit mightily from IPv4 address exhaustion, and who would
like to also profit from non-portable and non-private addresses.

Not to fear though.  There is zero chance NAT will be any less popular
in
IPv6 than it is in IPv4.  This is because the market demands NAT.  That
market is defined by those of us whose lives are greatly simplified by
NAT i.e., about 95% of systems and network managers.  Some of us were
network managers before there was such a thing as NAT and you can bet we
will not allow that to happen again.  It will not happen because we will
not purchase services or products that do not support NAT.

Roger Marquis

---

From: "Joel M. Halpern" <[email-masked]>
Date: Fri, 17 Jul 2009 10:44:01 -0400

(I have removed Roger's text, and am responding to Wes' note.)

While the draft has some overlap with RFC 4864, I think it would be a 
distraction to the community, and a distraction from the purpose of the 
draft, to get into an extended discussion of the pros and cons of RFC 
4864.  This draft does not so much update RFC 4864 as look at the issue 
from a somewhat different angle, although with similarities.

While this draft could be input to any discussion of updating Margaret's 
NAT66 draft (if such an update is needed), I would not expect to see 
such a focussed discussion here, as I understand the author's purpose.

Yours,
Joel

---

From: Roger Marquis <[email-masked]>
Date: Fri, 17 Jul 2009 07:57:42 -0700 (PDT)

Wes Beebee (wbeebee) wrote:
> not to, just like some people will continue to smoke
> make the IPv6 Internet as dysfunctional as the IPv4 Internet.

Instead of empty rhetoric I would recommend that any critique of NAT,
positive or negative, address all of the reasons why it has become so
popular.  Analyses failing this simple test, or using derogatory terms such
as "dysfunctional", or making purely rhetorical comparisons such as with
smoking, are somewhat transparent in their bias and should continue to be
considered faulty.

Some of those valid reasons why NAT is and will continue to be pervasive
are:

   #1 NAT advantage: it protects consumers from vendor lock-in.

Consider the advantage of globally unique public addressing to ISPs and
telcos.  Without NAT they have a very effective vendor lock-in.  Want to
change ISPs?  It's only as easy as reconfiguring every device and/or DHCP
server on your internal network.  With NAT you only need to reconfigure a
single device, sometimes not even that.

   #2  NAT advantage: it protects consumers from add-on fees for addresses
   space.

Given the 100 to 10,000% mark-ups many telcos and ISPs already charge for
more than a /29 it should come as no surprise they would be opposed to NAT.

   #3  NAT advantage: it prevents upstreams from limiting consumers'
   internal address space.

Even after full implementation of IPv6 the trend of technology will
continue to require more address space.  Businesses will continue to grow
and households will continue to acquire new IP-enabled devices.  Without
NAT consumers will be forced to request new netblocks from their upstream,
often resulting in non-contiguous networks. Not surprisingly, often
incurring additional fees as well.

Follow the money and you'll end up with these three reasons why the
technical arguments being made against NAT in opinion pieces like Keith
Moore's (URL above) are so one sided and overtly biased.  But there are
still more reasons NAT will continue to increase in popularity regardless
of IPv6.

   #4  NAT advantage: it requires new protocols to adhere to the ISO seven
   layer model.

H.323, SIP and other badly designed protocols imbed the local address in
the data portion of IP packets.  This trend is somewhat discouraged by the
layer-isolation requirements of NAT.

   #5  NAT advantage: it does not require replacement security measures to
   protect against netscans, portscans, broadcasts (particularly microsoft's
   netbios), and other malicious inbound traffic.

The vendors of non-NAT devices would love to have you believe that their
stateful inspection and filtering is a good substitute for the inspection
and filtering required by NAT devices. Problem is the non-NAT devices all
cost more, many are less secure in their default configurations, and the
larger rulesets they are almost always configured with are less security
than the equivalent NAT device.

To be continued.

--
Roger Marquis

---

From: Keith Moore <[email-masked]>
Date: Fri, 17 Jul 2009 11:30:16 -0400

Roger Marquis wrote:
> popular. 

Perhaps one of the reasons why it's popular is that there are far too
many network administrators in the world who believe that the network
exists for _their_ convenience, or allow users to run only the
applications that the network administrators want them to run.  They
prefer having crippled networks because it makes their jobs easier.

---

From: Christian Vogt <[email-masked]>
Date: Mon, 20 Jul 2009 14:15:02 -0700

Wes -

Thank you for the positive feedback.  While I agree with Joel that
digressions of the document should be avoided, I do think the related
work you are mentioning should be cited in the document.  I will tackle
this with the next document revision.

- Christian

---

From: Christian Vogt <[email-masked]>
Date: Mon, 20 Jul 2009 14:15:37 -0700

> prefer having crippled networks because it makes their jobs easier.

It is good that we are having this discussion.  It is clear that NAT'ing
has significant disadvantages.  But it also seems inevitable that
NAT'ing will be used nonetheless, even in IPv6.

The intent of my analysis is to minimize the harmful impact of such use,
by providing guidance on how to implement NAT in IPv6.  The intent is
neither to promote nor to discourage the use of NAT, since I believe
that either would be in vain anyway.

- Christian