Subject: RE: [NSIS] review of the "NAT/Firewall NSISSignaling Layer Protocol(NSLP) "

From: "Pashalidis, Andreas" <[email-masked]>
Date: Mon, 19 Jun 2006 11:04:33 +0200

Dear all,

This is to give a short answer to Dan Wing's comment below.

-----Original Message-----
From: Dan Wing [mailto:[email-masked]] 
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: [NSIS] review of the "NAT/Firewall NSISSignaling Layer
Protocol(NSLP) "

> I read through parts of draft-ietf-nsis-ntlp-09.txt to understand 
> how NATs are handled in NTLP.  In that document's section 7.2,
> "NAT Traversal", it says:

>    5.  Add a NAT-Traversal payload, listing the objects which have
been
>       modified and including the unmodified MRI and any other data
>       needed to interpret the response.  (If a NAT-Traversal object is
>       already present, in the case of a sequence of NATs, the list of
>       modified objects may be updated and further opaque data added,
>       but the MRI contained in it is left unchanged.)

> which sounds like you would be disclosing my 'private' IP address on
the
> public side of an NSIS-aware NAT.  I believe I'm misinterpreting that,
as in
> -ietf-nsis-nslp-natfw- I found text that alluded to avoiding such
> information leakage by having the outer-most NAT or firewall
configured to
> know that it is the outer-most NAT (or firewall) and to terminate REA
> processing.

In the draft
http://www.ietf.org/internet-drafts/draft-pashalidis-nsis-gimps-nattrave
rsal-02.txt
(which discusses NAT traversal for GIST in detail), two different "modes
of operation" for GIST-aware
NATs are described (see sections 5 and 6 respectively).
The mode of operation described in section 5 does not suffer from
"private address disclosure" on the public side.

Best Regards,
Andreas Pashalidis

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis