Subject: RE: [Speermint] Reachability

From: "Khan, Sohel Q [CTO]" <[email-masked]>
Date: Tue, 4 Apr 2006 11:20:01 -0500

I think, phone numbers whether it is (***)-***-**** format or an e-mail
format is publicly reachable.
However, provider's networks are private. It is for security and
regulations.
To make end-users publicly reachable at least one network entity  of a
provider may have a public address. 
These public network entity most probably is the peering interface with
others. 
It may look like this:

  Acore peer interface|<-----public---->|Bcore peer interface

But, there need to have something like this also:
Acore peer interface|<----private---->|Bcore peer interface

Although, you can say why IETF should work on this? 
Please understand that implementations may be almost the same and in
both cases providers will use IETF RFCs.

Question is how the second case users will be reachable by public?
Here is how:

Acore peer interface|<----private---->|Bcore peer
interface|<----public---->|Ccore peer interface

I hope, it makes sense..

-----Original Message-----
From: Stastny Richard [mailto:[email-masked]] 
Sent: Tuesday, April 04, 2006 11:06 AM
To: Khan, Sohel Q [CTO]; Patrick Melampy; Reinaldo Penno; Hadriel
Kaplan; [email-masked]
Subject: RE: [Speermint] Reachability

Sohel,
 
I think we are slowly converging here ;-)
 
but I think we have still to clarify some issues:
 
In the SIP trapezoid (if we forget for a moment "transit" peers) we have
O-UA - O-Core proxy - T-Core proxy - T-UA
 
>From the point of the O-Core the T-Core has always to be public and 
>before
the NAT, or do you mean the in first Ingress proxy can also be behind a
NAT?
(there may be others behind the NAT)
 
The T-UA may of course be behind the NAT (with a binding)
 
Richard

________________________________

Von: Khan, Sohel Q [CTO] [mailto:[email-masked]]
Gesendet: Di 04.04.2006 17:17
An: Patrick Melampy; Reinaldo Penno; Hadriel Kaplan; [email-masked]
Betreff: RE: [Speermint] Reachability

If you ar saying that  "every endpoint and every serving proxy/registrar
needs to be publicly addressable through the "public NAT binding"', then
it is okay.

-----Original Message-----
From: Patrick Melampy [mailto:[email-masked]]
Sent: Tuesday, April 04, 2006 8:29 AM
To: 'Reinaldo Penno'; 'Hadriel Kaplan'; [email-masked]
Subject: RE: [Speermint] Reachability

Reinaldo -- I agree with your assertions.

But I want to ensure everybody understands what your really saying here.

  Before somebody mentions it...for a UA behind a NAT to be reachable,
  he/she needs a public NAT binding so that a session _initiated_ from
the
  public side can be made to him/her.

This means that for carrier to carrier peering models, each and every
customer of every carrier that wants to inter-connect needs to have a
'public NAT binding'.

I believe by extension, this means that a serving proxy/registrar for
the target of a communication must ALSO have either a public address or
a public NAT binding.

The conclusion here -- every endpoint and every serving proxy/registrar
needs to be publicly addressable.

Am I correct?
-----Original Message-----
From: Reinaldo Penno [mailto:[email-masked]]
Sent: Tuesday, April 04, 2006 5:29 AM
To: Hadriel Kaplan; [email-masked]
Subject: RE: [Speermint] Reachability

Hello Hadriel,

Comment inline....

> -----Original Message-----
> From: Hadriel Kaplan [mailto:[email-masked]]
> Sent: Monday, April 03, 2006 11:01 PM
> To: Reinaldo Penno; [email-masked]
> Subject: RE: [Speermint] Reachability
>
> Hi Reinaldo,
> Comments inline...
>
> > -----Original Message-----
> > From: Reinaldo Penno [mailto:[email-masked]]
> >
> > Maybe I'm missing something, but given that this workgroup is
interested
> > only in call routing (E.164 is out of scope), do we really need to
care
> > about that? An AoR in the end will be translated to an IP address,
and
> > IP addresses have a very good definition of public and private (in
IPv4
> > and IPv6).
>
> I don't understand fully what you mean.  An AoR is only fully
"translated"
> to an IP Address (and really to a contact URI) by the AoR's domain.
So
> what
> you're saying is if the AoR's user-part represents a consumer behind a

> home NAT (a private IP), then it is a private AoR; but for those 
> consumers
who
> don't use home-NATs then it's a public AoR?
[[Reinaldo]]

Hello,

Actually I'm trying to understand the whole purpose of the discussion,
that's why I gave that example. I was trying to understand why it
matters, before getting knee deep into the classification. Can someone
refresh that for me?

So, if SIP peering is going to get woven into the fabric of the
internet, the rules for domains names, DNS resolution, private vs.
public IP address, etc should apply, right?

I believe the current model of host to host or email communication is
not different for SIP. We could have the following main
situations...(correct me where I'm wrong).

1) The AoR (just like a traditional domain name or email), in the end
will get resolved into an IP address. Then there are only two
situations.

   a) the IP address is private (RFC 1918).

   This means the SIP endpoint is unreachable unless you are also in the
same private network. Actually I believe a private IP address cannot
even be provisioned in a public DNS.

   Before somebody mentions it...for a UA behind a NAT to be reachable,
he/she needs a public NAT binding so that a session _initiated_ from the
public side can be made to him/her.

   b) the IP address is public.

   The SIP endpoint is theoretically reachable.

2) The AoR cannot get translated. Again, just like the Internet we have
today, this means the domain name/user is private, does not exist, etc

All this has been happening okay with just a few basic rules. If an AoR
is very similar to an email address, why it would not work with the
current infrastructure/definitions?

If somebody says that they have a "private" email address or domain
name, what is your interpretation of that?

Regards,

Reinaldo

 And if the AoR gets
> translated
> into an IP by a registrar inside a private IP subnet, and somehow it
later
> gets translated into the public IP address space, that's also private 
> because the AoR was translated to a private IP originally?
>
> Or maybe you mean what the domain part of the AoR resolves to?
>
> > For you to be "SIP reachable", you need to be IP reachable first,
let's
> > not forget about that. And if you are IP reachable, you could 
> > potentially be SIP reachable by registering to some free SIP service
(or
> > the SIP "domain" above you in the hierarchy...if this was the
email/DNS
> > model).
>
> Actually, to be very specific ultimate target of the AoR can be "sip 
> reachable" but not IP reachable.  But I think for now we should ignore
the
> implications of that, unless it becomes a problem.
>
> -hadriel

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint