Subject: RE: [Ietf-behave] DNS ALG, REQ-9

From: "Kaushik Biswas (kbiswas)" <[email-masked]>
Date: Wed, 17 Aug 2005 18:02:56 -0700 (PDT)

It was an outcome of the IETF 62 (Minneapolis) discussions whereby it
was felt that FTP & DNS ALGs turning off won't be acceptable. 

BTW IMO behave-udp draft shouldn't be talking about FTP in the first
place. If we are talking about FTP in behave-udp draft then we should
also putting a cross reference to
draft-sivakumar-behave-nat-tcp-req-01's Sections: 4.2 & 4.3.

Thanks,
Kaushik

> -----Original Message-----
> From: ietf-behave-bounces@xxxxxxxxxxxxxxxxxxx 
> [mailto:ietf-behave-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of 
> Francois Audet
> Sent: Tuesday, August 16, 2005 9:11 AM
> To: Dan Wing (dwing); ietf-behave@xxxxxxxxxxxxxxxxxxx
> Subject: RE: [Ietf-behave] DNS ALG, REQ-9
> 
> I don't remember why we put DNS in there.
> 
> Srisuresh, was it you that requested it?
> 
> PS: I will add the reference to 7.1/RFC 2663 for FTP ALG.
> 
> 
> 
> 
> > -----Original Message-----
> > From: ietf-behave-bounces@xxxxxxxxxxxxxxxxxxx
> > [mailto:ietf-behave-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf 
> Of Dan Wing
> > Sent: Monday, August 15, 2005 18:41
> > To: ietf-behave@xxxxxxxxxxxxxxxxxxx
> > Subject: [Ietf-behave] DNS ALG, REQ-9
> > 
> > 
> > -ietf-behave-nat-udp-03 reads:
> > 
> >    REQ-9: If a NAT includes ALGs, it is RECOMMENDED that 
> all of those
> >       ALGs (except for DNS [19] and FTP [18]) be disabled 
> by default.
> > 
> > This implies the converse -- that a DNS ALG SHOULD be enabled.  Is 
> > that the intention of your text?
> > 
> > I understand the FTP ALG, it's well described in section 7.1 of 
> > RFC2663. However, I don't understand what the DNS ALG is 
> supposed to 
> > do especially in a Dlink/Netgear/Linksys-class device; 
> section 4.3 of 
> > RFC2663 implies it would only be necessary if you're doing 
> "twice NAT" 
> > (see RFC2663 for
> > details) and only during pure NAT (that is, not doing port address 
> > translation).
> > 
> > I would like a better explanation of the intended function 
> of the DNS 
> > ALG in -ietf-behave-nat-udp-, or a cite to a specific 
> section and RFC.  
> > I'm concerned the existing text might cause proliferation of 
> > DNSSEC-breaking DNS ALG functions in seldom-upgraded consumer NATs.
> > 
> > -d
> > _______________________________________________
> > Ietf-behave mailing list
> > Ietf-behave@xxxxxxxxxxxxxxxxxxx
> > https://list.sipfoundry.org/mailman/listinfo/ietf-behave
> > 
> > 
> _______________________________________________
> Ietf-behave mailing list
> Ietf-behave@xxxxxxxxxxxxxxxxxxx
> https://list.sipfoundry.org/mailman/listinfo/ietf-behave
>

---

From: "Dan Wing" <[email-masked]>
Date: Wed, 17 Aug 2005 18:39:35 -0700 (PDT)

> was felt that FTP & DNS ALGs turning off won't be acceptable. 

Umkay.  But the basis for that decision seems to have been lost to
history.

I want additional text added to the document explaining what a DNS ALG
is supposed to do, and not supposed to do.  As it is, the BEHAVE 
document doesn't cite what behavior it's recommending a DNS ALG to
perform.  I am questioning the need for a DNS ALG at all considering
that I can't find that the major consumer-grade NAT manufacturers don't
seem to include it as a feature (I checked Linksys, D-Link, and 
Netgear).  It seems only useful if you're doing NAT in the truest
sense of NAT -- that is, you're only rewriting IP addresses and you're
not rewriting ports and not overloading ports (NAPT).

> draft-sivakumar-behave-nat-tcp-req-01's Sections: 4.2 & 4.3.

Good point - the UDP document shouldn't talk about an FTP ALG.

-d