Subject: RE: [Ietf-behave] comments on draft-ietf-behave-nat-udp-01

From: "Francois Audet" <[email-masked]>
Date: Thu, 26 May 2005 09:39:39 -0700 (PDT)

> Yes
> 
> 1) It is perceived as less secure than their competitors.
> 
> 
> I understand you don't believe the first, but they do. I 
> brought up the point but what if people want to run servers 
> and the response what a feeling that folks that want to run a 
> server behind a NAT are generally competent enough to go and 
> statically forward a port on the NAT to that server. Here 
> they more or less end up defining a server as something only 
> someone who could forward a port would run. This is a totally 
> circular definition of a server and void of any logic but 
> welcome to my world.

For what it's worth, I've seen exactly the same as what Cullent is
saying for the NAT manufacturers I talked to.

They viewed "Address/Port restricted Cone NATs" as "Just as secure as
Symmetric NATs" but they actually work for VoIP. 

Getting them to do "Address restricted" already takes a lot of convincing
to do.

---

From: Pyda Srisuresh <[email-masked]>
Date: Mon, 30 May 2005 10:06:47 -0700 (PDT)

Francois,

I understand what you and Cullen are saying about the perception. I donot
disagree on that.

cheers,
suresh