Subject: [Ietf-behave] Port forwarding and NAT behavior

From: "Reinaldo Penno" <[email-masked]>
Date: Tue, 25 Oct 2005 07:55:07 -0700 (PDT)

Hello,

I read the current UDP behavior NAT but I believe it is more concerned
with stand-alone sessions initiated from private network. My question is
more concerned with server behind a firewall and subsequent sessions.

Let's suppose a NAT device configured with port forwarding, for example:

80.0.0.1:5060 -> 10.0.0.1:5060
80.0.0.2:5060-> 10.0.0.2:5060

So, that SIP signaling packets can reach the SIP phone behind the NAT.
In other words, the SIP phone can receive external calls even when in a
private network. 

Now, noticing that the NAT device has more than one public address, when
phone 10.0.0.1 sends a SIP INVITE, should the NAT device pick 80.0.0.1
as the public IP address? Is this the recommended behavior?

Moreover, should the source port be the same (more than just in the same
range)? 

I guess I'm trying to gauge if the recommended behavior (now or as a
result of this WG) should be that if port forwarding is configured, the
NAT device should "reserve" that <IPaddress:Port> mapping and not give
to anyone else.

Thanks,

Reinaldo

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 25 Oct 2005 18:46:44 -0700 (PDT)

> Now, noticing that the NAT device has more than one public 
> address, when phone 10.0.0.1 sends a SIP INVITE, should the NAT 
> device pick 80.0.0.1 as the public IP address?  Is this the 
> recommended behavior?

As long as the NAT always picks 80.0.0.1, it seems to meet the
requirement REQ-2 of draft-ietf-behave-nat-udp-04.txt.

> Moreover, should the source port be the same (more than just 
> in the same range)? 
>

Right, it should be reserved for the device that is configured
to receive that traffic.  Otherwise, if it isn't reserved, you're
doing port overloading which is fraught with complexity and 
interoperation problems, namely when you receive a packet on
port 5060, do you hand it to the last device that sent a
UDP packet with source=5060, or do you hand it to the 
configured device?  It's impossible to develop an algorithm
that will behave correctly in all situations which is why
port overloading is a MUST NOT in that I-D.

-d

---

From: Pyda Srisuresh <[email-masked]>
Date: Mon, 31 Oct 2005 09:41:56 -0800 (PST)

> Let's suppose a NAT device configured with port forwarding, for example:

The above static configuration for port forwarding sounds fine. 

> Moreover, should the source port be the same (more than just in the same

By source port, what packets are you refering to - Packets from SIP initiator
or SIP responder?

> NAT device should "reserve" that <IPaddress:Port> mapping and not give

The Behave requirements do not address inbound port forwarding. As such, static
port forwarding as you suggest should be fine. 

cheers,
suresh
> 
> Thanks,
> 
> Reinaldo
> 
> 
> 
> 
> _______________________________________________
> Ietf-behave mailing list
> Ietf-behave@xxxxxxxxxxxxxxxxxxx
> https://list.sipfoundry.org/mailman/listinfo/ietf-behave
>