Subject: Re: [BEHAVE] Comments on draft-bagnulo-behave-nat64-00

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 4 Aug 2008 14:53:41 +0200

On 29 jul 2008, at 4:09, Philip Matthews wrote:

> However, if AAAA records are synthesized using a single prefix, as  
> Dave is suggesting, then I think it is much harder to ensure that L  
> always uses the same NAT64 device.

> To be more precise, what we want is that all traffic from L uses one  
> NAT64, but all traffic from another node M uses a different NAT64,  
> etc, so that there is more-or-less an even assignment of nodes to  
> NAT64 devices, with one node always using the same NAT64.

The problem here is using the words "all" and "always".

It's fairly trivial to build a setup where packets from the same  
source consistently arrive at the same destination, even if multiple  
destinations share an address. As long as the routing remains the  
same. When there is an outage that leads the routing protocols to  
select new paths, packets may end up at a different instance of the  
address in question.

However, this is as much a feature as a bug: rather than talking to a  
dead translator and/or over dead links, the user gets to talk to a  
working translator.
_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave

---

From: Dave Thaler <[email-masked]>
Date: Mon, 4 Aug 2008 19:10:51 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Pekka Savola
> Sent: Tuesday, July 29, 2008 5:33 AM
> To: Rémi Denis-Courmont
> Cc: [email-masked]; [email-masked]; Dave Thaler
> Subject: Re: [BEHAVE] Comments on draft-bagnulo-behave-nat64-00
>
> This is mainly directed at Dave, but I'm responding off Remi's comment,
>
> On Tue, 29 Jul 2008, Rémi Denis-Courmont wrote:
> > On Tuesday 22 July 2008 04:06:37 ext Dave Thaler, you wrote:
> >> If you have a v6-only network, then handing out a DNS64 server's
> >> address in DHCPv6 as the DNS server is the right thing.
> >>
> >> If you have a dual-stack network, then you'd really like to give
> >> v6-only hosts a DNS64 server (e.g., via DHCPv6), but give dual-stack
> >> hosts a DNS server.
>
> How does the operator configuring DNS, DHCPv6, and/or Router
> Advertisements know whether a host is v6-only or dual-stack?

In some cases, it's obvious, such as
a) when the DNS64 is close to the client, and it's on a v6-only network
that has hosts that aren't multi-homed (e.g. some cell phone networks).
This was picture 2 in Mark Townsley's INTAREA deck if I recall correctly.
b) when the DNS64 is close to the server, and the server network has
no public IPv4 addresses and hence all clients are logically v6-only
as far as connectivity to that network is concerned.  This was
picture 3 in Mark's INTAREA deck if I recall correctly.

This is why it's important to distinguish between common cases,
since there may be some scenarios that are simple.

> Note that a dual-stack host may also use DHCPv6 to request DNS server
> address information.  Such a host would probably also prefer those
> addresses over v4 DNS server addresses.
>
> Do we also need to care about a scenario which has v6-only network and
> NAT64, but the user configures a v4-over-v6 tunnel or v6-in-v6 VPN and
> has connectivity and name lookup capability beyond what's provided by
> the physical network operator?

Yes, that's logically equivalent to a multihomed host, which is a
valid scenario.

> > If we assume that all current v6-capable nodes are actually dual-
> stack...
> > could we do it so that:
> >
> > * On v6-only network, DNS64 is provisioned like normal (e.g. DHCPv6
> > and/or
> > SLAAC) as "the" DNS recursive server.
> >
> > * On a dual-stack network, DNS64 is provisioned with a *new*
> > DNS64-specific setting (e.g. an extension to DHCPv6), and normal DNS
> > is only provisioned via
> > IPv4 (e.g. DHCPv4).
>
> Trying to figure out if this has implications on the "thou shalt not
> modify hosts" requirement (when examining dual-stack nodes in
> particular) makes my head ache :-/

Depends on the scenario.  In all but one scenario (the greenfield
case as Alain put it), "don't modify hosts" is a requirement, at
least in my view.

-Dave

> --
> Pekka Savola                 "You each name yourselves king, yet the
> Netcore Oy                    kingdom bleeds."
> Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings