Subject: RE: (NAT) IPv6 and NAT

From: "Tony Hain" <[email-masked]>
Date: Mon, 11 Sep 2000 09:27:50 -0700

Just to clarify, NAT does not provide isolation from the Internet, route
filtering does that. The inbound filtering that happens is a function of
lack of a route in the NAT, not the fact it is translating addresses.
IPv6 has a defined function for this, called Site Local. These addresses
are filtered at the site boundary router, providing more security than
'where is this port mapped to now?' functions.

It is expected that ISPs will be allocating /48 to customers, and for
those that don't support IPv6 the IPv4 address provides a /48 using
6to4. With 64k subnets available there should be no reason to build
perverse configurations, and no need for translating the addresses. As
you note many things do not work correctly without end-to-end address
integrity, so why preclude them by continuing down the NAT path? Each of
the items you list as values are solved in a cleaner way by IPv6 so just
move to it.

Tony

While I am the Program Manager for IPv6 at Microsoft, the above comments
are mine and should not be construed as related to my employer.

-----Original Message-----
From: Joris Dobbelsteen [mailto:[email-masked]]
Sent: Monday, September 11, 2000 8:27 AM
To: IPng WG (E-mail); NAT WG (E-mail)
Subject: (NAT) IPv6 and NAT

Maybe an issue for the IPv6 and NAT Workgroups.

NAT was proposed as a temporary solution for the shortage of IP address,
which is solved with the IPv6 protocol. Currently I don't expect IPv6 to
be
deployed soon (within 1 or 2 years). My ISP, nor many ISPs, aren't
promoting
IPv6 yet, nor Microsoft provides IPv6 support for it's OSes.
But as finally IPv6 has been deployed world-wide, what will we do with
NAT?

A disadvantage of NAT is that some protocols don't work good/correctly
through NAT. Here NAT broke the principle of the Internet, where every
node
should be able to have bidirectional and end-to-end communication. FTP
and
many games require this to operate correctly.

However, some scenarios where NAT provides THE solution, are for
* private networks that may not be exposed to the Internet   and
* for networks that have only one IP address available to use on the
Internet,
while host on the private network are required to make 'direct'
connections
to the Internet.

I don't think NAT should be made obsolete or unneeded after IPv6 has
been
deployed, but rather to be offered for some purposes on small and home
networks. Most companies and bussinesses (even small ones) will be able
to
afford a dedicated Internet Connection with a couple IP addresses,
esspecially after IPv6 has been deployed.
However I don't expect my ISP to provide me more than one IP address,
because I don't have a dedicated connection (yet) and I even haven't got
one
static IP address (just DHCP). Also I want to separate 'MY' network from
the
Internet, and don't install more network adapters into computers and lay
networking cable than needed. This requirement without having to make
strange configurations to any other computers on the network.

That's what's so good about NAT, from my point of view....

- Joris

-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Thomas Eklund <[email-masked]>
Date: Wed, 13 Sep 2000 14:20:13 +0200

A few comments:
<I guess my point, ultimately, is that the user community is going to
<pick their own poison.  They don't find NAT to be very objectionable,
<so if you offer something that is *to them* worse than NAT (i.e.
<renumbering), you will have effectively promoted a NAT solution.

since that re-numering can be done automatically it is not a problem in
ipv6. This is actually one of IPv6's nice feature for an ISP for future
Merger's&Acquisition's. 

You can 
- automatically autoconfigure your host on your subnet via neighbor
discovery
- all router in the backbone can be re-numbered using a router renumbering
scheme

this cant be done with NAT and how are you going to solve overlapping
private address domain when you merge them? You will have to manually
configure those overlapping host-addreses which is very timeconsuming.

And an other comments:
Is the traditional that it breaks the end-to-end model and makes the
services assymetric!
- mobility (roaming dont work), qos, security etc 

/Thomas

---

From: Dan Lanciani <[email-masked]>
Date: Wed, 13 Sep 2000 00:02:35 -0400 (EDT)

|> I've sometimes wondered why IPv6 doesn't have some number space that is
|> "globally unique but not globally routable" that could be used for packets
|> internal to a site.
|
|How do you get people to do even epsilon paperwork to request such
|space?

People seemed so willing to do such paperwork for non-routable v4 address
space that is was supposedly necessary to make the process hard/expensive to
discourage them from consuming it all.  Offer the v6 space on the terms that v4
space was once available (i.e., free with nominal justification documentation)
and I'm sure people will use it.  Try to make these allocations another cash
cow with yearly fees and, naturally, people will pick (poorly) random addresses
that will later hurt them.

The same argument applies to NAT.  If ISPs make it expensive to get extra v6
addresses (based on the justification that addresses used to be scarce?) then
people will use NAT with IPv6.  If ISPs make "stable" v6 addresses (i.e., ones
that they do not deliberately renumber frequently) a premium service then
people will use NAT.  Although the standard claim is that NAT breaks the end-
to-end model we all like (and note that I have personally never liked NAT),
NAT shines at preserving the stable-address model that is deeply embedded in
many protocols and applications.  NAT has already proved itself:  many useful
applications work just fine in spite of the loss of the end-to-end model.  The
renumbering model has yet to be proven, let alone retrofitted to many existing
applications.

I happen to think that ISPs will charge a premium for multiple and/or stable
v6 addresses because that is the status quo and because the market will bear
it.  Thus, I suspect that NAT will remain quite active if/when IPv6 is deployed.
I think this is unfortunate--again, I'm no fan of NAT--but it's probably too
late to do anything.  While it certainly would have been possible to structure
IPv6 in such a way that end users could allocate identity addresses independent
of their providers (I even made a hand-waving proposal to allow for this with
relatively minor protocol modifications) there never seemed to be much interest.
So the market pressures will continue to operate in an IPv6 environment just as
they have in the IPv4 one.  All IMHO, of course...

				Dan Lanciani
				[email-masked]