Subject: IPv6 and NAT

From: "Joris Dobbelsteen" <[email-masked]>
Date: Mon, 11 Sep 2000 17:27:21 +0200

Maybe an issue for the IPv6 and NAT Workgroups.

NAT was proposed as a temporary solution for the shortage of IP address,
which is solved with the IPv6 protocol. Currently I don't expect IPv6 to be
deployed soon (within 1 or 2 years). My ISP, nor many ISPs, aren't promoting
IPv6 yet, nor Microsoft provides IPv6 support for it's OSes.
But as finally IPv6 has been deployed world-wide, what will we do with NAT?

A disadvantage of NAT is that some protocols don't work good/correctly
through NAT. Here NAT broke the principle of the Internet, where every node
should be able to have bidirectional and end-to-end communication. FTP and
many games require this to operate correctly.

However, some scenarios where NAT provides THE solution, are for
* private networks that may not be exposed to the Internet   and
* for networks that have only one IP address available to use on the
Internet,
while host on the private network are required to make 'direct' connections
to the Internet.

I don't think NAT should be made obsolete or unneeded after IPv6 has been
deployed, but rather to be offered for some purposes on small and home
networks. Most companies and bussinesses (even small ones) will be able to
afford a dedicated Internet Connection with a couple IP addresses,
esspecially after IPv6 has been deployed.
However I don't expect my ISP to provide me more than one IP address,
because I don't have a dedicated connection (yet) and I even haven't got one
static IP address (just DHCP). Also I want to separate 'MY' network from the
Internet, and don't install more network adapters into computers and lay
networking cable than needed. This requirement without having to make
strange configurations to any other computers on the network.

That's what's so good about NAT, from my point of view....

- Joris

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Joris Dobbelsteen" <[email-masked]>
Date: Mon, 11 Sep 2000 19:49:19 +0200

Looks like a *dame* stupid question, so I suppose it is....

However I will explain why I actually did ask this:
Maybe I don't explain things to good (my english sucks at this point)....

Assume i'm just an ordinary home(!) user that dials (with a 50Kbps modem) to
an (free) ISP and requests IP addresses using DHCP, you get only ONE, not a
subnet (such account I don't have and can't afford: it ain't free, so far I
know). So I don't benefit from the 64K (or at least 4 Internet IP
addresses)....

Now I do have a (little) computer network, that must be connected to the
Internet.
Installing a HTTP proxy works fine for HTTP, FTP and Gopher. SMTP and POP3
can also be solved (with some more clever software). SOCKS can handle
clients that support that (like ICQ, etc).
BUT what about my software that does not support this, such as SOCKS???
Things like this are the problem, the - lets call it - 'bad' software...

On my current network NAT would solve this problem, what should I do when I
have IPv6 deployed?

Matt,

I will read the docs you given (today, 11th, I'm to busy)

Christian,

I will look at MS its docs (and downloads)...

---

From: Francis Dupont <[email-masked]>
Date: Mon, 11 Sep 2000 19:56:40 +0200

In your previous mail you wrote:

   nor Microsoft provides IPv6 support for it's OSes.

=> this is no more true!

=> if you don't need a connection to the Internet then you don't even
need a NAT: I don't understand your point.

=> with IPv6 you can have near as many addresses as you'd like.
The restriction to one dynamic IP address should vanish (even if it is
based on not technical reasons).

   networks.

=> I disagree. IPv6 is here in order to help small and home network users
too. In fact this is very important to explain to them (even I don't know
how) that IPv6 will help them (in general they know they have a problem
but they don't know good (ie. not NAT) solutions).

   Most companies and bussinesses (even small ones) will be able to
   afford a dedicated Internet Connection with a couple IP addresses,
   especially after IPv6 has been deployed.

=> I still cannot find a technical reason to get only a couple of addresses.

   However I don't expect my ISP to provide me more than one IP address,
   because I don't have a dedicated connection (yet) and I even haven't got one
   static IP address (just DHCP).

=> IMHO there are two reasons to have dynamic addresses:
 - the main one (well known but not technical, ie. irrelevant to these lists)
 - the lack of addresses (ie. use one address per modem, not one address per
   customer). This one will disappear with IPv6!

=> we cannot convince everybody that NAT is the devil (:-) but I have
noted NATs are not sold to small and home network users as NATs, they
are named masquerade devices, smart gateways, ...

Regards

[email-masked]

---

From: "Joris Dobbelsteen" <[email-masked]>
Date: Tue, 12 Sep 2000 16:43:05 +0200

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Francis Dupont
> Sent: maandag 11 september 2000 19:57
> To: Joris Dobbelsteen
> Cc: IPng WG (E-mail); NAT WG (E-mail)
> Subject: Re: IPv6 and NAT 
> 
> 

How whould it be explained that IPv6 (from MS) is only a
  TECHNICAL PREVIEW for WINDOWS 2000 ONLY???

Without any (GUI) support for configuration, no support
for dial-up and VPN connections and lack of support for
routing with e.g. RRAS???

With NO SUPPORT I mean, NO official final release of a driver
to support IPv6 for ALL Windows Platforms: Windows 95/98/ME/NT/2000...

- Joris

---

From: "Melinda Shore" <[email-masked]>
Date: Mon, 11 Sep 2000 12:02:27 -0700

From: Joris Dobbelsteen <[email-masked]>
>To: IPng WG (E-mail) <[email-masked]>; NAT WG (E-mail)
><[email-masked]>
>Sent: Monday, September 11, 2000 8:27 AM
>Subject: (NAT) IPv6 and NAT

> deployed, but rather to be offered for some purposes on small
and home

A couple of things:

1) I don't think that anybody is in the position
of being able to mandate NAT out of existence -
if service providers/network operators feel that
there's justification for continuing to translate
addresses, they will do just that

2) In voice services there's a requirement to be
able to hide calling party addresses on a policy
basis.  NAT is one way to effect this (although
arguably not the best, given the numerous problems
it causes).  A few people in the voice community
are claiming, however, that no terminal should
have a public IP address and that there should
be "address policy domains."  I don't find their
arguments for it particularly compelling and I'm
not even going to try to represent them, but my
guess is that this is going to be an argument
we'll be having in a year or so.

At any rate, I think that point 1 above is the
salient one.

Melinda

---

From: Matt Holdrege <[email-masked]>
Date: Mon, 11 Sep 2000 09:00:58 -0700

Joris,

Before you post to these groups, it would be a real good idea to read some 
of the RFC's and Drafts that have been produced on this topic. 
Specifically, you should read 
http://www.ietf.org/internet-drafts/draft-iab-nat-implications-09.txt and 
http://www.ietf.org/internet-drafts/draft-ietf-nat-protocol-complications-04.txt

At 05:27 PM 9/11/00 +0200, Joris Dobbelsteen wrote:
>-
>To unsubscribe, email [email-masked]' with
>'unsubscribe nat' in the body of the message.

---

From: Paul Francis <[email-masked]>
Date: Mon, 11 Sep 2000 09:48:17 -0700

> > deployed, but rather to be offered for some purposes on small

I predict that the use of IPv6-IPv6 NAT will be widespread,
for the reason that most net admins will prefer NAT to renumbering.
(Noting here that site-local addresses doesn't eliminate
renumbering...you still will have to merge sites from time to
time.)

PF

---

From: Eliot Lear <[email-masked]>
Date: Mon, 11 Sep 2000 10:59:43 -0700

First, you probably don't realize what a storm you are treading into,
and so let me suggest that this NOT become a flame fest.

Technically speaking there is nothing that stops you from using NAT with
IPv6.  The issue remains the limitations it could cause you, should you
choose to offer services from one of your workstations.  Please read
Tony Hain's document carefully.
--
Eliot Lear
[email-masked]

---

From: Robert Elz <[email-masked]>
Date: Wed, 13 Sep 2000 05:10:28 +1100

Date:        Mon, 11 Sep 2000 09:48:17 -0700
    From:        Paul Francis <[email-masked]>
    Message-ID:  <006a01c01c10$161715c0$adfb10ac@francislaptop>

  | (Noting here that site-local addresses doesn't eliminate
  | renumbering...you still will have to merge sites from time to
  | time.)

In that case, NAT doesn't help either - if the address spaces are to
be merged, then there can't be any NAT between them.

If the address spaces aren't being merged, then they can be considered to
be two separate sites, each with their own site local.

Nothing is ever going to eliminate the need for renumbering (not even
very agressive NAT) - the best that can be done is to make it as
painless as possible when it is needed.

kre

---

From: Paul Francis <[email-masked]>
Date: Tue, 12 Sep 2000 11:33:03 -0700

> be merged, then there can't be any NAT between them.

No...what will happen is that the site internally uses some globally unique
address space, but shields that space from renumbering by using NAT between
it and its ISP(s).  When two such numbered sites merge, there is no
renumbering because each already uses a globally unique address space.

I've sometimes wondered why IPv6 doesn't have some number space that is
"globally unique but not globally routable" that could be used for packets
internal to a site.

PF

---

From: "Matt Crawford" <[email-masked]>
Date: Tue, 12 Sep 2000 14:51:05 -0500

> "globally unique but not globally routable" that could be used for packets

How do you get people to do even epsilon paperwork to request such
space?  How do you deter them from just picking something in the
block?  (Or not in the block!)

As long as you have an IPv4 address to call your own, you can do the
6to4 thing.  But since you are likely not to "own" any IPv4 space,
you can to the "pick and pray" thing with a random RFC 1918 address.
Until your mergers and backdoor connections lump you in together with
sqrt(2^24 + 2^20 + 2^16) ~= 4230 like-mindless organizations, you can
expect to probably get away with it.

Ugh.

---

From: Paul Francis <[email-masked]>
Date: Tue, 12 Sep 2000 13:34:43 -0700

> block?  (Or not in the block!)

The only way to deter (not prevent, of course, but deter) would be to
make the space easy to come by...which in theory shouldn't be too
hard because you wouldn't have to worry about making it
aggregatable.  You can hand out huge chunks of it to the good folks
who today will gladly sell you your domain name, or to your
friendly ISP...

I guess my point, ultimately, is that the user community is going to
pick their own poison.  They don't find NAT to be very objectionable,
so if you offer something that is *to them* worse than NAT (i.e.
renumbering), you will have effectively promoted a NAT solution.

PF