Subject: RE: NAT != SL (Was: RE: CONSENSUS CALL: Deprecating Site-Local Addressing)

From: "Christian Huitema" <[email-masked]>
Date: Thu, 3 Apr 2003 10:45:25 -0800

If we are serious about NAT != SL, then we should enforce it. Clearly,
we cannot send the protocol police and whack every market driven
designer of a NAT, but we can perform "collective enforcement", i.e.
design our specification in such a way that misusing site local in a NAT
configuration is guaranteed to break every application, and thus that
any attempt to deploy an IPv6 NAT using site local will be a deployment
nightmare.

Suppose for example that we change our spec to forbid any communication
between addresses of different scopes. This can be enforced by senders
(refuse to send a packet if dest scope != source scope), routers or
firewalls (drop packet if srce and dest scope don't match), and
receivers (drop incoming packet if srce and dest scope don't match). You
don't need to enforce it in every host and every router to be effective:
just enforce in in a significant fraction of the hosts makes sure that
any attempt to use the forbidden pattern will be very unreliable.

This simple suggestion will in fact prevent using SL in the NAT
scenario, as at some point the scenario relies on communication between
an SL addressed source (e.g. a client) and a globally addressed
destination (e.g. a web site).

I think that we should enforce this requirement whether we maintain site
local or find a replacement for disconnected sites.

-- Christian Huitema

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Nick 'Sharkey' Moore" <[email-masked]>
Date: Fri, 4 Apr 2003 09:33:33 +1000

On Thu, Apr 03, 2003 at 10:45:25AM -0800, Christian Huitema wrote:
>
> If we are serious about NAT != SL, then we should enforce it.

Well, I find this attitude (it's widespread on this list) bizarre ...
if SLAs =/=> NAT  (SLAs do not cause NAT) then we don't need to
worry about it.

> between addresses of different scopes.

... but that sounds fair enough to me.  Scopes are scopes. 
Your return address has to be in scope at the destination.

> scenario,

It will prevent _Standards Compliant_ client implementations from
using NAT, but as we both know many vendors loosely interpret
standards in any case. 

-- 
Nick 'Sharkey' Moore  <[email-masked]>  <http://zoic.org/sharkey>
"If you can keep your cynicism when all around are losing theirs..."
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------