Subject: RE: NAT != SL (Was: RE: CONSENSUS CALL: Deprecating Site-Local Addressing)

From: "Christian Huitema" <[email-masked]>
Date: Thu, 3 Apr 2003 15:38:33 -0800

> > This simple suggestion will in fact prevent using SL in the NAT
> > scenario,
> 
> It will prevent _Standards Compliant_ client implementations from
> using NAT, but as we both know many vendors loosely interpret
> standards in any case.

You don't get the point. If enough hosts come programmed to enforce
scope restrictions, then the non compliant product ends up with a
deployment headache and has to be fixed. This is basically the root of
Internet standards -- enforcement by peer pressure.

-- Christian Huitema

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Greg Daley <[email-masked]>
Date: Fri, 04 Apr 2003 09:49:10 +1000

Hi Christian,

> Internet standards -- enforcement by peer pressure.

The Globally addressed peer hosts when a communicating host is
behind NAT are talking to another Global peer address at the NAT
agent.

This only requires complicity on the NAT box and the host,
not the peer communicator.  The proposed requirement provides
no further burden to implementors than NATv4 systems.

Greg D.

---

From: "Nick 'Sharkey' Moore" <[email-masked]>
Date: Fri, 4 Apr 2003 09:49:49 +1000

> Internet standards -- enforcement by peer pressure.

What a wonderful world it will be.  Consider, however, that 
once a packet has been NATed, it has a global scope source and
destination.

-----Nick
-- 
Nick 'Sharkey' Moore  <[email-masked]>  <http://zoic.org/sharkey>

---

From: Tim Chown <[email-masked]>
Date: Fri, 4 Apr 2003 01:30:27 +0100

> >Internet standards -- enforcement by peer pressure.

So actually we want site-local scoping to remain so we can detect when
there is a scope mismatch so the implementation can chose to have the
connection fail?

The danger I guess is that the site then hijacks a global scope address
space to use internally so that the implementation will talk to external
globally addressed hosts via a global-global NAT mapping?  So do we gain
anything?

We would thus also have to put a "should not rewrite source address"
requirement for devices in there too?   Which many would just ignore...

So I don't see we could ever stop NAT.   Which leads to the conclusion that
we must encourage ISPs to offer stable /48 prefixes (can the RIR policies
help there?) even if that means an ISP with a million customers needs a
/22 or similar rather than a /32 (allowing for HD-ratio), and let market
forces take effect.

Tim