Subject: Re: (NAT) Host NAT issues and Security Policy Servers

From: "Mike Borella" <[email-masked]>
Date: Thu, 7 Jan 1999 16:29:03 -0600

Determining whether the destination is within the private network space
or not is an open issue.

I haven't thought much about the multiple NAT gateway issue, but
at first glance it looks like the multiple RADIUS server issue:
you can pick one of several solutions, each with a different drawback
or limitation.

-Mike

"Michael C. Richardson" <[email-masked]> on 01/07/99 12:13:59
PM

Please respond to "Michael C. Richardson" <[email-masked]>

To:   [email-masked]
cc:    (Mike Borella/MW/US/3Com)
Subject:  Re: (NAT) Host NAT issues and Security Policy Servers

>>>>> "Mike" == Mike Borella <[email-masked]> writes:
    Mike> Obviously, all of these are candidates for whatever RUTS turns
out.

  RUTS may be fine for getting the info once you know where to get it from.

  In your HostNAT work, how do you determine if you need to do NAT or not?
What if there are multiple NAT gateways?

   :!mcr!:            |  Network and security consulting/contract
programming
   Michael Richardson |         Firewalls, TCP/IP and Unix administration
 Personal:
http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html
 Corporate: http://www.sandelman.ottawa.on.ca/SSW/
     ON HUMILITY: To err is human, to moo bovine.

-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.

-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.

---

From: "Michael C. Richardson" <[email-masked]>
Date: Thu, 07 Jan 1999 19:09:05 -0500

>>>>> "Mike" == Mike Borella <[email-masked]> writes:
    Mike> Determining whether the destination is within the private network
    Mike> space or not is an open issue.

  One of things that SPS and RSVP do well is that they don't make you
decide which gateway to use. The normal routing system decides that for you.

  The thing that I like about this method is that it provides a clear 
probe packet, and clearly allows routers along the way that care to intercept 
the packet and query their policy servers to find out what should be done.

  SPS uses its own protocol (namely, the gateway simply bounces the SPS 
probe to the security server, which may then interact with the end system)
while RSVP requires something like COPS to make the query. Both have
advantages and disadvantages.

  The difference between the RADIUS and Host-NAT situation is that you
typically don't want to configure 10000 clients with the IP addressess of the 
two Host-NAT servers, and then reconfigure each one when the list
changes. You don't mind doing that with your 10 NASes. (Yes, I know that
some organizations have far in excess of that number.)

   :!mcr!:            |  Network and security consulting/contract programming
   Michael Richardson |         Firewalls, TCP/IP and Unix administration
 Personal: http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html
 Corporate: http://www.sandelman.ottawa.on.ca/SSW/
	ON HUMILITY: To err is human, to moo bovine.

-

---

From: Jeffrey Lo <[email-masked]>
Date: Thu, 7 Jan 1999 18:01:18 -0800 (PST)

Policy issues have not been addressed in the HNAT nor the DNAT drafts.
Questions like "can I talk to the outside world?", "which NAT gateway
should I contact?", "what type of NAT can I use?" are essentially open at
this moment. SPS and COPS etc are all possible candidates for providing a
NAT policy or some common policy. It seems that service specific
configuration negotiations which could be session initiated should be
handled by service specific protocols such as RSVP in the case of QOS and
ISAKMP in the case of IPSEC. This is what HNAT, DNAT drafts and 
later work address. But by introducing HNAT, we come very close to talking
about policy.

Jeff

-