Subject: [pcp] -06 review: deployment scenarios

From: Paul Selkirk <[email-masked]>
Date: Tue, 08 Mar 2011 04:31:16 +0000

12.  Deployment Scenarios

12.2.  NAT64

   Hosts behind a NAT64 device can make use of PCP in order to perform
   port reservation (to get a publicly routable IPv4 port).

Is that seriously all you want to say about this?

12.3.  NAT44 and NAT444

   Residential subscribers in NAT44 (and NAT444) deployments are usually
   given one IPv4 address, but may also be given several IPv4 addresses.
   These addresses are not routable on the IPv4 Internet, but are
   routable between the subscriber's home and the ISP's CGN.  To
   accommodate multiple hosts within a home, especially when provided
   insufficient IPv4 addresses for the number of devices in the home,
   subscribers operate a NAPT device.  When this occurs in conjunction
   with an upstream NAT44, this is nicknamed "NAT444".

This conflates two things that are significantly different - local NAT
as we have it today (CPE provisioned with globally routable IPv4
addr), and remote NAT (CGN).  PCP has to work in both scenarios -
in the first as a direct replacement for UPnP/NAT-PMP, in the second
as a way of proxying to the upstream NAT.

How does discovery work in NAT444?  Does the intermediate NAT signal the
upstream PCP address to the internal hosts, or does it proxy?  I think
it would have to proxy, because the upstream PCP address would probably
also be an RFC 1918 address.  More text in the draft would be good.
Also, a PCP request from a client app on an internal host would have to
create mappings in both the intermediate NAT (CPE) and the CGN.

12.4.  IPv6 Simple Firewall

   Many IPv6 deployments will include a simple firewall [RFC6092], which
   permits outgoing packets to initiate bi-directional communication but
   blocks unsolicited incoming packets, which is similar to PCP's
   security model that allows a host to create a mapping to itself.  In
   many situations, especially residential networks that lack an IT
   staff, the security provided by an IPv6 simple firewall and the
   security provided by PCP are compatible.  In such situations, the
   IPv6 simple firewall and the IPv6 host can use the MAP6 OpCode to
   allow unsolicited incoming packets, so the host can operate a server.

with the REMOTE_PEER_FILTER Option?

				paul