Subject: RE: [Sipping] new draft on session policies in SIP

From: David Oliver <[email-masked]>
Date: Thu, 20 Jun 2002 08:18:40 -0500

Broadband users behind NATs can be in the worst of all worlds; they are
neither "protected" from the open Internet by an MIS department, nor do they
have unrestricted access to it.

Some STUN-enabled SIP clients will be able to get through the NAT, but it
doesn't work in all cases. It also requires the user to acquire access to a
STUN server, which may be an issue for non-technical personal users. STUN is
advertised as a stop-gap solution.

A much better solution would be for the ISP to provide a NAT-managing SIP
proxy as part of their service, allowing simple NAT-aware SIP clients to
traverse their NAT. This seems a reasonable duty of the ISP, in the same way
that an apartment owner would provide all residents a key, when the owner
places a lock on the main door.

Regards,

David C. Oliver
Principal Engineer
SecureLogix Corp
Email: [email-masked] <mailto:[email-masked]>
Tel:   210.402.9669
Fax:   210.402.6996 

-----Original Message-----
From: Henry Sinnreich [mailto:[email-masked]]
Sent: Wednesday, June 19, 2002 5:00 PM
To: 'David Oliver'; 'Jonathan Rosenberg'; [email-masked]
Cc: [email-masked]
Subject: RE: [Sipping] new draft on session policies in SIP

>The appropriate place for this is the proxy server nearest the
>NAT: configuration and administration are normally the same as the
NAT's,

DSL and cable users may be behind a NAT in the C.O. where they can have
absolutely no control. What alternative to STUN, if any do you
recommend?

Thanks, Henry

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of David Oliver
> Sent: Wednesday, June 19, 2002 1:06 PM
> To: 'Jonathan Rosenberg'; [email-masked]
> Cc: [email-masked]
> Subject: RE: [Sipping] new draft on session policies in SIP
> 
> 
> I agree that clients must be NAT-aware.
> 
> SDP endpoints generally only have numeric IP addresses (a 
> protocol design practice which has been recommended against 
> for many years, but which is necessitated by the prevalence 
> of NAT), so either a transparent ALG is needed to traverse 
> their NAT, or they need to be aware of the NAT.
> 
> Transparent ALGs have the severe limitation that they cannot 
> work with encrypted data, and many users require their 
> conversations to be private.
> 
> Arbitrary NAT awareness by clients is problematic, as clients 
> are likely to be small embedded hosts (e.g. net-phones), 
> which cannot be easily configured to work with different 
> NATs, and protocols such as STUN do not work in all cases. 
> This is especially important for essentially untrusted guest 
> users, such as in hotels or airport hospitality suites.
> 
> The best solution is to make the client aware of the 
> existence of NATs, while limiting the impact on the client to 
> a simple address replacement protocol. The appropriate place 
> for this is the proxy server nearest the
> NAT: configuration and administration are normally the same 
> as the NAT's, it can be trusted by the NAT (especially 
> important for guest users), and has minimal administrative 
> impact as Midcom protocols appear and stabilize to replace ad 
> hoc and proprietary solutions.
>
<...>

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Henry Sinnreich <[email-masked]>
Date: Thu, 20 Jun 2002 16:47:37 -0500

> A much better solution would be for the ISP to provide a 
> NAT-managing SIP proxy as part of their service, allowing 
> simple NAT-aware SIP clients to traverse their NAT.

Yes, that would be ideal, but unfortunately may not be in the cards any
time soon for users having DSL provided by a LEC.
Is there any other alternative to STUN for such DSL subscribers?
(I don't believe there is).

Thanks, Henry

> Sent: Thursday, June 20, 2002 8:19 AM
> To: 'Henry Sinnreich'; David Oliver; 'Jonathan Rosenberg'; 
> [email-masked]
> Cc: [email-masked]
> Broadband users behind NATs can be in the worst of all 
> worlds; they are neither "protected" from the open Internet 
> by an MIS department, nor do they have unrestricted access to it.
> 
> Some STUN-enabled SIP clients will be able to get through the 
> NAT, but it doesn't work in all cases. It also requires the 
> user to acquire access to a STUN server, which may be an 
> issue for non-technical personal users. STUN is advertised as 
> a stop-gap solution.
> 
> A much better solution would be for the ISP to provide a 
> NAT-managing SIP proxy as part of their service, allowing 
> simple NAT-aware SIP clients to traverse their NAT. This 
> seems a reasonable duty of the ISP, in the same way that an 
> apartment owner would provide all residents a key, when the 
> owner places a lock on the main door.
> 
> Regards,
> 
> David C. Oliver
> Principal Engineer
> SecureLogix Corp
> DSL and cable users may be behind a NAT in the C.O. where 
> they can have absolutely no control. What alternative to 
> STUN, if any do you recommend?
> 
> Thanks, Henry
> 
> Use [email-masked] for questions on current 
> sip Use [email-masked] for new developments of core SIP
>

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 24 Jun 2002 16:21:15 -0400

> places a lock on the main door.

I would never in a million years hand over control of my home nat to a 
proxy server run by my ISP or anyone else for that matter, even if I 
personally wrote the code for said proxy. In fact, many ISPs consider 
NATs anathema (they equate them to stealing IP addresses), and so I find 
it unlikely they would do this.

As for a proxy managing a NAT that the ISP owns, well, thats all fine. 
However, the really big problem is that your ISP is not likely to be 
your SIP provider. The wireless folks may attempt to prevent that, but 
in wireline access it is definitely the case today. None of the retail 
voip providers that I am aware of are ALSO ISPs. I somehow doubt that 
Earthlink would allow net2phone or deltathree to control its NATs.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com