Subject: [BEHAVE] Rebutting the endpoint-dependent excuse

From: "Rémi Denis-Courmont" <[email-masked]>
Date: Fri, 21 Nov 2008 21:03:30 +0200

Hello,

There was a "point" at the previous BEHAVE session, that NAT64 translators 
could afford to be endpoint-dependent because:
1/ (BEHAVE-compliant) NAT44 are endpoint-indendepent,
2/ there should never be more than one NAT64 translator on a given path, and
3/ endpoint-independent behavior is needed on only one side.

I am pretty sure I already pointed out at Dublin that this would NOT work, but 
it seems this has not gone through. So: This would not work.

As regards NAT44, the RFCs from the BEHAVE wg require endpoint-independent 
*mappings*. They do -purposedly- NOT require endpoint-independent 
*filtering*. Now, consider this chart:

(1) BEHAVE-compliant cone NAT (E-I mapping, E-I filtering)
(2) BEHAVE-compliant restricted-port NAT (E-I mapping, E-D filtering)
(3) Symmetric NAT (E-D mapping, and presumably E-D filtering)

   |  1  |  2  |  3  |
---+-----+-----+-----+
 1 | Yes | Yes | Yes |
---+-----+-----+-----+
 2 | Yes | Yes | No! |
---+-----+-----+-----+
 3 | Yes | No! | No  |
---+-----+-----+-----+

If NAT64 have endpoint-dependent mappings, they can only talk to peers with 
endpoint-independent filtering, but not endpoint-dependent filtering NAT'ed 
clients.

-- 
Rémi Denis-Courmont
Maemo Software, Nokia Devices R&D
_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave