Subject: [BEHAVE] NAT66 - pointer to opsec doc on infrastructure security

From: Merike Kaeo <[email-masked]>
Date: Fri, 21 Nov 2008 22:40:27 +0200

Check out section 6 which deals with infrastructure hiding.

http://tools.ietf.org/html/draft-ietf-opsec-infrastructure-security-01

I will check with authors to see if an update is pending.....

- merike
_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 24 Nov 2008 09:11:30 +1300

Merike,

That talks about infrastructure hiding in a reasonable way,
but does *not* (fortunately) talk about topology hiding
(i.e. hiding the subnet structure), which is the claim
sometimes made as an advantage of NAT. At least as far as
I'm concerned, it's the topology hiding aspect that seems
bogus. Infrastructure hiding is a different matter and
clearly a normal function of firewalls or ACLs.

   Brian

---

From: Merike Kaeo <[email-masked]>
Date: Sun, 23 Nov 2008 13:52:30 -0800

Hello....

I've been a lurker here for quite a while and didn't want to express  
a definitive opinion until I'd
really thought things through for myself.

I personally agree that topology hiding via NAT is bogus and am  
typically a strong proponent of
securing the hosts properly instead of utilizing a mechanism that is  
'easier' but breaks end-to-end
principles.  NAT in the long run also makes troubleshooting network  
problems rather complex.  I
typically look at networks from an angle of when something breaks,  
how quickly can issues be
identified and fixed.  In my experience, NAT concerns have always  
complicated the process.

Since at the Friday session there were statements of not really  
having clearly defined thoughts on
topology hiding, I figured this pointer may help.  And to be honest,  
I am not so sure I get the subtle
difference of topology vs infrastructure hiding.  In my current  
thinking, topology hiding would be a natural
byproduct of infrastructure hiding. By hiding the infrastructure you  
don't know the subnet structure either.

After changing my mind a multitude of times as to whether I agree  
with standardizing on a mechanism to
do v6 NAT I have finally come to the conclusion for myself that I do  
not agree with it.   It will be impossible
to stop vendors from building whatever they want but if the IETF  
standardizes on any mechanism to do
v6-NAT they are basically giving their OK that IPv6 NAT is an  
accepted mechanism......regardless of statements
in documents that v6 NAT should be avoided.  And it is my belief that  
vendors will just go further and create
some excuse for including port-based translations and here we go  
again with NAT parity of v4 and v6.  I hope
I am proven wrong but this is the conclusion I have come to for myself.

In my opinion, unless there is a clear need for IPv6 NAT from a  
technical perspective, standardization of
such a solution should be avoided.  I will still keep an open mind as  
the discussions progress......

- merike