Subject: [BEHAVE] Confusion about the features of NAT64

From: Dong Zhang <[email-masked]>
Date: Sat, 28 Nov 2009 11:33:13 +0800

Hi Marcelo,

In draft-ietf-behave-v6v4-xlate-stateful-03, it says:
   
      ...
   o  It supports peer-to-peer communication between IPv4 and IPv6
      nodes, including the ability for IPv4 nodes to initiate
      communication with IPv6 nodes using peer-to-peer techniques (i.e.,
      using a rendezvous server and ICE).  To this end, NAT64 is
      compliant with the recommendations for how NATs should handle UDP
      [RFC4787], TCP [RFC4787], and ICMP [RFC5508].
   o  NAT64 supports IPv4 initiated communications to a subset of the
      IPv6 hosts through statically configured bindings in the NAT64
      device.
      ....
   o  Supports additional features with some changes on nodes.  These
      features include:
      *  Support for DNSSEC
      *  Some forms of IPsec support
    ...
   Any protocol that protect IP header information are essentially
   incompatible with NAT64.  So, this implies that end to end IPSec
   verification will fail when AH is used (both transport and tunnel
   mode) and when ESP is used in transport mode.  This is inherent to
   any network layer translation mechanism.

I am not quite clear here. please do me a favor. I guess I miss something.
For bullet one, does it mean using ICE mechanism and something like that NAT64 could support communication iniciated from IPv4 node to IPv6 node in peer-to-peer model?
For bullet two, does it mean by statical configuration NAT64 could allow IPv4 to initiate connections to a subset of IPv6 nodes?
So, my confusion is draft-ietf-behave-v6v4-xlate-stateful-03 is a protocol for the translation from IPv6 to IPv4, but why does it include above two bullets as feature of NAT64?

In addition, I wonder why NAT64 could support ESP tunnel mode. Imho, in ESP tunnel mode, the port is not able to be translated as well.

Thank you.

2009-11-28 

Dong Zhang

---

From: marcelo bagnulo braun <[email-masked]>
Date: Sat, 28 Nov 2009 09:33:24 +0100

Dong Zhang escribió:
> For bullet one, does it mean using ICE mechanism and something like
> that NAT64 could support communication iniciated from IPv4 node to
> IPv6 node in peer-to-peer model?
> For bullet two, does it mean by statical configuration NAT64 could
> allow IPv4 to initiate connections to a subset of IPv6 nodes?
> So, my confusion is draft-ietf-behave-v6v4-xlate-stateful-03 is a
> protocol for the translation from IPv6 to IPv4, but why does it
> include above two bullets as feature of NAT64?

this is analogous to the NAT44 case, right?

using ICE or static bindings you could trick the nat to allow "incoming"
communications.
this is inherent to the fact that once the state is created, packets
should be able to flow through the nat in both directions.

so i am not sure there is anything new here.

> In addition, I wonder why NAT64 could support ESP tunnel mode. Imho,
> in ESP tunnel mode, the port is not able to be translated as well.

right, this is out of the scope for this document,
you could make it work, if you created state that stores the SPI and use
that for demux
We agreed in the dublin meeting (if i remember correctly) that the IPsec
processing should be done in a separated document, which has not been
written yet afaict

regards, marcelo

> 2009-11-28
> ------------------------------------------------------------------------
> *Dong Zhang*

---

From: Dong Zhang <[email-masked]>
Date: Sat, 28 Nov 2009 17:14:07 +0800

Hi Mareclo,

>so i am not sure there is anything new here.
Yes, I know. I mean NAT64 is mainly to document the communication initiated from IPv6 to IPv4. Whereas the content I mentioned emphasizes the features of communication in the opposite direction. It might be not consitent with the topic of the document. That's my feeling.
 
>processing should be done in a separated document, which has not been
OK.

Thank you.
>_______________________________________________
>Behave mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/behave

------------------				 
Dong Zhang
2009-11-28

---

From: marcelo bagnulo braun <[email-masked]>
Date: Sat, 28 Nov 2009 10:24:34 +0100

Dong Zhang escribió:
> Yes, I know. I mean NAT64 is mainly to document the communication initiated from IPv6 to IPv4. Whereas the content I mentioned emphasizes the features of communication in the opposite direction.

i wouldn't go as far as saying emphasize... the document has about 40
pages and there are a couple of mentions of this in the whole document,
that wouldn't account for 1% of the document.
I would say that the document acknowledges that this is possible

> It might be not consitent with the topic of the document. That's my feeling.
>   

the document simply acknowledges this. I mean there is nothing specific
that needs to be done to support ICE, other than following the behave
requirements. I mean after all the behave requirements for nats are
there to actually simplify the support of nat traversal techniques, so
it seems reasonable to explicitly acknowledge that.
FWIW, explicit mention of these features have been discussed and
requested on earlier discussions.
regards, marcelo

---

From: Dong Zhang <[email-masked]>
Date: Sat, 28 Nov 2009 17:30:15 +0800

Hi,

>requested on earlier discussions.
Clear. 
Thanks.

------------------				 
Dong Zhang
2009-11-28

---

From: George Tsirtsis <[email-masked]>
Date: Sat, 28 Nov 2009 11:33:32 +0000

Actualy, as I indicated in my review, I think the document should be
clearer on what it is trying to achieve in the area of ipv4 to ipv6
communications. The document currently shows a preference to end point
independent mappings which is exactly the NAT behavior recommended for
p2p/ice communications to work through it, w/o relays. It is also what
we wish NAT44 implementations did.
Still this kind of communication is somewhat restricted by the fact
the DNS64, for all the good reasons, does not support ipv4 initiated
address resolutions.

All this is significant and should become clearer as the documents progress.

George

On 11/28/09, marcelo bagnulo braun <[email-masked]> wrote:
>> Yes, I know. I mean NAT64 is mainly to document the communication
>> initiated from IPv6 to IPv4. Whereas the content I mentioned emphasizes
>> the features of communication in the opposite direction.
>

---

From: marcelo bagnulo braun <[email-masked]>
Date: Sat, 28 Nov 2009 12:53:36 +0100

right, i will try to make it clearer when i go through your review