Subject: [BEHAVE] CGN REQ: Source address filtering

From: <[email-masked]>
Date: Wed, 16 Mar 2011 10:36:43 +0100

Re-,
 
This point is more specific to DS-Lite and L2-NAT. The NAT function of the CGN must only processes IPv4 datagrams whose source address is a private address (RFC 1918). The behaviour of the CGN when receiving a packet with a broadcast address is also to be specified.

For other CGN deployment models, address filtering can be enforced before reaching the CGN.

Cheers,
Med

---

From: Simon Perreault <[email-masked]>
Date: Wed, 16 Mar 2011 10:12:10 -0400

On 2011-03-16 05:36, [email-masked] wrote:
> This point is more specific to DS-Lite and L2-NAT. The NAT function
> of the CGN must only processes IPv4 datagrams whose source address is
> a private address (RFC 1918).

Since this is specific to DS-Lite and L2-NAT then I suggest that it go
in a document that would be specific to them. Why not add that to the
document describing the AFTR?

> The behaviour of the CGN when receiving
> a packet with a broadcast address is also to be specified.

What behaviour (on top of RFC1122) are you thinking of?

Simon
-- 
DTN made easy, lean, and smart --> http://postellation.viagenie.ca
NAT64/DNS64 open-source        --> http://ecdysis.viagenie.ca
STUN/TURN server               --> http://numb.viagenie.ca

---

From: <[email-masked]>
Date: Wed, 16 Mar 2011 15:19:31 +0100

Re-,

I tend to disagree. I see the CGN requirement I-D as the place to cover the requirements for all variants of CGN including the DS-Lite and L2-NAT.  

More comments inline.

Cheers,
Med

-----Message d'origine-----
De : [email-masked] [mailto:[email-masked]] De la part de Simon Perreault
Envoyé : mercredi 16 mars 2011 15:12
À : [email-masked]
Objet : Re: [BEHAVE] CGN REQ: Source address filtering

Med: DS-Lite I-D refers to the CGN Requirements I-D for the NAT behaviour.

Med: What I has in mind is for instance to add an explicit statement saying: "drop packets with broadcast addresses".

---

From: Francis Dupont <[email-masked]>
Date: Wed, 16 Mar 2011 16:09:33 +0100

In your previous mail you wrote:

   This point is more specific to DS-Lite and L2-NAT. The NAT function
   of the CGN must only processes IPv4 datagrams whose source address
   is a private address (RFC 1918).

=> to have implemented this for DS-Lite I can say the wording should
be more accurate: there must be such a check but it should accept
192.0.0.0/29 too. IMHO the best is to accept only packets from
prefixes in a list which is by default the 3 1918 prefixes and
the 192 above.

   The behaviour of the CGN when receiving a packet with a broadcast
   address is also to be specified.
   
=> do you mean a broadcast address as the source address?
(BTW how you can check this?)

Regards

[email-masked]