Subject: RE: [Capwap] NAT traversal

From: "Darren Loher" <[email-masked]>
Date: Fri, 10 Jun 2005 12:57:55 -0700

I agree with Emek that #4 and #5 are important problems when using NAT.
But I think wether communication is lost via NAT distruption/reboot,
link issues or other reasons, a reasonable CAPWAP implementation should
have a method to survive a lost connection and restore the connection
between WTP and AC.  

Connection integrity/keepalive type functions which would address
problems like these probably do not need to be explicit requirements.

-Darren

> -----Original Message-----
> From: Sadot, Emek (Emek) [mailto:[email-masked]]
> Sent: Friday, June 10, 2005 8:52 AM
> To: Pat Calhoun; David T. Perkins; Darren Loher
> Cc: Cheng Hong; [email-masked]
> Subject: RE: [Capwap] NAT traversal
> 
> Pat,
> 
> Compare to other along-the-way network appliances NAT device reboot
> presents communication challenge as parties (e.g. AC and WTP) need to
> proactively resume communication / protocol from the private side of
the
> NAT. I would say that the CAPWAP protocol can come up with a solution
> for #4 that will covers #5 scenario as well.
> 
> Emek
> 
> -----Original Message-----
> From: Pat Calhoun [mailto:[email-masked]]
> Sent: Friday, June 10, 2005 8:45 AM
> To: Sadot, Emek (Emek); 'David T. Perkins'; 'Darren Loher'
> Cc: 'Cheng Hong'; [email-masked]
> Subject: RE: [Capwap] NAT traversal
> 
> I am ok with most statements here, but not necessarily with number 5.
I
> don't think we need to go as far as to try to create a protocol that
can
> guard itself against broken NAT infrastructure.
> 
> Pat Calhoun
> CTO, Wireless Networking Business Unit
> Cisco Systems
> 
> 
> 
> > -----Original Message-----
> > From: Sadot, Emek (Emek) [mailto:[email-masked]]
> > Sent: Thursday, June 09, 2005 8:27 PM
> > To: David T. Perkins; Darren Loher
> > Cc: Pat Calhoun; Cheng Hong; [email-masked]
> > Subject: RE: [Capwap] NAT traversal
> >
> > David,
> >
> > Excellent diagram. Respectfully I would avoid naming "Internet" as
NAT
> 
> > device can segregate Enterprise's internal segments. A second WTP in
> > the private domain (10.1.2.2) may be helpful as well.
> >
> > A few problems presented by a NAT device:
> > 1. NAT manipulate layer 4 ports -> CAPWAP protocol cannot be layer 3
> > protocol based.
> > 2. Symmetric NAT will drop AC communicating with the WTP unless the
> > WTP initiate the communication first.
> > 3. WTP unique identification at the AC must not by WTP's IP address
> > (and
> > port) based.
> > 4. WTP to AC CAPWAP session must be refreshed at the NAT device.
> > 5. CAPWAP protocol shall be immunized against NAT device crash. More
> > specifically, since session mapping will be erased at the NAT device
> > the WTP (in contrast to the AC) must send CAPWAP to resume
> > communication.
> >
> > Emek
> >
> >
> > -----Original Message-----
> > From: David T. Perkins [mailto:[email-masked]]
> > Sent: Thursday, June 09, 2005 8:20 PM
> > To: Darren Loher
> > Cc: Pat Calhoun; Cheng Hong; Sadot, Emek (Emek); [email-masked]
> > Subject: RE: [Capwap] NAT traversal
> >
> > HI Darren & Pat,
> >
> > I'm still having a problem understanding what you are trying to
> > accomplish.
> >
> > Here is a picture....
> >
> >
> >   /------------\   209.128.82.1   10.1.1.1 /---------------\
> >  |             |           ----------     |                 |
> >  | Internet    |-----------|NAT box |-----|Private Network  |
> >  |             |---        ----------     |(say 10.1.1.0/16)|
> >   \-----------/    \                       \---------------/
> >        |            \                        |
> >        AC            \                      WTP     STA-IP=?
> >    209.128.82.62      \                  10.1.2.1
> >                        \                   /---------------\
> >                         \  ----------     |                 |
> >                          --|NAT box |-----|Private Network  |
> >                            ----------     |(say 10.1.1.0/16)|
> >                    209.128.82.2  10.1.1.1  \---------------/
> >                                              |
> >                                             WTP    STA-IP=?
> >                                          10.1.2.1
> >
> >                            More NAT boxes
> >
> > Is this what you are talking about? And If so, tell me again what
> > problem are you trying to solve, or service that you are wanting to
> > provide?
> >
> > Regards,
> > /david t. perkins
> >
> > On Thu, 9 Jun 2005, Darren Loher wrote:
> > > On the requirements side for NAT, should we specify if the WTP is
> > behind
> > > NAT, the AC behind NAT or both?  I can see two basic scenarios
> > > realistically being implemented:
> > >
> > >
> > >
> > > Assume:
> > >
> > > - Hotspot provider uses whatever available broadband
> > connection as an
> > > Internet uplink
> > >
> > > -This connection is limited to one, dynamically assigned IP
address
> > >
> > > -NAT is required to share the connection with multiple hosts
> > >
> > >
> > >
> > > Scenario 1: The hotspot provider's AC is on the open Internet
> > >
> > > Scenario 2: The hotspot provider's AC is behind a NAT
> > firewall and the
> > > hotspot provider has port forwarding and/or static NAT
> > control of this
> > > firewall
> > >
> > >
> > >
> > > There could be several more, but these seem very common and
> > > straightforward.
> > >
> > >
> > >
> > > -Darren
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > ________________________________
> > >
> > > From: [email-masked]
> > [mailto:[email-masked]] On
> > > Behalf Of Pat Calhoun
> > > Sent: Thursday, June 09, 2005 7:19 AM
> > > To: 'Cheng Hong'; 'Sadot, Emek (Emek)'; [email-masked]
> > > Subject: RE: [Capwap] NAT traversal
> > >
> > >
> > >
> > > Imagine a service provider connecting their AC to their customer's
> > WTPs
> > > across a NAT. Makes sense to me.
> > >
> > >
> > >
> > > Pat Calhoun
> > > CTO, Wireless Networking Business Unit Cisco Systems
> > >
> > >
> > >
> > >
> > >
> > >
> > > ________________________________
> > >
> > >
> > > 	From: [email-masked]
> > > [mailto:[email-masked]] On Behalf Of Cheng Hong
> > > 	Sent: Thursday, June 09, 2005 12:52 AM
> > > 	To: Sadot, Emek (Emek); [email-masked]
> > > 	Subject: RE: [Capwap] NAT traversal
> > >
> > > 	Hi Emek,
> > >
> > >
> > >
> > > 	Would like to know a bit more about the deployment examples:
> > >
> > >
> > >
> > > 	>>say the WTP is located at branch office and the AC at
> > the main
> > > office separated by NAT device
> > >
> > >
> > >
> > > 	In this case, most likely the NAT traversal is not a
> > problem for the
> > > WTP or AC directly. For the branch office and main office case,
> > most
> > > likely there will be a VPN setup between them. To the WTP
> > and AC, NAT
> > > will be transparent.
> > >
> > >
> > >
> > > 	 >>or within an Enterprise segregated by NAT devices.
> > >
> > >
> > >
> > > 	Does this mean AC and WTP are on different side of the
> > NAT? It sounds
> > > interesting, but is there any reason for deploy it in such a
> > way
> > > (A NAT inside the enterprise network to separate the AC and WTP)?
> > >
> > >
> > >
> > > 	cheers
> > >
> > >
> > >
> > > 	Cheng Hong
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > ________________________________
> > >
> > >
> > > 		From: [email-masked]
> > > [mailto:[email-masked]] On Behalf Of Sadot, Emek (Emek)
> > > 		Sent: Wednesday, June 08, 2005 4:27 AM
> > > 		To: [email-masked]
> > > 		Subject: [Capwap] NAT traversal
> > >
> > > 		All,
> > >
> > >
> > >
> > > 		Would like to suggest adding a NAT traversal
> > requirement to the
> > > CAPWAP objective document, i.e. the ability of AC and WTP to
> > > communicate across NAT device (UDP / TCP transport, refresh CAPWAP
> > > session at the NAT device, WTP identification behind NAT device,
> > etc.).
> > > Deployment examples? say the WTP is located at branch office and
the
> > AC
> > > at the main office separated by NAT device, or within an
Enterprise
> > > segregated by NAT devices.
> > >
> > >
> > >
> > > 		Regards,
> > >
> > > 		Emek
> > >
> > >

_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap

---

From: Suresh Satapati <[email-masked]>
Date: Mon, 13 Jun 2005 09:01:30 -0700

> I agree with Emek that #4 and #5 are important problems when using NAT.

Agreed. Also agree with the two high level scenarios :-
1. WTP behind NAT
2. AC behind NAT

I can send some text on different types of NATs in the market place
today. We have gone through this exercise in V6OPS.  All this can go
into a separate document if the WG feels this is useful work..
 
> problems like these probably do not need to be explicit requirements.

Yes. No need for explicit requirements here..