Subject: Re: Last Call: 'Teredo: Tunneling IPv6 over UDP through NATs' to Proposed Standard

From: Francis Dupont <[email-masked]>
Date: Mon, 27 Sep 2004 12:27:12 +0200

Some comments about draft-huitema-v6ops-teredo-02.txt:
 - correct spelling of IPSEC is IPsec (cf draft-ietf-ipsec-rfc2401bis-03.txt)
 - there is a "retricted" in 3.1
 - to be complete the document should explain why it can't support
   symmetric NATs
 - IMHO section 3.1 should have a statement about multiple NATs
 - I don't believe the protocol works with NATs using global addresses
   on both sides (yes, this is a stupid way to use NATs but one can say
   that using NATs is already stupid :-)
 - a client can work only when it knows at least a server address.
   Obviously this can become an operational issue. I don't understand
   why there is nothing about an anycast IPv4 server address (i.e.,
   the document should explain why this does/doesn't work).
 + (not editorial) 6to4 has the major drawback that it can give on
   the long term two IPv6 Internets, the native one and the 6to4 one.
   Teredo is carefully specified to avoid this issue.
 - last point is more serious: according to NAT classification stats
   (draft-jennings-midcom-stun-results-01.txt), many NATs are symmetrical
   but try to keep the source port so they behave as port restricted
   cone NATs *until* two internal clients try to use the same server...
   So perhaps in a common case Teredo just pretends to work?

Thanks

[email-masked]

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Mon, 27 Sep 2004 07:53:03 -0700

>    that using NATs is already stupid :-)

If you mean "non-private" on both sides, there is a very good reason 
for such NATs (well, if you believe that there is any reason for 
NATs). You have a Class C from your ISP and have hard-wired values in 
dozens of boxes, have gotten certificates for some of the IP 
addresses, have hard-wired the IP address in other places, and so on. 
One day they call and say "we've changed your IP range just because 
we can". Tossing everything behind a NAT using the old addresses 
keeps everything working until you can handle the transition.

--Paul Hoffman, Director
--VPN Consortium

---

From: Jeroen Massar <[email-masked]>
Date: Mon, 27 Sep 2004 17:14:19 +0200

> keeps everything working until you can handle the transition.

As a "Director" (of what that may be) you probably also know of these
papers called 'contracts'. Thus make sure you have that sort of stuff in
your contract. There was a couple of months ago even some weird company
who abused their network and then got disconnected and almost got the
court to let them keep their addresses... Not a technical issue and thus
irrelevant.

Greets,
 Jeroen

---

From: Joe Abley <[email-masked]>
Date: Mon, 27 Sep 2004 11:37:01 -0400

On 27 Sep 2004, at 11:14, Jeroen Massar wrote:

> your contract.

Regardless, there are circumstances where IPv4 renumbering is 
necessary, and hence the original point (that there is practical 
application for a NAT with non-private-use addresses on both sides) is 
a valid and reasonable one.

Many small hosting companies who do not provide access do not qualify 
for PI allocations from some RIRs, for example, and for them 
renumbering is required every time they change provider.

Joe