Subject: [Pana] NAT issue

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 8 Mar 2007 22:39:51 -0500

In the current draft:

"
   When the PANA message is sent in response to a request, the UDP
   source and destination ports of the response message MUST be copied
   from the destination and source ports of the request message,
   respectively.

   For other PANA messages, the source port MUST be set to a value
   chosen by the sender and the destination port MUST be set to the
   assigned PANA port (To Be Assigned by IANA).
"

According to this, a PAA-originated request will be always sent to
PANA port.  If there is a NAT between PaC and PAA, this does not seem
to work, because the NAT is typically expecting incoming messages to
be received on the port that was used as the source port of outgoing
messages.

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Tschofenig, Hannes" <[email-masked]>
Date: Fri, 9 Mar 2007 11:27:13 +0100

Good catch, Yoshi. 

I assume that you would like to fix it by sending PAA initiated messages to the port and address of the last received message. 

Ciao
Hannes
 
> -----Ursprüngliche Nachricht-----
> Von: Yoshihiro Ohba [mailto:[email-masked]] 
> Gesendet: Freitag, 9. März 2007 04:40
> An: [email-masked]
> Betreff: [Pana] NAT issue
> 
> In the current draft:
> 
> "

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 09 Mar 2007 07:57:12 -0500

> I assume that you would like to fix it by sending PAA initiated messages to the port and address of the last received message. 

Yes, and we still need to make sure that one of source and destination
ports of any PANA message carries well-known PANA port.

Yoshihiro Ohba

---

From: "Alper Yegin" <[email-masked]>
Date: Fri, 9 Mar 2007 15:34:35 +0200

> > I assume that you would like to fix it by sending PAA initiated messages
> to the port and address of the last received message.
> 

... so that sniffers can still catch the PANA signals.

Also, PAA cannot initiate a PANA session with a PaC behind the NAT. Session can only be initiated by the PaC in that case (by sending the PCI). 

Alper

> 
> Yoshihiro Ohba
> 
> 
> 
> >
> > Ciao
> > Hannes
> >
> > > -----Urspr醇・gliche Nachricht-----
> > > Gesendet: Freitag, 9. M醇Brz 2007 04:40
> > > An: [email-masked]