Subject: RE: WG Last Call: draft-ietf-v6ops-unmaneval-01.txt

From: "Christian Huitema" <[email-masked]>
Date: Sun, 29 Feb 2004 23:12:01 -0800

A couple of quick points regarding Teredo:
 
> >    In automatic tunnels like [Teredo] and [6to4], the bulk of the
> >    traffic between two nodes using the same technology is exchanged
on
> >    a direct path between the endpoints, using the IPv4 services to
> >    which the endpoints already subscribe. By contrast, the
configured
> >    tunnel servers carry all the traffic exchanged by the tunnel
client.
> >
> > <MB> Is "direct path always possible in all cases between Teredo
nodes?
> > </MB>
> 
> It isn't and this should be reflected here.

Actually, in the current design either all traffic will go on the direct
path, or no traffic will be exchanged at all.

> > ...
> >    by many applications, e.g., networked games or voice over IP. The
> >    experience shows that most recent "home routers" are designed to
> >    support these applications. In some edge cases, the automatic
> >    solutions will require explicit configuration of a port in the
home
> >    router, using the so-called "DMZ" functions.
> >
> > <MB>only works for one single node. Moreover, it should be noted
that
> this
> > explicit configuration is completly out of the _unmanaged_ goal.
> >
> > Suggesting text:
> > using the so-called "DMZ" functions". These cases are obviously out
of
> > scope of the unmanaged network scenario and only work for a single
node
> > behind the NAT.
> > </MB>
> Good point.

I agree that in the absence of automatic support through UPNP, DMZ
functions are indeed not your typical unmanaged service. But the point
is at least partially incorrect. First, it is possible in some cases to
use automatic procedures to "DMZ" a port (e.g., using the UPNP "internet
gateway device" service). Second, the procedure that absolutely work for
more than one node -- just pick a different port for each node. 

In any case, the work done in the MIDCOM working group shows that the
number of symmetric NAT in the market is rapidly decreasing. See
draft-jennings-midcom-stun-results-00.txt

-- Christian Huitema

---

From: Pekka Savola <[email-masked]>
Date: Mon, 1 Mar 2004 17:19:50 +0200 (EET)

> path, or no traffic will be exchanged at all.

It is true that this is an all-traffic/no-traffic issue (the latter 
caused by a flavor of NATs).  But aren't the latter ones, still, by 
definition Teredo nodes?

> more than one node -- just pick a different port for each node. 

I'm not sure that UPNP is a solution we can be referring to.
 
> draft-jennings-midcom-stun-results-00.txt

Sigh -- replacing "secure" NAT boxes with "insecure" ones.
Now I'm done -- I said "secure NAT"! :-)

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Marc Blanchet <[email-masked]>
Date: Mon, 01 Mar 2004 10:30:53 -0500

> I'm not sure that UPNP is a solution we can be referring to.

agree. unless I'm not aware, UPNP is not an IETF standard?

> Now I'm done -- I said "secure NAT"! :-)

agree.
- this argument of "most are not" does not go far to me. We are talking
about a protocol proposal which is based on some proportion of market place
and some internal behavior of devices that were never specified before
implemented and that we don't know what is out there. In the case that
these devices happen to exist (which is the case), the protocol proposal
does not work. 

Marc.

------------------------------------------
Marc Blanchet
Hexago
tel: +1-418-266-5533x225
------------------------------------------
http://www.freenet6.net: IPv6 connectivity
------------------------------------------