Subject: Re: [arch-d] Valid and Invalid Internet architectures and approaches

From: Brian E Carpenter <[email-masked]>
Date: Mon, 06 Mar 2006 13:51:10 +0100

Oh Tony, you've woken me up ;-)

Tony Li wrote:
> Thomas,
> 
> Architectural proposals have been lofted.  They were specific, had clear
> migration plans, and the discussion was shut down with the usual "v6 has
> already shipped" dogma.  Specific topics were:
> 
> 	- GSE (more generally locator/identifier splits)
> 	- locator agile transport protocols
> 
> Without these types of capabilities, the architecture is stuck
> supporting multihoming and mobility with kludges such as NAT, SHIM6 (NAT
> in the host), and various forms of tunneling.

I don't understand why you disparage SHIM6 (end-to-end NAT-in-the-host)
but don't disparage GSE (edge-to-edge NAT-in-the-router). It was thinking
about the end-to-end problems created by GSE that led directly to the
conception of SHIM6. If one is a kludge, so is the other. They both result
in the upper layer protocol using a different "address" than the routing
system to identify a session. Viewed at an appropriate distance, they
are isomorphic.

The common point is that by doing *and undoing* the NAT action at both ends,
the essential end-to-end properties of IP datagrams are not destroyed.
Viewed at a slightly greater distance, they are both isomorphic with
map-and-encap.

> 
> To truly move forward, we first need to have consensus on the following:
> 
> 	- We have a problem.

Which needs to be described with precision

> 	- The current crop of solutions are unsatisfactory.

Which needs to be justified.

> 	- We are willing to make changes.

Who's we? That's not intended flippantly - "we" would need to
figure out in detail exactly who needs to be on board.

     Brian
> 
> Until then, we have the status quo.
> 
> Tony
> 
> _______________________________________________
> Architecture-discuss mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/architecture-discuss
> 

_______________________________________________
Architecture-discuss mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/architecture-discuss

---

From: Fred Baker <[email-masked]>
Date: Mon, 6 Mar 2006 16:15:09 -0800

not sure I agree with that.

Map/encap permits me, knowing the global identity of a remote system,  
to use a tunnel-or-equivalent to get a message to it. NATs prevent  
the remote system from having a global identity, which makes it  
harder for me to send a message to the device. It is for this reason  
that marketing people sell NAT as a security solution.

---

From: Tony Li <[email-masked]>
Date: Tue, 07 Mar 2006 00:28:20 -0800

Brian,

> conception of SHIM6. 

I don't consider NAT to be disparagement -- just taxonomy.  Yes,
architecturally NAT is a kludge, but I'm fine with judiciously applied
kludges.  Sometimes kludges are *THE* pragmatic approach to forward
progress.  If you have further questions concerning my tolerance for
kludges, I suggest that you consult any of my former IOS development
colleagues -- they will probably give you an earful.  ;-)

As to GSE, I'm not sure that I consider GSE to be in the exact same
realm as NAT.  Yes, architecturally, swapping locators around offends my
sense of preserving the pristine packet (as does modifying the DSCP),
but inherently the locator is an ephemeral entity, much as a transient
MAC address on the frame, somewhere in the middle of a transit ISP.  In
GSE, the EID is the true invariant in the packet, providing end-to-end
context.

Tony

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 07 Mar 2006 12:04:53 +0100

Fred Baker wrote:
> to use a tunnel-or-equivalent to get a message to it. NATs prevent  the 
> remote system from having a global identity, which makes it  harder for 
> me to send a message to the device. It is for this reason  that 
> marketing people sell NAT as a security solution.

Single ended NAT, for sure. I was talking about double ended NAT,
where there is some sort of e2e identity. Admittedly, there are
probably precisely zero of those deployed today.

    Brian