Subject: [Hipsec] an alternative to making IPv4 NATs "HIP aware"

From: [email-masked] (Tim Shepard)
Date: Mon Oct 20 11:57:03 2003

There has been discussion about making HIP traverse IPv4 NATs.

We've broken that down into two cases:

	(1)  Making the IPv4 NAT HIP-aware
	(2)  somehow tunneling HIP through a NAT that is not aware of HIP.

I would like to point out that there is an alternative to (1) which is
to deploy RFC3056 (with RFC3068 if no better tunnel is known) at the
NAT and use IPv6 behind the NAT, and then run HIP (and ESP) over IPv6.

To complete the story, we just need to say that hosts implementing HIP
SHOULD give themselves IPv6 connectivity via RFC3056/RFC3068 if they
don't otherwise have IPv6 connectivity but do have IPv4 connectivity
that is not an RFC1918 address.

I think it would be much nicer to ask NAT implementors to do RFC3056/RFC3068
than to do something special to make their NATs HIP-aware.

What do you think?

(BTW, About 6 months ago I gave myself IPv6 connectivity at
 home using RFC3056/RFC3068.  It worked, and without me
 having to contact anyone to make arrangements for a
 tunnel. If you haven't done so yet, you should try it.)

			-Tim Shepard
			 [email-masked]