Subject: Re: [lisp] #7: LISP ETRs ignoring checksum value in LISP UDP outer header on decapsulation

From: [email-masked] (Noel Chiappa)
Date: Fri, 21 Aug 2009 17:18:19 -0400 (EDT)

[Separate sub-thread about working through NAT boxes - not sure how much I
can change the Subject line and have the tracker keep track of things...]

    > From: Margaret Wasserman <[email-masked]>

    > There are a number of things about the current LISP protocol that won't
    > work through NAT boxes.

I'm not really the expert on the details of LISP working through NAT boxes,
so here I'll have to call on others for help. I do think it has been tried,
or am I mis-remembering what I heard? I do know there's been a fair amount of
attention given to operation behind a NAT.

In any event, I think you've identified an excellent general point: if we
intend to have LISP work through NAT boxes, we need to survey LISP, and make
sure there no stuff that won't work there, and fix any problems we do find.

    > I know that LIG doesn't work through NAT boxes, because the response
    > comes back from a different port than the port to which the request was
    > sent.

I seem to recall Dave Meyer having a very similar problem to this, but his
was different (something about Unix and UDP ports).

    > Also, LISP allows map replies to come from a different IP address than
    > the address to which the request was sent.

That is likely something of an issue... If so, there are, I think, relatively
easy fixes for this, although they introduce a slight amount of inefficiency
- the Map-Reply just has to come via the Map-Resolver (blasted name - I keep
thinking the 'Map-Server' is what the users talk to, but of course it is a
different function :-).

And of course the LISP box has to 'know' that it's behind a NAT box, but IIRC
someone clever (Darrell?) has already worked out a way to do that, and figure
out what its 'outside' address is. Now that I mention that, I have this vague
memory that the different IP address issue was sorted as well, but that could
be wrong.

    > And AH doesn't work through NAT boxes, does it?

Depends on the type of authentication, if memory serves (i.e. all the ones
that cover the address fail).

Surely someone has defined a type of IP authentication that works through a
NAT box by now, though? The blasted things are ubiquitous...

	Noel

---

From: Sam Hartman <[email-masked]>
Date: Fri, 21 Aug 2009 21:20:33 -0400

>>>>> "Noel" == Noel Chiappa <[email-masked]> writes:

    Noel> Surely someone has defined a type of IP authentication that
    Noel> works through a NAT box by now, though? The blasted things
    Noel> are ubiquitous...

Sure.  IPsec esp-null with NAT traversal.  or ip over TLS (I don't
recommend this for us, but it's in wide use).

If we do want to do our map-register authentication based on IPsec, we
can probably make that work.