Subject: Re: [BEHAVE] [v6ops] double nat

From: "Dan Wing" <[email-masked]>
Date: Mon, 29 Oct 2012 08:49:10 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Nejc Škoberne
> Sent: Saturday, October 27, 2012 4:22 PM
> To: [email-masked]
> Subject: Re: [v6ops] double nat
> 
> Hi,
> 
> I am reviving this thread, as (AFAIK) nobody mentioned the following
> issue:
> 
> "Other aspects of NAT behaviour, notably the NAT binding lifetime and
> the form of NAT "cone behaviour" for UDP take on the more the more
> restrictive of the two NATs in sequence.
> The binding times are potentially problematical in that the two NATs are
> not synchronised in terms of binding behaviour. If the CGN has a shorter
> binding time, it is possible for the CGN to misdirect packets and cause
> application level hang ups. However this is not overly different to a
> single level NAT environment where aggressively short NAT binding times
> will also run the risk of causing application level hang ups when the
> NAT drops the binding for a active session that has been quiet for an
> extended period of time."
> 
> (Geoff Huston,
> http://www.potaroo.net/ispcol/2011-03/transtools-part2.pdf, page 7)
> 
> So binding lifetime desynch can be quite harmful here? Any real-world
> experience on this?

This question is probably better answered in BEHAVE, which I CC'd.

Yes, short binding lifetimes can cause applications to fail.  Consider,
for example, an application lets its connection sit idle and the
NAT clobbers the connection, and then re-uses that same IP address
and port for another (fresh) connection.  Eventually the application
using the old connection will send data.  Depending on if this was
TCP or UDP, and if it was the device behind the NAT or on the
Internet, all sorts of things could happen.

As Geoff wrote, this occurs with one NAT, if that NAT times out a
mapping before the hosts delete their mappings.

Yes, this happens in the wild.  But it is seldom diagnosed because 
it is difficult to recreate.

-d

> Thanks,
> Nejc
> 
> On 2.10.2012 13:54, Randy Bush wrote:
> >>> so, is double nat really worse than single nat?  is it formally
> >>> different?  except in the case of overlapping spaces, of course.
> >> One of the problems with "someone else controls your NAT" is that you
> >> can't add port mappings.  This seems to be an inevitable side effect
> >> of NAT444 (but can happen with single NAT44 as well, of course,
> >> depending on where it's placed).
> > i asked *formally*.  i am not concerned with all the ops, social,
> > stuff.  and not about issues not directly connected to the nat.
> > what does double translation do that single does not?
> >
> > randy
> > _______________________________________________
> > v6ops mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/v6ops
> 
> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops