Subject: Re: [IPsec] FW: New Version Notification for draft-suram-dynamic-nat-traversal-00.txt

From: "[email-masked]" <[email-masked]>
Date: Mon, 6 Apr 2015 18:40:10 +0000

Hi,

Very sorry for the late reply.

We have considered roaming VPN client scenario where MOBIKE may not be required, 

NAT can be enabled or disabled any time due to administrative reasons.

Thanks
Jyothi

-----Original Message-----
From: IPsec [mailto:[email-masked]] On Behalf Of Tero Kivinen
Sent: Monday, March 30, 2015 6:46 PM
To: Suram Chandra Sekhar-B38523
Cc: [email-masked]
Subject: [IPsec] FW: New Version Notification for draft-suram-dynamic-nat-traversal-00.txt

[email-masked] writes:
> A new Internet Draft is posted to the working group.
> The draft addresses a problem where NAT is enabled dynamically (after 
> IPsec SA is created) because of which traffic stops.

This is already supported when MOBIKE is used, and without MOBIKE the IP-addresses cannot change, thus NAT cannot suddenly appear in the middle.

Can you explain in which situations the NAT will be enbled after the
IKEv2 connection has been creteated in such way that IP-addresses of both end points stay same?

If the IP-addresses change, then to be able to keep the same IKEv2 connection you need to use MOBIKE and MOBIKE will already automatically enable NAT if it detects NAT while moving traffic from one IP-address to another.

> The draft uses the existing IKEv2 framework (without defining any new 
> payloads) and maintains backward compatibility with older 
> implementations of IKEv2 that does not support this draft.
> 
> We request your feedback on the same.

Can you explain what is problem with the already standardized solution to this problem, and why do you think it does not solve the issue?
--
[email-masked]

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 7 Apr 2015 12:04:24 +0300

> We have considered roaming VPN client scenario where MOBIKE may not

So you do not want to implement already standardized protocol to solve
the issue, and want to create new extension to solve partial issue? 

> NAT can be enabled or disabled any time due to administrative

And how is that supposed to work.

If I have network described in the draft:

   +-+-+-+-+     +-+-+-+-+ IPsec    +-+-+-+-+
   |Roaming|     |Edge   | tunnel   |Corp   |     Protected
   | User  |<--->|Router |<========>|Gateway|<--> network
   +-+-+-+-+     +-+-+-+-+          +-+-+-+-+
   	 198.	 198.   130.	    133.
	 51.	 51.	233.	    42.
	 100.	 100.	208.	    11.
	 22	 1	1	    1

I.e. Roaming user has public IP-address of 192.51.100.22, and its
default gateway is 192.51.100.1, and it uses that to connect to the
corporate gateway at ip-address 133.42.11.1.

The roaming user already has public routable IP-address which it can
use to connect to internet. What benefits you get by suddenly NAT:ing
it to some other public routable IP-address? The normal reason for NAT
is to provide ability to have multiple user sharing the same IP
address, but if roaming user already has public routable IP-address,
there is no need for that.

I do not really see what you are trying to do here, what is the reason
for this, and why it would ever be useful to add NAT for public
routable IP-address because of some adminstrative reasons? I.e. what
are those adminstrative reasons?

In normal case when you add NAT there in the middle, the roaming user
will loose its public IP-address, and then network will then be:

   +-+-+-+-+     +-+-+-+-+ IPsec    +-+-+-+-+
   |Roaming|     |Edge   | tunnel   |Corp   |     Protected
   | User  |<--->|Router |<========>|Gateway|<--> network
   +-+-+-+-+     +-+-+-+-+          +-+-+-+-+
   	 10.	 10.    130.	    133.
	 1.	 1.	233.	    42.
	 1.	 1.	208.	    11.
	 22	 1	1	    1

and that is again the case which MOBIKE was specified to solve. 
-- 
[email-masked]

---

From: "[email-masked]" <[email-masked]>
Date: Tue, 7 Apr 2015 10:27:25 +0000

Roaming user is behind the edge router.
Control of issuing address is in edge router.
Edge router may issue a public IP when NAT is not configured, later NAT configured, but IP is not changed immediately.

Thanks
Jyothi

-----Original Message-----
From: Tero Kivinen [mailto:[email-masked]] 
Sent: Tuesday, April 07, 2015 2:34 PM
To: Vemulapalli Jyothi-B37784
Cc: Suram Chandra Sekhar-B38523; [email-masked]
Subject: RE: [IPsec] FW: New Version Notification for draft-suram-dynamic-nat-traversal-00.txt

> We have considered roaming VPN client scenario where MOBIKE may not be 

So you do not want to implement already standardized protocol to solve the issue, and want to create new extension to solve partial issue? 

I.e. Roaming user has public IP-address of 192.51.100.22, and its default gateway is 192.51.100.1, and it uses that to connect to the corporate gateway at ip-address 133.42.11.1.

The roaming user already has public routable IP-address which it can use to connect to internet. What benefits you get by suddenly NAT:ing it to some other public routable IP-address? The normal reason for NAT is to provide ability to have multiple user sharing the same IP address, but if roaming user already has public routable IP-address, there is no need for that.

I do not really see what you are trying to do here, what is the reason for this, and why it would ever be useful to add NAT for public routable IP-address because of some adminstrative reasons? I.e. what are those adminstrative reasons?

In normal case when you add NAT there in the middle, the roaming user will loose its public IP-address, and then network will then be: