Subject: (NAT) nat implications doc

From: "Wijnen, Bert (Bert)" <[email-masked]>
Date: Thu, 10 Aug 2000 19:36:23 +0200

On page 10 (end of Sect 5) you talk about "IP based 
authentication in SNMPv3"
Not sure where you get that from, but SNMPv3 does not do such 
things. The SNMP architecture allows SNMPv1/v2c to be
included and RFC2576, coexistence document, does talk
about possible "authentication" using IP addressses. But
not for SNMPv3. If the "SNMPv3" gets changed in just "SNMP"
I can live with it... although I still wonder why SNMP would be
singled out... are there other examples that can be added, so
as to not make SNMP stand out so "badly"

Also, on page 11 (sect 6) you list that NAT does invalidate
SNMPv3 authentication. I don't think that NAT itself does that.
The ALG that has been presented raised lots of security issues.
But if there is no ALG that needs to fiddle with the packets,
then I do not think that NAT itself invalidates the authentication
necessarily. 

Thanks,
Bert

-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.