Subject: RE: 6to4 vs forwarding IP proto41 in NAT

From: "Christian Huitema" <[email-masked]>
Date: Tue, 15 Jul 2003 08:17:33 -0700

No, it will not work. The NAT that implements 6to4 will decapsulate all packets that it receives as if they were meant for the local 6to4 router. If the packets have a "wrong" destination address, it should implement the behavior recommended in the 6to4 security recommendations, i.e. drop the packet. 

________________________________

From: [email-masked] on behalf of Alain Durand
Sent: Tue 7/15/2003 8:01 AM
To: [email-masked]
Subject: 6to4 vs forwarding IP proto41 in NAT

A NAT box could do the following when receiving an IPv6 packet
encapsulated in IPv4 with proto 41:

If IPv6 dst does not belong to the local 6to4 /48 prefix, forward
internally,
else decapsulate.

Why will will not work?

        - Alain.

---

From: "Christian Huitema" <[email-masked]>
Date: Tue, 15 Jul 2003 08:22:50 -0700

On Windows XP, with IPv6 enabled, if you ask to "share a link", the PC will behave as an IPv4 NAT (using ICS) and as a 6to4 router. So I guess there is at least one example of "NAT that is also a 6to4 router."

From: [email-masked] on behalf of Tim Chown
Sent: Tue 7/15/2003 8:08 AM
To: [email-masked]
Subject: Re: 6to4 vs forwarding IP proto41 in NAT

The advantage for plain proto41 forwarding is that you don't have to
decapsulate for it to work - just pass it on :)  The NAT web config
screen can just have a checkbox to forward proto41 and a field to
specify the RFC1918 address to forward it to.

But agreed if the vendor is implementing 6to4, there is no reason why they
couldn't choose to do this.

I wouldn't like to lose the ability to run a tunnel broker client inside my
network (for a host or network broker client) because of 6to4 support on
the router (which I applaud - and I'd be interested to know which vendors
are implementing it... Christian?)

Of course ideally we want IPv6 natively, but...

Tim

---

From: "Bound, Jim" <[email-masked]>
Date: Wed, 16 Jul 2003 09:14:37 -0400

thats one solution. the other is what Jordi proposes to get NAT vendors
to support this outside of the PC and plethora of devices in the home.
/jim

> -----Original Message-----
> From: Christian Huitema [mailto:[email-masked]] 
> Sent: Tuesday, July 15, 2003 11:23 AM
> To: Tim Chown; [email-masked]
> Subject: RE: 6to4 vs forwarding IP proto41 in NAT
> 
> 
> On Windows XP, with IPv6 enabled, if you ask to "share a 
> link", the PC will behave as an IPv4 NAT (using ICS) and as a 
> 6to4 router. So I guess there is at least one example of "NAT 
> that is also a 6to4 router."
> 
> The advantage for plain proto41 forwarding is that you don't 
> have to decapsulate for it to work - just pass it on :)  The 
> NAT web config screen can just have a checkbox to forward 
> proto41 and a field to specify the RFC1918 address to forward it to.
> 
> But agreed if the vendor is implementing 6to4, there is no 
> reason why they couldn't choose to do this.
> 
> I wouldn't like to lose the ability to run a tunnel broker 
> client inside my network (for a host or network broker 
> client) because of 6to4 support on the router (which I 
> applaud - and I'd be interested to know which vendors are 
> implementing it... Christian?)
> 
> > internally, else decapsulate.
> >
> > Why will will not work?
> >
> >       - Alain.
> >
> 
> 
> 
> 
>

---

From: "Bound, Jim" <[email-masked]>
Date: Wed, 16 Jul 2003 09:24:37 -0400

because if the nat vendors have guidance to pass through proto 41 and
ISPs will decap IPv6 can be used as tunnel to the outside word for two
IPv6 nodes to communicate using IPv6 all be it with IPv4.  It gives
reason to nat and isps to do init ipv6.  also permits other options and
that is the work of this draft to flush out.  if we don't flush it out
then I agree.  but this also would permit tunnel brokers which I think
are a good idea for home use.  we will learn and expand from pekkas list
he sent from this exercise and why jordis work is important for us as
engineers working on transition to analyze.

/jim

> From: HELENA RUTE SOFIA [mailto:[email-masked]] 
> Sent: Wednesday, July 16, 2003 3:20 AM
> To: JORDI PALET MARTINEZ
> Cc: [email-masked]
> One thing that is really puzzling me about this draft is: do 
> we really need this?? There are currently two options that 
> have "more" priority in terms of implementation, i.e., v6 and 
> 6to4...so why try to create a document on something that is 
> currently assumed to work, and that is only used as a "hack", 
> when one of the other two is not working?? Why do we need a 
> document on this?
> 
> Rute
> 
> 
> On Tue, 15 Jul 2003, JORDI PALET MARTINEZ wrote:
> 
> > Agree, it should work.
> >
> > Regards,
> > Jordi
> >
> > ----- Original Message -----
> > From: "Alain Durand" <[email-masked]>
> > To: <[email-masked]>
> > Sent: Tuesday, July 15, 2003 5:01 PM
> > *****************************
> > Madrid 2003 Global IPv6 Summit
> > Presentations and videos on-line at:
> > http://www.ipv6-es.com
> >
> >
> >
> 
> 
>

---

From: "Bound, Jim" <[email-masked]>
Date: Wed, 16 Jul 2003 09:39:24 -0400

> I understand the point of your document, but really do not 
> see a place for it... It's not so much a question of the 
> "mechanism" (it is here; it is used sometimes), but really, a 
> question of the purpose of the document. There has to be a 
> clear purpose (and maybe I'm missing it), otherwise, we just 
> end up adding more entropy...Can you please answer clearly 
> the following questions:
> 
> 1) does the document introduce a *significant* contribution 
> to current deployment status?

Yes.  We want many options for transition this is investigation and we
do investigation. We are not done yet.

> 2) if something should be forced to vendors, that should be 
> either ipv6 or 6to4 ;-). Why impose a third option, given 
> that only a subset of scenarios will *possibly* gain with it ??

Nothing forces vendors other than the market.  And all users I know do
not only want the two you list.  So we disagree on that base assumption
of the market and users.

/jim
> 
> And, a bit out of scope in technical terms...out of 
> curiosity, if you already have an "updated" version of the 
> draft (updated in which sense??), why didn't you present it yesterday?
> 
> thanks,
> rute
> 
> 
>