Subject: Making the IETF meeting network more representative of the real world

From: Matt Crawford <[email-masked]>
Date: Thu, 09 Aug 2001 03:42:46 -0500

I liked Tony Hain's suggestion that the future IETF terminal room/
wireless LAN ntworks should offer NATted IPv4 and plain IPv6, to
better reflect the choices available to much of the world.  But I
don't think that puts the two on an equal footing, so in addition
the network ought to undergo an IPv6 renumbering during Wednesday.

---

From: Randy Bush <[email-masked]>
Date: Thu, 09 Aug 2001 11:16:43 +0100

> better reflect the choices available to much of the world.

i wish i could agree that they are, but the transition plan seems to
have a lot of nats in it. <sigh>

randy

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 9 Aug 2001 13:41:26 +0100

There are nats defined for those who want to use them, but the primary plan has always been dual-stack.

Tony 

-----Original Message-----
From: Randy Bush [mailto:[email-masked]]
Sent: Thursday, August 09, 2001 11:17 AM
To: Matt Crawford
Cc: [email-masked]
Subject: Re: Making the IETF meeting network more representative of the real world

randy

---

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Thu, 09 Aug 2001 21:41:51 +0900

>have a lot of nats in it. <sigh>

	you should better practice using before IETF54 (Yokohama Japan),
	as we may deploy IPv6-only terminal cluster :-):-):-)

	seriously, with the address allocation policy/status in JP I guess
	IETF54 term room may have to use IPv4 NAT or something alike.
	If you use IPv6, you should be safe.  So it's better to prepare today
	than tomorrow.

itojun

---

From: "JIM R FLEMING" <[email-masked]>
Date: Thu, 9 Aug 2001 08:50:44 -0500

----- Original Message -----
From: "Matt Crawford" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, August 09, 2001 3:42 AM
Subject: Making the IETF meeting network more representative of the real
world

> the network ought to undergo an IPv6 renumbering during Wednesday.

http://www.ietf.org/mail-archive/ietf/Current/msg12342.html
VHS vs. BETAMAX....

http://www1.ietf.org/mail-archive/ietf/Current/msg12524.html
RFC-2001-06-27-001 - Obtaining IPv8 Address Allocations

The "toy" IPv4 Internet is a sewer.
IPv8 is designed to be a swamp to cover the sewer.
IPv16 is the "high-ground"....

...here are some links...

Jim Fleming
http://www.unir.com
Mars 128n 128e
http://www.unir.com/images/architech.gif
http://www.unir.com/images/address.gif
http://www.unir.com/images/headers.gif
http://www.ntia.doc.gov/ntiahome/domainname/130dftmail/unir.txt
http://msdn.microsoft.com/downloads/sdks/platform/tpipv6/start.asp
http://www.ietf.org/mail-archive/ietf/Current/msg12213.html
http://www.ietf.org/mail-archive/ietf/Current/msg12223.html

---

From: "JIM R FLEMING" <[email-masked]>
Date: Thu, 9 Aug 2001 08:53:14 -0500

----- Original Message -----
From: "Jun-ichiro itojun Hagino" <[email-masked]>
To: "Randy Bush" <[email-masked]>
Cc: "Matt Crawford" <[email-masked]>; <[email-masked]>
Sent: Thursday, August 09, 2001 7:41 AM
Subject: Re: Making the IETF meeting network more representative of the real
world

http://www.ietf.org/mail-archive/ietf/Current/msg12342.html
VHS vs. BETAMAX....
----------------------------------
> as a temporary measure I have configured tunnel to IIJ Palo Alto device.
> the IPv6 prefix for the meeting room is 3ffe:507:1ff::/64.
>
> it would be, of course, better to have ipv6 prefix from microsoft
> research :-)

 today we've got a router operated by MS research guys, using 6to4.
 so my router have went away.
 2002:836b:2505:5::/64
----------------------------------

Do you support the new TLDs ?

http://www.ietf.org/mail-archive/ietf/Current/msg12215.html
"Proof of Concept TLD Development...and Multiple TLD Clusters"

Jim Fleming
GO Nuclear....Drop the COM !
http://www.DOT-NZ.com
http://www.NZ.Registry
6:130 - NZ World

---

From: Francis Dupont <[email-masked]>
Date: Thu, 09 Aug 2001 16:04:14 +0200

In your previous mail you wrote:

=> Matt, you have to give more details about which kind of renumbering:
 - if we simulate switch from a ISP to another one, the time scale
   will be in days and nobody will notice.
 - if we simulate a multihomed site with uplink failures, this will be
   funny but a bit unfair (until multi6 finds a solution).
Of course we should have a lot of announced prefixes, not only one
as we get here from BT (I remember we got 4 or 5 in Tokyo, and I have
3 (6bone + 2 from RIPE) at my school).

Regards

[email-masked]

PS: have we  been immune for Code Red if you have applied this here?

---

From: Matt Holdrege <[email-masked]>
Date: Thu, 09 Aug 2001 08:01:09 -0700

>         If you use IPv6, you should be safe.  So it's better to prepare today

For many or most of us, it's not a matter of our preparation. Rather it is 
the matter of infrastructure support for IPv6. Until our corporate and ISP 
and operating system and application infrastructures support IPv6, we 
unfortunately must remain IPv4 users. So I humbly request that all IETF 
meetings support NAT-free pure IPv4 networks for use by IETF attendees. 
Pure IPv6 networks would be good too!

---

From: Keith Moore <[email-masked]>
Date: Thu, 09 Aug 2001 11:05:09 -0400

if we're going to make the IETF network representative of the real world,
perhaps we should block outgoing traffic to port 25 and incoming traffic
to port 80 also, since real world ISPs are doing this.  perhaps we should 
also block multicast, since most ISPs don't support it.  or maybe we should
have all incoming traffic sent through a firewall which corrupts that
traffic, since that's also common in the real world.  and we should
limit everyone to 56k of bandwidth since most users are still on v.90
modems (or worse).  and we should hire folks to monitor usage to make
sure that no IETF participants are using the net inappropriately, since 
that is what many employers do.

I understand the desire to have IETF folks understand the real world.
but most of us already understand that the real world is severely broken.
our (very difficult) task is to make it less broken.

maybe instead of trying to reinforce current notions of the "real world",
our goal should instead be to expose IETF participants to what the net 
*could* be like if we solved some of these (very real) problems.

Keith

---

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Fri, 10 Aug 2001 00:14:06 +0900

>Pure IPv6 networks would be good too!

	1. so, try to support IPv6 in your corporate network as well as your
	   email server sooner than later.
	2. use IPv6-to-IPv4 translator, supposedly available at the venue
	   (your laptop = IPv6, corporate = IPv4).

itojun

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 9 Aug 2001 16:56:14 +0100

Matt Holdrege wrote:

> So I humbly request that all IETF meetings support NAT-free 
> pure IPv4 networks for use by IETF attendees.

Matt, I thought a co-chair of the NAT WG would actually support 
the proposal. :) 

Seriously, are we really saying that NAT is great for consumers,
but keep them away from the IETF network because we *know* it won't
work? 

BTW: I would actually support having the public address/prefix 
of both IPv4 & IPv6 change daily (say 5 am when everyone has 
finally called it a day). If we are ever going to make the 
mechanisms work correctly, we have to live with them and not just
talk about them.

Tony

---

From: Bill Manning <[email-masked]>
Date: Thu, 9 Aug 2001 09:11:08 -0700 (PDT)

% BTW: I would actually support having the public address/prefix 
% of both IPv4 & IPv6 change daily (say 5 am when everyone has 
% finally called it a day). If we are ever going to make the 
% mechanisms work correctly, we have to live with them and not just
% talk about them.

	In the "always on" Internet, 05:00 is just as 
	problematic as 11:00 or 17:00.  To really test the
	viability of NAT/renumbering, it should be done 
	when there is a load. 

% 
% Tony 
% 
% 

-- 
--bill

---

From: Keith Moore <[email-masked]>
Date: Thu, 09 Aug 2001 13:11:38 -0400

> but keep them away from the IETF network because we *know* it won't

it's actually the opposite:

- we *know* that NAT has limited applicability and interferes with
  applications that consumers/customers want to deploy 

- at the same time most IETF attendees aren't doing things that NATs
  would break.  

however "most" does not mean "all", and there has traditionally been
some use of the IETF network to test prototypes of new and innovative 
applications.  imposing NATs on the IETF network would limit the 
capability of the network to support such tests.

Keith

---

From: Matt Holdrege <[email-masked]>
Date: Thu, 09 Aug 2001 11:11:35 -0700

>            (your laptop = IPv6, corporate = IPv4).

I don't think too many CEO's come to the IETF, so we can't force our 
companies to move to IPv6. This is especially true in large companies. And 
if our companies or jobs require us to use applications and OS's that do 
not support IPv6, then we cannot yet make the change on our laptops.

---

From: Matt Holdrege <[email-masked]>
Date: Thu, 09 Aug 2001 11:16:20 -0700

>Matt, I thought a co-chair of the NAT WG would actually support

Being the chair means that I know how bad NAT is. Why would I want the IETF 
terminal room to use it?

>but keep them away from the IETF network because we *know* it won't

The terminal room and wireless network at IETF meetings are *working* 
networks. They aren't for playing around. We've been there and done that 
and it isn't fun.

---

From: Matt Holdrege <[email-masked]>
Date: Thu, 09 Aug 2001 11:20:25 -0700

>- at the same time most IETF attendees aren't doing things that NATs

Wrong! Most IETF'ers I know tunnel back to their home offices. I personally 
use an IPsec/IKE implementation that doesn't care much for NAT.

---

From: Keith Moore <[email-masked]>
Date: Thu, 09 Aug 2001 14:22:36 -0400

> Wrong! Most IETF'ers I know tunnel back to their home offices. 

gee, it's good to know that those "home offices" don't use NAT either...  

(most of the folks I know use ssh to tunnel back home)

Keith

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 9 Aug 2001 20:37:51 +0100

>         viability of NAT/renumbering, it should be done

No argument, I was just trying to recognize that many people 
here have longer lived connections than average, but most are
trying to get a little sleep around that time.

Tony

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 9 Aug 2001 20:43:07 +0100

Keith Moore wrote:

> ... imposing NATs on the IETF network would limit the

Obviously you missed the point that native IPv6 would be available.
Why would we want to support any further development of IPv4 only
apps? 

Tony

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 9 Aug 2001 20:56:03 +0100

Matt Holdrege wrote:

> The terminal room and wireless network at IETF meetings are 
> *working* networks. They aren't for playing around. We've 
> been there and done that and it isn't fun.

I am not suggesting playing around. Either the products are useful
and solve the problem or they are not. Since a large number of 
people believe that NAT solves our problems, I have to conclude 
there must be useful products. The alternative is that these people 
believe NAT is fine because they never have to use it to realize 
that the products don't really work in that environment. If the 
latter is the case then the debate should end, NAT should be 
declared historic, and all IPv4 focused WGs should be shut down. 

Tony

---

From: Lloyd Wood <[email-masked]>
Date: Thu, 9 Aug 2001 21:00:37 +0100 (BST)

> Being the chair means that I know how bad NAT is. Why would I want the IETF 

Well, the IETF London terminal room is being run by BT, and since
Openworld (slightly ironic name) does NAT its paying ADSL customers,
it's only fair to them.

http://www.slashdot.org/articles/00/04/27/0836222.shtml

of course, the terminal room should really be on ADSL too, and we may
need to wait until ADSL reaches the area of the hotel.

(Shouldn't sampling the local culture include sampling the
local telecoms in full?)

L.

> networks. They aren't for playing around. We've been there and done that 

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: RJ Atkinson <[email-masked]>
Date: Thu, 09 Aug 2001 16:53:27 -0400

At 14:20 09/08/01, Matt Holdrege wrote:
>Wrong! Most IETF'ers I know tunnel back to their home offices. I personally use an IPsec/IKE implementation that doesn't care much for NAT.

If the remote ESP tunnel endpoint (and IKE KM endpoint) is on the 
external interface of a box that is also performing NAT on the inside
interface, there just isn't a problem.  Lots of the economical
gateway/firewall/encryptor widgets work this way.  This approach 
actually works quite well, particularly if one's employer has an
internal network using private address space.

This approach does mean that the mobile host has a different IP address 
for the RED ESP network interface than for its BLACK physical network 
interface.  Laptops at IETF with ESP tunnels back to one's employer 
date back at least to late 1995, when danmcd was doing it (complete 
with automated session key change every 24 hours), though he wasn't
using NAT (employer had lots of globally routable IP addresses).

Mind, the original designer of ESP/AH erroneously thought that 
ESP/AH would mainly be used to provide end-to-end security,
rather than gateway-to-gateway security (which is how it has 
played out).  

Cheers,

Ran
[email-masked]

---

From: Matt Holdrege <[email-masked]>
Date: Thu, 09 Aug 2001 16:03:42 -0700

At 01:53 PM 8/9/2001, RJ Atkinson wrote:
> >Wrong! Most IETF'ers I know tunnel back to their home offices. I 
> personally use an IPsec/IKE implementation that doesn't care much for NAT.
>

Yes but this would be ESP/IKE IPv4 laptops running through whatever NAT 
would be provided by the local IETF host through the Internet and to the 
corporate network. It doesn't matter that the corporate firewall/IPsec 
endpoint does NAT unless of course both sides use the same address range 
(that would not be nice).

---

From: "James S. Binder" <[email-masked]>
Date: Thu, 9 Aug 2001 16:32:49 -0700

A lot of companies are starting to do UDP tunneling between their client and
gateway (well at least Cisco's latest Windows client does).  Then, NAT isn't
a issue if the option is enabled at the gateway.

/jsb

---

From: Dave Crocker <[email-masked]>
Date: Tue, 14 Aug 2001 17:58:57 +0100

> > better reflect the choices available to much of the world.

Oddly, I thought that the IETF network was intended to be a utility service 
network, for use by participants, rather than a demonstration effort for 
various educational (or experimental) goals.

The rule that engineers (and others) should live with what they impose on 
their customers is generally a good one, but the IETF event permits no 
serious learning, just an opportunity for communications hassles during a 
critical week.

d/

----------
Dave Crocker  <mailto:[email-masked]>
Brandenburg InternetWorking  <http://www.brandenburg.com>
tel +1.408.246.8253;  fax +1.408.273.6464