Subject: Re: OK, final NAT66 argument (Was: NAT Not Needed To Make Renumbering Easy

From: Masataka Ohta <[email-masked]>
Date: Mon, 09 Nov 2009 18:38:20 +0900

Phillip Hallam-Baker wrote:

> I assert that regardless of whether NAT66 is a good or a bad thing,
> anything that layers on IPv6 must be NAT66 tolerant.

Because IPv6 is a bad thing, there should be nothing on IPv6.

> Observation: Without NAT44 the internet would already have run out of
> address space.

Observation: With NAT44 and unicast class E (and part of D) the
IPv4 Internet would not run out of address space for the time
being.

> I think that it is
> now very clear that the IPv6 transition will take at least another
> decade

Considering that development of IPv6 did not take so many years,
it is better to have another IPng which is more easily deployable
than IPv6.

> If we accept these two observations we arrive at a proof that NAT66 is
> unavoidable.

Only if IPv6 were worth deploying.

							Masataka Ohta

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Mon, 9 Nov 2009 11:45:23 +0100

> Only if IPv6 were worth deploying.

Isn't this a little... late? A few hundred million devices are deployed 
with IPv6, including all the commonly deployed versions of Windows and 
IOS. By comparison, here's an overview of how an alternative might 
fare:

1. Some drafts are published.
2. A BOF is held at IETF77 (fortunately for this BOF, IETF77 is held in 
a country that cherishes free speech).
3. Some more drafts are published.
4. There's fighting over whether to do a WG at all, and vile fighting 
over the design of the perfect IPng.
5. A WG has its first meeting at IETF79.
6. On the Tuesday of IETF80 the IANA switches to armageddon rules and 
transfers the last ten /8s to RIRs.
7. On the following Wednesday, the press reports that the internet is 
out of addresses and IPv6 becomes a big buzzword. Game over.

Arnt

---

From: Masataka Ohta <[email-masked]>
Date: Mon, 09 Nov 2009 22:15:22 +0900

> IOS. By comparison, here's an overview of how an alternative might fare:

Within IETF, maybe. As ITU, these days, is doing much better than
IETF that IPng could better be discussed there or somewhere else.

> transfers the last ten /8s to RIRs.

Can you say NAT and unicast class E?

							Masataka Ohta

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 8 Nov 2009 12:55:49 -0500

While folk can postulate alternative universes in which enterprises
will not demand or vendors refuse to implement NAT66, there is another
area that is harder to wish away.

I don't think this can be seriously disputed.

Observation: Without NAT46 and NAT64, we cannot transition from IPv4 to IPv6.

OK, so when I first started making this claim I was widely dismissed
as a fool, a lunatic and other unpleasant things. I think that it is
now very clear that the IPv6 transition will take at least another
decade to be near completion and that large parts of the net will not
support IPv6 access for many years to come. Contrawise, consumers and
enterprises are going to require that their ISP provides Internet
service that works with the devices they have, not the ones that
hardware vendors might hope to sell them.

When the US settled for a single lightbulb socket standard there were
many different systems in use. The only reason that a transition was
possible was due to adapters. The same will be true of the IPv6
transition.

If we accept these two observations we arrive at a proof that NAT66 is
unavoidable. It will happen any time an IPv6 device with IPv4 service
attempts to connect to an IPv6 server. NAT64 + NAT46 = NAT66.

---

From: Sabahattin Gucukoglu <[email-masked]>
Date: Tue, 10 Nov 2009 01:52:58 +0000

Sorry in advance for the length of the post and, in parts, the  
rudeness of my spleen.

> anything that layers on IPv6 must be NAT66 tolerant.

In the whole of the foregoing discussion about NAT and IPv6, the  
question that I'm only really left with is whether or not we actually  
lost anything by doing NAT.  I have never seen the link between the  
application layer and the network layer (or whatever you call these  
things, "Layer" being a highly inadequate term), and taking the  
effects of NAT and the resultant protocol drain by way of example, now  
no longer "See" what end-to-end connectivity is good for ...

Until I remember FTP.

And SIP.

And IKE...

And I question the quality expectations and degraded service the  
Internet's users have endured.  The attitude is no longer that  
"Address exhaust came, NAT pushes back the emergency" but "If it  
weren't for NAT, we'd have run out of addresses by now".  You know, as  
if the botches we take for granted today are in any way good, as  
though the strategies we know and love to get around NAT are in any  
way acceptable, as though replacements for NAT-unfriendly protocols  
are somehow heavenly and divine.  And whose idea was it to make the  
above protocols easily dependent on universal addressing, anyway?  Was  
it necessary?

It would only be fair to wonder how FTP and SIP would be, if designed  
today.  It would be a shame not to mention WebDAV and, oh, Skype.  And  
SIP, done today, would probably depend on connection reuse, fixed  
ports and no payload rewriting to get around NAT, those features being  
both desirable in NAT and of presumably great use in circumstances  
where realm translation happens, as with proxying where translating  
the IP or application header is absolutely the most you can do and  
where, presumably, NAT or similar can actually be justified for those  
who simply must have it.

But one thing's damn certain, I will never, ever, ever configure a  
passive-mode FTP server behind a NAT ever again - not so long as the  
gateway supports FTP ALG but only if the behind-NAT FTP server  
pretends to be oblivious to the existence of NAT, while flopping  
completely if you try to be clever and set up ports and addresses to  
be given to clients.  Worse yet, if it uses UPnP to open the needed  
holes.  Do you care for a healthy Internet?  I do.  That sort of thing  
is beyond me, and I want somebody to tell me it's okay and it will all  
be over soon.  And really, a lot of the excuses people give for  
keeping NAT are highly lame, in many instances suboptimal even for  
their intended purpose (source address spoofing behind NAT is my  
favourite argument against security held to be a value of NAT) and  
generally miss one or two points about the initial, healthy  
development of the 'net unencumbered by NAT.  For a particularly  
aggressive take:
http://www.fourmilab.ch/speakfree/ link

And, of course, RFC 2993 is standard reading.

So yes, I need to know why we put up with NAT, or why you think others  
should.  I also need any justification you may have about why end-to- 
end is wrong or never held for the Internet's design, and if it did,  
why it did.

> I don't think this can be seriously disputed.

But see above.

> Observation: Without NAT46 and NAT64, we cannot transition from IPv4  

Not now, no.  It was the grand master plan though, back when.  And,  
yes, capitalism and managers are to blame and, no, I don't feel the  
slightest sympathy for the slow movers who end in hot water because  
they didn't plan ahead.  Really, it's a crisis whose only quandary is  
money and is entirely of their own making, and if they can't see  
beyond that point, it doesn't matter if they lose business.  I don't  
know why the IETF keeps its hands out like that, when for years the  
clean start proposal was, while perhaps rather optimistic, perfectly  
adequate and, on the whole, of sound engineering.  But now, vendors  
have begun pedalling the latest in CGN, and I'm tempted to imagine  
that if the transition had begun sooner there's a very real  
possibility the impetus and usefulness of IPv6 would have made the  
notion of CGN infeasible and unsellable.  And don't get me started on  
the silly proposals to recycle unused IPv4 address space, they won't  
work longer than five minutes a time.  Any market value those  
addresses may have is significantly outperformed by the real benefit  
of IPv6, when IPv6 is all there is to give.

Still, FWIW, I see the transition this way: CGN (carrier-grade NAT)  
will happen now and in response to future demand on existing address  
space reclamation efforts (ISP wants more business, for instance),  
giving client-only v4 access to v4 or v6 nodes, and v6-only nodes  
client access to v4.  V4 will, finally, become nearly useless because  
of the real potential in peer-to-peer.  IPv6, either native or over  
NAT- or non-NAT-friendly v6 tunnels, will suddenly seem very cool and  
necessary.  V6 will suddenly gain traction, the value of v4 is the sum  
of the value of deployed CGNs to keep, and soon the only people with  
nearly useless connections will be the ones who got us into the mess  
to begin with.  Everybody will scream at them for making their  
experiences sucky, slow and dependent on old code, ISPs will  
eventually make the corporates see sense in the v6 upgrade, and  
bingo!  It's 2148, and we've made the transition!  ISPs will almost  
certainly be long into the process before the blackout period, of  
course, for obvious reasons.

Well, one can dream, anyway. :-)

> attempts to connect to an IPv6 server. NAT64 + NAT46 = NAT66.

No.  A device with just IPv4 addressing, even one behind NAT(s), can  
in fact get IPv6 connectivity, complete with global reachability  
(state of NAT(s) permitting).  So it is not a prerequisite of a node  
that wants the complete benefits of IPv6 to have more than a single  
IPv4 address, preferably publicly routable.

Cheers,
Sabahattin

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 11 Nov 2009 18:58:22 -0500

IPv6 is just fine. The problem is not the technology we would
transition to, it is the lack of transition strategy and refusal to
think about deployment strategy in some quarters.

While they were building the big dig in Boston they actually built an
entire interchange from scratch and then demolished it. The temporary
interchange was necessary because you can't stop traffic in Boston for
ten years while you build the permanent one. We need the same for
IPv6.

The problem with IPv4 address space exhaustion is that it is much less
of a problem for end users than some imagine. If you have an IPV4
address and someone else does not, that is their problem, not
something you want to spend money for.

-- 
-- 
New Website: http://hallambaker.com/
View Quantum of Stupid podcasts, Tuesday and Thursday each week,
http://quantumofstupid.com/