Subject: RE: myth of the great transition (was US Defense Department forma lly adopts IPv6)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 17 Jun 2003 13:57:08 -0700

Michel,

	Yep, I am aware that there are some folk wedged. However I believe
that there are also folk who are not wedged and I want to reach them and
their managers.

	There are other standards bodies where work can take place. Clearly
there is a certain advantage to that particular piece of work taking place
in the IETF. However as Tim Berners-Lee told me the key to getting anywhere
in IETF is to have a credible threat of succession.

	In the past three years I have worked on three specs, one is an
OASIS standard, one has just completed W3C last call, the third just started
interop testing. None of the committees took more than eighteen months. All
the specs are being actively deployed by real users and real companies.

	I don't think it is necessary for the IETF to compromise its
principles to be effective. Open and inclusive is not incompatible with
Roberts Rules of Order.

	As with spam, I would very much like the IETF to be a part of the
solution. What I will not allow is for IETF inertia and cliques to become a
part of the problem.  

		Phill

> -----Original Message-----
> From: Michel Py [mailto:[email-masked]]
> Sent: Tuesday, June 17, 2003 2:10 PM
> To: Hallam-Baker, Phillip
> Cc: [email-masked]
> Subject: RE: myth of the great transition (was US Defense Department
> formally adopts IPv6)
> 
> 
> Phill,
> 
> > Hallam-Baker, Phillip
> > Simply repeating the end to end dogma is not going to provide
> > a solution. The internet people are using is not end to end.
> > NAT boxes and firewalls play an important and necessary
> > security role. We need a standard for a superNAT box that
> > provides both security and protocol bridging functions.
> 
> This is a politically courageous post but I'm afraid that the 
> end-to-end
> dogma _is_ the IETF. WRT IPv6, the pragmatic point of view of doing
> something along the lines of what you proposed is that it 
> will raise so
> much opposition that it will go nowhere, so why bother in the first
> place?
> 
> Michel.
>

---

From: "Michel Py" <[email-masked]>
Date: Wed, 18 Jun 2003 22:44:50 -0700

Valdis,

> Valdis Kletnieks wrote:
> And unfortunately, a lot of the Just Does Not Work stuff are
> applications like H.323 and VOIP that Joe Sixpack actually
> *might* be interested in.

Unfortunately, there is no single reason [protocol or app xyz] does not
work over NAT. When [protocol or app xyz] does not work, it's a
combination of _two_ things.

1. The protocol designer designed a protocol that is not NAT-capable
therefore the protocol designer is stupid.

2. The network administrator tries to run a protocol that is not
NAT-capable over NAT therefore the network administrator is stupid.

As a protocol designer, I will say that the network administrator is the
one being stupid because if s/he even understood the basics of protocol
design s/he would understand why I have to embed the port number in the
packet.

As a network administrator, I will say that the protocol designer is the
one being stupid because if s/he had any clue about what it takes to
operate a network s/he would not have designed a protocol that could not
cross NAT.

Conclusion: this leads us nowhere.

Michel.

---

From: "Peter Ford" <[email-masked]>
Date: Thu, 19 Jun 2003 07:35:52 -0700

Noel,
 
You are getting too cerebral.  We can look at the marketing info on the box of a NAT product to see what people think they are getting:
 
1) Instant Internet Sharing for cable and DSL ....
2) Firewall Security against ...  USING NAT technology.
3) Simultaneous Internet Access for up to NNN PCs
4) 4 port 10/100 switch
5) Built in print server ...

It really doesn't matter what you think wrt the firewall security of NATs.   People think they are getting additional security.   Here is a common sequence we see: 1) person puts on a software firewall solution on their PC, 2) their solution then continually inundates the user with warnings due to all the scanning going on, 3) they get a NAT based on security recommendations from PC magazines, CNET, ZD, etc., it is a trivial install of a now < $50 devicce,  4) the warnings are significantly reduced, 5) customer feels they have done something about their vulnerability, probably akin to installing a deadbolt lock into a wooden door frame (sure, a crowbar will go right through it like butter).
 
regards, peterf
 
P.S. NATng - it's time has come!

________________________________

From: [email-masked] on behalf of J. Noel Chiappa
Sent: Thu 6/19/2003 4:49 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

    > From: Bob Braden <[email-masked]>

    > Today, one must unfortunately question whether universal connectivity
    > can be sustained (or is even the right goal) in a networking
    > environment without universal trust. Maybe NATs are, in fact, a result
    > of a very deep problem with our architecture.

My take is that NAT's respond to several flaws in the IPv4 architecture:

- 1) Not enough addresses - this being the one that brought them into
        existence.
- 1a) Local allocation of addresses - a variant of the preceeding one, but
        subtly different; NAT's do allow you to allocate more addresses
        locally without going back to a central number allocation authority,
        which is very convenient.
- 2) Easy renumbering when switching ISP's - a benefit that only was realized
        later in time, but a significant one all the same - especially for
        those people who reckon that switching addresses is a really painful
        undertaking.

I don't really believe the rationale that they are useful as a firewall. For
one thing, most NAT boxes includes a real firewall (i.e. packet filtering
separate from the NAT functionality). I think that even if we had plenty of
addresses, people would still install boxes with firewall functionality at
the edges of their networks.

Which gets to your original point - "whether universal connectivity .. is
even the right goal .. in a networking environment without universal trust".
Which is an interesting and complex point, but I think one we can put off to
a separate discussion, because I think it's unrelated to the reasons that NAT
boxes have been a success. (It's also good to put if off because including it
will muddy the discussion water.)

    > If you accept that, then there is no point in attacking NATs until you
    > can propose a better architectural solution to the trust problem
    > (hopefully, there will be one!)

Well, not so much the trust problem, because I don't think that's what drove
NAT. But your basic point is a good one.

I think that if you look at the points I listed above, the market has clearly
decided that IPv4+NAT (for all its problems, with which people are I'm sure
reasonably familiar, given the many years NAT has been in service widely) is
the most cost-effective solution to providing them. The IETF really needs to
sit and ponder the implications of that.

        Noel

---

From: "Fleischman, Eric" <[email-masked]>
Date: Thu, 19 Jun 2003 07:56:12 -0700

My posting wasn't concerning what I think, it was concerning what is commonly done today in industry. I also didn't intend to imply that the NAT was being used as a firewall, rather that the NAT is commonly used today as an element within firewalls.

My own thoughts (which is off-topic) is that traditional firewalls have had their day and remain valuable. However, I am actively pursuing alternatives which perform the same functions without impacting the end-to-end performance of the protocols. Research into several approaches like this have excited me. But then, I've wandered far off topic.

-----Original Message-----
From: James Seng [mailto:[email-masked]]
Sent: Wednesday, June 18, 2003 10:38 PM
To: Fleischman, Eric
Cc: EKR; Keith Moore; [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: Re: myth of the great transition (was US Defense Department
forma lly adopts IPv6)

If you need a secure zone, and you want a firewall, then should install 
a firewall. You should not put an NAT thinking that it is also a firewall.

But I agree with you that NAT is here to stay.

-James Seng

Fleischman, Eric wrote:
> Eric Rescorla [mailto:[email-masked]] wrote:
> 
> 
>>>similarly, people who install NAT usually don't realize how much this
>>>costs them in lost functionality and reliability.
> 
> 
>>Really? You have evidence of this?
> 
> 
>>I don't either, but my intuition is that you're wrong.  Once you have
>>decided to have a firewall in place (which you may think is evil, but
>>I consider pretty much a necessary evil), I suspect that most people
>>suffer almost not at all from having a NAT.
> 
> 
> I believe that Eric is pointing out an important point: many deployments of NATs have nothing to do with IPv4 address conservation. Rather, they are firewall adjuncts implemented to hide internal networks from outside scrutiny and direct access. 
> 
> One point where I disagree with my IPv6-advocating friends is that I expect firewall-related NATs to continue to be deployed within Internet (including IPv6) environments until such a time as real-time-protocol and peer-to-peer-protocol friendly "distributed firewall" (policy zones) variants become the preferable "due diligence" alternative for CIOs.
> 
> 
> 
>

---

From: "Christian Huitema" <[email-masked]>
Date: Thu, 19 Jun 2003 09:21:45 -0700

> > The person who's most in denial around here is you - about how
> definitively
> > the market has, for the moment, chosen IPv4+NAT as the best balance
> between
> > cost and effectiveness.
> >
> > Get a grip. We all know you don't like NAT. You don't need to reply
to
> > *every* *single* *message* *about* *NAT* explaining for the
> 145,378,295th
> > time how bad they are.
> 
> Legend tells us Cato, a Roman senator during the Punic Wars, finished
> every speech he made in the Senate with the words "Carthage Must Be
> Destroyed". It didn't matter if it was a speech about defense, or
> monetary policy or the Roman water works. His one-eyed devotion to
this
> task was, well, determined. Keith sort of puts me in mind of Cato...

Carthage was eventually destroyed, but Cato died before that.

-- Christian Huitema

---

From: "Michel Py" <[email-masked]>
Date: Thu, 19 Jun 2003 18:03:35 -0700

Eric,

> Eric Rescorla wrote:
> The fact that a large number of people have chosen
> to use NAT is a strong argument that B>C. (Here's
> where the invocation of revealed preference comes in).

This is not the point. What you are saying is that since B>C it makes
NAT OK. What I am saying (and possibly what Melinda was trying to say)
is this: NAT is a necessary evil. I don't challenge the fact that it is
necessary (for IPv4) and here to stay but the fact that it is necessary
does not make it less evil.

Michel.

---

From: "Michel Py" <[email-masked]>
Date: Thu, 19 Jun 2003 19:02:34 -0700

Ted,

> Theodore Ts'o wrote:
> So 30 static IP addresses, with a slower service, is over
> *five* times more expensive, and over twice as expensive
> as faster service with only 2 static IP addresses.  
> As much as I hate NAT, from an aesthetic perspective,
> using two static IP addresses and a NAT box was the
> expedient solution.  We could I suppose blame the ISP's
> for their charging policies, but these economic pressures
> are going to drive people in certain directions, and as
> Ekr as pointed out, saying that people are either
> misinformed or non-rationale isn't going to help matters.

In other words, for your setup the inconveniences of NAT are not worth
spending $100/mo more. Same here.

> (Put another way, sure, Voice over IP would be nice.  But
> if I have to pay 2x or 5x a month to an ISP in order to
> not have a NAT box so I can use VoIP, wouldn't it be much
> more rational to stick with a wired POTS line?)

Not to mention that after 8pm cell phone calls are free. Besides, I do
voice over IP with ipip tunnels that cross NAT just fine.

> But the reality is that NAT boxes are here to stay, and
> we have lost that battle for IPv4. It would be nice not to
> lose that battle for IPv6, but I suspect the jury is still
> out on that point; and burying our heads in the sand about
> why people chose NAT's is not going to help us assure a
> NAT-free world for IPv6.

Ditto.

Michel.

---

From: Bob Braden <[email-masked]>
Date: Fri, 20 Jun 2003 09:53:43 -0700 (PDT)

*> do it. In the meantime, I wear a hat.
  *> 
  *> -Ekr
  *> 

Perhaps that was Keith's point... a hat as a cure for baldness is
akin to a NAT box as a cure for end system insecurity.

Bob Braden

---

From: "Michel Py" <[email-masked]>
Date: Mon, 23 Jun 2003 08:55:30 -0700

> Keith Moore wrote:
> Which is why I've done some work to try to make the barrier to
> adopting IPv6 on an existing IPv4 network as low as possible.

What you don't realize is that the only thing that you have left to do
is to get 6to4 implemented in NAT boxes. If every Linksys had 6to4 code
and was acting as a 6to4 gateway every home network would be IPv6
capable without the annoyances of crossing NAT when trying to implement
6to4 at the host level.

Michel.