Subject: Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

From: "J. Noel Chiappa" <[email-masked]>
Date: Thu, 19 Jun 2003 07:49:14 -0400

> From: Bob Braden <[email-masked]>

    > Today, one must unfortunately question whether universal connectivity
    > can be sustained (or is even the right goal) in a networking
    > environment without universal trust. Maybe NATs are, in fact, a result
    > of a very deep problem with our architecture.

My take is that NAT's respond to several flaws in the IPv4 architecture:

- 1) Not enough addresses - this being the one that brought them into
	existence.
- 1a) Local allocation of addresses - a variant of the preceeding one, but
	subtly different; NAT's do allow you to allocate more addresses
	locally without going back to a central number allocation authority,
	which is very convenient.
- 2) Easy renumbering when switching ISP's - a benefit that only was realized
	later in time, but a significant one all the same - especially for
	those people who reckon that switching addresses is a really painful
	undertaking.

I don't really believe the rationale that they are useful as a firewall. For
one thing, most NAT boxes includes a real firewall (i.e. packet filtering
separate from the NAT functionality). I think that even if we had plenty of
addresses, people would still install boxes with firewall functionality at
the edges of their networks.

Which gets to your original point - "whether universal connectivity .. is
even the right goal .. in a networking environment without universal trust".
Which is an interesting and complex point, but I think one we can put off to
a separate discussion, because I think it's unrelated to the reasons that NAT
boxes have been a success. (It's also good to put if off because including it
will muddy the discussion water.)

    > If you accept that, then there is no point in attacking NATs until you
    > can propose a better architectural solution to the trust problem
    > (hopefully, there will be one!)

Well, not so much the trust problem, because I don't think that's what drove
NAT. But your basic point is a good one.

I think that if you look at the points I listed above, the market has clearly
decided that IPv4+NAT (for all its problems, with which people are I'm sure
reasonably familiar, given the many years NAT has been in service widely) is
the most cost-effective solution to providing them. The IETF really needs to
sit and ponder the implications of that.

	Noel

---

From: Keith Moore <[email-masked]>
Date: Thu, 19 Jun 2003 09:40:05 -0400

> - 2) Easy renumbering when switching ISP's - a benefit that only was
>       realized later in time, but a significant one all the same -
>       especially for those people who reckon that switching addresses is a
>       really painful undertaking.

You might be surprised to find that I agree with the above.  But I also think
it's useful to consider technical reasons for wanting NATs in IPv4 separately
from the things that motivate people to install NATs - and many of the latter
have no technical basis.  e.g. people have been sold on NAT functionality by
being told that it's a firewall and that the NAT protects them from attacks.

> I think that if you look at the points I listed above, the market has
> clearly decided that IPv4+NAT (for all its problems, with which people are
> I'm sure reasonably familiar, given the many years NAT has been in service
> widely) is the most cost-effective solution to providing them. 

Again, there are sound technical justifications and there are uninformed 
motiviations, and both affect people's purchasing decisions.  Whether NAT+IPv4
is cost-effective has a lot to do with what you want to do with your network;
the answer will be different for different user communities.  I think it's
more realistic to say that IPv4+NAT was the easiest thing to try first to
alleviate the flaws you list above, since it claimed (unrealistically) to
solve those problems without upgrading hosts, applications, or the packet
format.

---

From: "Theodore Ts'o" <[email-masked]>
Date: Thu, 19 Jun 2003 09:53:13 -0400

> 	those people who reckon that switching addresses is a really painful

I have to agree with Noel here.  As much as I hate NAT's because they
screw up various protocols --- not the least of which are Kerberos,
Zephyr, AFS, etc. --- I am running a NAT at home precisely because it
solves the above issues.

Unfortunately, it hasn't been clear to me IPv6 necessarily solves
these problems.  If it's true that some address registries have been
handing out IPv6 addrs. with the same parsimony that they've been
handing IPv4 address, and that routing concerns means that we won't
have provider independent addressing, and various application writers
are using promoting the use of explicit IPv6 addresses in
configuration files, license managers, etc., then we may end up with
NAT's even in IPv6 land.  And that would be most unfortunate.

					- Ted

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 19 Jun 2003 19:28:02 +0200

On donderdag, jun 19, 2003, at 13:49 Europe/Amsterdam, J. Noel Chiappa 
wrote:

>> Maybe NATs are, in fact, a result

> - 1) Not enough addresses - this being the one that brought them into

Since there are 1.5 billion unallocated addresses lying around in some 
storage room at IANA, the IPv4 address shortage problem in itself can't 
be the reason for the existence of NAT. The real problem is that ISPs 
are unwilling to give out addresses to customers in a way that 
customers find acceptable and affordable.

> 	which is very convenient.

Right.

> clearly

Designing a NAT architecture that doesn't have the disadvantages 
current NAT has wouldn't be much of a challenge. A little outside 
address discovery here, some dynamic server port assignment there, and 
we're well on our way. However, this would still require massive 
changes to all applications (not just the ones that don't work with NAT 
today) and to deployed NATs. But instant deployability is exactly what 
makes NAT so prevalent today. If implementing NATng is as much trouble 
as implementing IPv6, why bother?