Re: on NAT-PT

[itojun@iijlab.net]

>>> What I'm saying is that imposing to use 'AD is secure'
>>> to operate DNSsec in IPv6 networks is a big step
>>> that I'm not sure I'm ready to make.
>> 	you are generalizing it too much by saying "in IPv6 networks" - what
>> 	i'm suggesting is to use "AD is secure" for NAT-PT, that's all.
>> 	it doesn't have to be imposed for all IPv6 networks.
>So you're back to my previous question. The context is now clearer, 
>thanks.
>How does the end node knows it is behind a NAT-PT box?

	end nodes do not need to know if it is behind a NAT-PT box or not.
	their connections will be invited to NAT-PT translation device by a
	matter of site administration policy (use specific recursive resolver),
	that's all.

	the use of "AD is secure" is not directly dependent to DNS-ALG, you
	could use it even when you are using normal recursive resolver.  i
	suggested the use of "AD is secure" because you asked how you can
	use DNSSEC with NAT-PT.

itojun