RE: WG Last Call: draft-ietf-v6ops-unmaneval-01.txt

[Pekka Savola <pekkas@netcore.fi>]

On Sun, 29 Feb 2004, Christian Huitema wrote:
> > >    a direct path between the endpoints, using the IPv4 services to
> > >    which the endpoints already subscribe. By contrast, the
> configured
> > >    tunnel servers carry all the traffic exchanged by the tunnel
> client.
> > >
> > > <MB> Is "direct path always possible in all cases between Teredo
> nodes?
> > > </MB>
> > 
> > It isn't and this should be reflected here.
> 
> Actually, in the current design either all traffic will go on the direct
> path, or no traffic will be exchanged at all.

It is true that this is an all-traffic/no-traffic issue (the latter 
caused by a flavor of NATs).  But aren't the latter ones, still, by 
definition Teredo nodes?

> > > ...
> > >    by many applications, e.g., networked games or voice over IP. The
> > >    experience shows that most recent "home routers" are designed to
> > >    support these applications. In some edge cases, the automatic
> > >    solutions will require explicit configuration of a port in the
> home
> > >    router, using the so-called "DMZ" functions.
> > >
> > > <MB>only works for one single node. Moreover, it should be noted
> that
> > this
> > > explicit configuration is completly out of the _unmanaged_ goal.
> > >
> > > Suggesting text:
> > > using the so-called "DMZ" functions". These cases are obviously out
> of
> > > scope of the unmanaged network scenario and only work for a single
> node
> > > behind the NAT.
> > > </MB>
> > 
> > Good point.
> 
> I agree that in the absence of automatic support through UPNP, DMZ
> functions are indeed not your typical unmanaged service. But the point
> is at least partially incorrect. First, it is possible in some cases to
> use automatic procedures to "DMZ" a port (e.g., using the UPNP "internet
> gateway device" service). Second, the procedure that absolutely work for
> more than one node -- just pick a different port for each node. 

I'm not sure that UPNP is a solution we can be referring to.
 
> In any case, the work done in the MIDCOM working group shows that the
> number of symmetric NAT in the market is rapidly decreasing. See
> draft-jennings-midcom-stun-results-00.txt

Sigh -- replacing "secure" NAT boxes with "insecure" ones.
Now I'm done -- I said "secure NAT"! :-)

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings