Re: The argument for writing a general purpose NAT for IPv6

[Wesley Eddy <weddy@grc.nasa.gov>]

On Wed, Apr 18, 2007 at 10:20:08AM +0200, Brian E Carpenter wrote:
> I am confused.
>  
> If the issue is stateful packet filters the solution is
> to be able to configure them off for specified hosts. I can't
> see why transport proxies are needed (as far as you describe them,
> they exist *because* the IPv4 box is a NAT, not because it
> contains stateful filters).
> 

I think I agree.  It looks like James is saying that *in his code*,
implementing IPv6-NAT is the easiest way to re-use existing upper-layer
packet inspection code in order to poke holes in the firewall.  I don't
think that this in any way applies to implementations in general.

I believe he's only said that this seems like the path of least
resistance in his code, but I don't think he's said that it would be
impossible to re-use his packet inspection code through some other means
without implementing IPv6-NAT, but I may have missed something.

I think this is being blown out of proportion and confusing one
implementation's decisions with the protocol requirements in general.

-- 
Wesley M. Eddy
Verizon Federal Network Systems