Re: NAT64 and IPsec support

[Iljitsch van Beijnum <iljitsch@muada.com>]

On 30 mrt 2008, at 13:33, Yaron Sheffer wrote:

> > > In this case you could envision NAT64 happening on the host (!)  
> > > which creates an IPv4-IPsec tunnel with its peer, encapsulates it  
> > > in UDP and sends it into the IPv6 network.

> > right, but this not only requires v4 stack in the v6only node  
> > (which would be ok, since as you say it seems this will be a common  
> > case for a while) but it also requires to provision a valid IPv4  
> > address to the v6 only node and that address is not purely local,  
> > since it will be the v4 address the v4 only node has in its IPSec  
> > SA, right?
> > So, even i agree this is possible i am not sure this is so  
> > interesting

> Actually we commonly provision such addresses to IPv4 clients today,  
> *inside* the IPsec tunnel. They are known as "Tunnel Inner Address  
> (TIA)". But I think I got this case wrong: you end up with a v4  
> packet, which you want to send to a v4 host, through a v6-only  
> network. It sounds more like tunneling than NAT.

What you have here is IPv4 packets that you tunnel, where one tunnel  
endpoint is IPv4 and the other is IPv6. So this requires translation  
of the outer header, bringing us back into NAT-PT territory.

If IKE NAT traversal (RFC 3947) is supported on the v4 side the v6  
side can create a fake private IPv4 address and signal this as its  
"real" address and everything should work. Basically, in this case the  
v6 host needs to act like an IPv4 host. This isn't entirely trivial  
but I don't see any reason why it couldn't be done if IPsec over NAT- 
PT is desired over IPsec over IPv6.