<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.5730.11" name=GENERATOR>
<STYLE>@font-face {
font-family: Helvetica;
}
@font-face {
font-family: Tahoma;
}
@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in 1.25in; }
P.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
LI.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
DIV.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.EmailStyle19 {
COLOR: navy; FONT-FAMILY: Arial
}
DIV.Section1 {
page: Section1
}
</STYLE>
</HEAD>
<BODY lang=EN-US
style="WORD-WRAP: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space"
vLink=blue link=blue>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008>The problem that Chris (Hi!) is talking about is where
a higher layer protocol starts to embed IP addresses</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008>or port numbers.</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008>The traditional one is FTP. The firewall
protected FTP client opens the control channel and passes the data
channel</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008>port number that it is listening on to the
server. The server is then meant to open a TCP
connection</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008>to that port. This commonly causes a firewall to
rewrite the port number inside the FTP message to one</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008>that is free on the </SPAN></FONT><FONT face=Arial
color=#0000ff size=2><SPAN class=182253601-01082008>public
side.</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008>The main one people have to deal with today is
SIP. It passes the IP address over for the RTP over
UDP</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008>session. This is commonly not the same as the SIP
client. (e.g. media gateways.)</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008>Imagine that you are using a PBX and dial out to
somebody. When they ask you for your phone number,</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008>you are pretty stuffed. NAT is the same
problem.</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=182253601-01082008>Scott</SPAN></FONT></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> ausnog-bounces@ausnog.net
[mailto:ausnog-bounces@ausnog.net] <B>On Behalf Of </B>Chris
Chaundy<BR><B>Sent:</B> Friday, 1 August 2008 11:30 AM<BR><B>To:</B> Matthew
Moyle-Croft<BR><B>Cc:</B> ausnog@ausnog.net<BR><B>Subject:</B> Re: [AusNOG] IPv4
Exhaustion, APNIC EC, and James is a nice bloke ;-)<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV class=Section1>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">It’s a while since I’ve
had to deal with this, but as I understand it, there are protocols that embed
addressing and port information in payloads which need to be fiddled if there
is/are NAT(s) in the path. If the extended address space offered by IPv6
allows us to escape from the NAT ‘functionality’ (and we just have firewall
security), then there is no need for any fiddling.</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Of course, as Macca
pointed out, proxying will probably be the way things will go for most
applications in the future anyway.</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face=Tahoma size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">-----Original
Message-----<BR><B><SPAN style="FONT-WEIGHT: bold">From:</SPAN></B> Matthew
Moyle-Croft [mailto:mmc@internode.com.au] <BR><B><SPAN
style="FONT-WEIGHT: bold">Sent:</SPAN></B> Friday, 1 August 2008 11:07
AM<BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B> Chris
Chaundy<BR><B><SPAN style="FONT-WEIGHT: bold">Cc:</SPAN></B>
ausnog@ausnog.net<BR><B><SPAN style="FONT-WEIGHT: bold">Subject:</SPAN></B> Re:
[AusNOG] IPv4 Exhaustion, APNIC EC, and James is a nice bloke ;
-)</SPAN></FONT></P>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt"></SPAN></FONT> </P>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt">Stateful firewalls (the solution touted as
required for CPE) still appear to require an understanding of the protocols
going through them - to understand the "state" of a protocol and what
connections can/should be opened up.</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt">Remind me then how the protocol tweaking
will decline? </SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt">MMC</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt"></SPAN></FONT> </P>
<DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt">On 01/08/2008, at 10:08 AM, Chris Chaundy
wrote:</SPAN></FONT></P></DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt"><BR><BR></SPAN></FONT></P>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt">A further comment on this topic - I agree
entire on the comments<BR>regarding accessibility versus addressability.
One of the problems with<BR>NAT is all the tweaking needed for some
protocols that 'break the rules'<BR>as far as layering of protocols go by
embedding information about lower<BR>layers in higher layers which leads to
complexity which inevitably leads<BR>to bugs.<BR><BR>While IPv6 is may
problematic for some of these protocols, it is a<BR>problem that will have to be
solved, and once solved, NAT (and the<BR>tweaking) will no longer be necessary
when we have sufficient address<BR>space (well in the perfect world anyway :-).
Long live the KISS<BR>principle...<BR><BR>-----Original
Message-----<BR>From: <A
href="mailto:ausnog-bounces@ausnog.net">ausnog-bounces@ausnog.net</A> [<A
href="mailto:ausnog-bounces@ausnog.net">mailto:ausnog-bounces@ausnog.net</A>]
On<BR>Behalf Of Mark Newton<BR>Sent: Friday, 1 August 2008 8:51 AM<BR>To: Robert
Brockway<BR>Cc: <A
href="mailto:ausnog@ausnog.net">ausnog@ausnog.net</A><BR>Subject: Re: [AusNOG]
IPv4 Exhaustion, APNIC EC, and James is a nice<BR>bloke ;-)<BR><BR><BR>On
01/08/2008, at 1:11 AM, Robert Brockway wrote:<BR><BR></SPAN></FONT></P>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt"></SPAN></FONT> </P>
<BLOCKQUOTE style="MARGIN-TOP: 5pt; MARGIN-BOTTOM: 5pt" type="cite">
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt">Please excuse me if I'm wrong but it
seems like you are equating</SPAN></FONT></P></BLOCKQUOTE>
<BLOCKQUOTE style="MARGIN-TOP: 5pt; MARGIN-BOTTOM: 5pt" type="cite">
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt">'publically accessible' to 'publically
addressable'. They need not </SPAN></FONT></P></BLOCKQUOTE>
<BLOCKQUOTE style="MARGIN-TOP: 5pt; MARGIN-BOTTOM: 5pt" type="cite">
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt">be the</SPAN></FONT></P></BLOCKQUOTE>
<BLOCKQUOTE style="MARGIN-TOP: 5pt; MARGIN-BOTTOM: 5pt" type="cite">
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt">same thing as per earlier parts of the
thread.</SPAN></FONT></P></BLOCKQUOTE>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt"><BR>There's a certain amount of
cross-purposes discussion going on here.<BR><BR>I don't think anyone is equating
the two issues in the way you've<BR>described. It might be useful for you
to assume that those in this<BR>thread who have taken a contrary view have a
full and complete<BR>understanding of the problem and simply disagree with
you.<BR><BR>Let me expand on it just slightly, by way of
illustration.<BR><BR>Lets say you have some firewall code in your CPE.
That's something<BR>that controls "accessibility."<BR><BR>And lets also
say you have some NAT code in your CPE. That's something<BR>that controls
"addressability."<BR><BR>Flows passing through the CPE are NAT'ed
(re-addressed), and also<BR>passed through the firewall. That seems to be
the typical way that<BR>most CPE works; Whether you're talking about a
Cisco or a Billion,<BR>the stateful inspection configuration stanzas and
internal code paths<BR>are different beasts.<BR><BR>Now -- Lets assume you're
using cheap and nasty CPE that has<BR>firmware that's of, shall we say, variable
quality.<BR><BR>If the firewall is buggy, it'll incorrectly block some traffic
and<BR>incorrectly pass other traffic. The one Bevan is worried about
is<BR>incorrectly passing traffic to his fridge -- i.e., making an<BR>incorrect
decision about whether his fridge should be
accessible.<BR><BR>Separately:<BR><BR>If the NAT code is buggy, it'll
incorrectly translate inside<BR>addresses to outside addresses. The
degenerate, almost inevitable<BR>case is that devices on the "inside" won't have
an network access<BR>due to NAT bugs.<BR><BR>Now consider each facility being
present or not present individually,<BR>and consider the failure
modes.<BR><BR>In the presence of bugs on a device that has NAT and no
firewall,<BR>devices inside your network won't have network access.<BR><BR>In
the presence of bugs on a device that has a firewall and no<BR>NAT, incorrect
decisions regarding accessibility will be made and<BR>Bevan's fridge will
conceivably be reachable from the outside.<BR><BR>In the presence of bugs on a
device that has a firewall and NAT,<BR>incorrect decisions regarding
accessibility won't matter very<BR>much because nothing on the inside is
addressable, or, consequently,<BR>reachable; and NAT failures will -still-
cause devices inside<BR>your network to not have network access.<BR><BR>So --
although NAT != security, what NAT *does* do is make your<BR>firewall fail-safe.
The preference in the event of a bug when<BR>NAT is present is to deny
access. The preference in the event of<BR>a bug without NAT is to either
incorrectly permit or incorrectly<BR>deny, depending on the bug. NAT is,
therefore, a net gain, and<BR>a marginal improvement on the quality of the
security provided<BR>by the solution.<BR><BR>Now, I'm not emotionally attached
to NAT, and I don't think its<BR>inevitable culling in an IPv6 world represents
a huge problem. But<BR>I think you're making a mistake by suggesting that
taking away<BR>NAT makes no difference because protecting the network is the
firewall's<BR>job. We don't live in an ideal world, and some CPE firmware
is so<BR>badly tested that it won't even boot, so I don't think you can
trust<BR>the firewall. So what does that leave you
with?<BR><BR><BR></SPAN></FONT></P>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt">I would not allow my</SPAN></FONT></P>
<BLOCKQUOTE style="MARGIN-TOP: 5pt; MARGIN-BOTTOM: 5pt" type="cite">
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt">appliances to be publically accessible
but I'm fine with them being</SPAN></FONT></P></BLOCKQUOTE>
<BLOCKQUOTE style="MARGIN-TOP: 5pt; MARGIN-BOTTOM: 5pt" type="cite">
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt">publically
addressable.</SPAN></FONT></P></BLOCKQUOTE>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt"><BR>What about when your firewall is buggy?
Is it ok then?<BR><BR><BR> - mark<BR><BR>--<BR>Mark Newton
Email:<BR><A
href="mailto:newton@internode.com.au">newton@internode.com.au</A>
<BR> (W)<BR>Network Engineer
Email:
<BR><A
href="mailto:newton@atdot.dotat.org">newton@atdot.dotat.org</A>
(H)<BR>Internode Systems Pty Ltd
Desk:
+61-8-82282999<BR>"Network Man" - Anagram of "Mark Newton"
Mobile:
+61-416-202-223<BR><BR><BR><BR><BR><BR>_______________________________________________<BR>AusNOG
mailing list<BR><A href="mailto:AusNOG@ausnog.net">AusNOG@ausnog.net</A><BR><A
href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</A><BR>_______________________________________________<BR>AusNOG
mailing
list<BR>AusNOG@ausnog.net<BR>http://lists.ausnog.net/mailman/listinfo/ausnog</SPAN></FONT></P></DIV></DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt"></SPAN></FONT> </P><SPAN
style="WORD-SPACING: 0px; orphans: 2; widows: 2; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0">
<DIV apple-content-edited="true">
<DIV
style="WORD-WRAP: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space">
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face=Helvetica color=black
size=1><SPAN
style="FONT-SIZE: 7pt; COLOR: black; FONT-FAMILY: Helvetica">-- <BR>Matthew
Moyle-Croft Internode/Agile Peering and Core Networks<BR>Level 4, 150 Grenfell
Street, Adelaide, SA 5000 Australia<BR>Email: <A
href="mailto:mmc@internode.com.au">mmc@internode.com.au</A>
Web: <A href="http://www.on.net/">http://www.on.net</A><BR>Direct:
+61-8-8228-2909<SPAN
class=apple-tab-span>
</SPAN> Mobile: +61-419-900-366<BR>Reception:
+61-8-8228-2999 Fax:
+61-8-8235-6909</SPAN></FONT></P></DIV></DIV></DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></SPAN></FONT> </P></DIV></DIV>
<p><span style="font-family:'Arial';font-size:8pt;">**********************************************************************</span></p>
<p><span style="font-family:'Arial';font-size:8pt;">This email and any files transmitted with it are confidential and</span></p>
<p><span style="font-family:'Arial';font-size:8pt;">intended solely for the use of the individual or entity to whom they</span></p>
<p><span style="font-family:'Arial';font-size:8pt;">are addressed. If you have received this email in error please notify</span></p>
<p><span style="font-family:'Arial';font-size:8pt;">the system manager.</span></p>
<p><span style="font-family:'Arial';font-size:8pt;"></span></p>
<p><span style="font-family:'Arial';font-size:8pt;"> </span></p>
<p><span style="font-family:'Arial';font-size:8pt;">**********************************************************************</span></p>
<p><span style="font-family:'Arial';font-size:8pt;"> </span></p>
<BR>
_____________________________________________________________________ <BR>
This e-mail has been scanned for viruses by MCI's Internet Managed <BR>
Scanning Services - powered by MessageLabs. For further information <BR>
visit http://www.mci.com<BR>
</BODY></HTML>