Subject: [midcom] More than one NAT in Network-friendlier Midcom

From: "Bob Penfield" <[email-masked]>
Date: Thu, 6 Dec 2001 11:13:34 -0500

Hi Melinda,

I see that the proposed method could work when Host B has a public address
(and Host A knows what it is), but I'm having trouble figuring out how the
multiple NAT scenario in figure 8 (section 4.4) would work. How does host A
know where to send the Path message to reach host B?

Also, in many of the scenarios that the current midcom framework is
addressing, you a have a "chicken or the egg" problem. The signaling
messages may have to traverse a proxy network to "discover" the IP address
of the other end. The endpoints need to include their IP addresses in
signaling messages, but they would need to obtain the NAT binding before
they could do that. But they cannot send the "Path" message until they know
where to send it.

I suppose a twist on STUN could be used where an endpoint would send a
"Path" message to a node in the public network to obtain NAT bindings and
open pinholes, and then use the learned IP address in the signaling
messages. You still have the problem of potentially causing session to
unnecessarily traverse the public internet when endpoints are really in the
same network behind the same NAT/Firewall.

Am I missing something?

cheers,
(-:bob

Robert F. Penfield
Chief Software Architect
Acme Packet, Inc.
130 New Boston Street
Woburn, MA 01801
[email-masked]

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: Melinda Shore <[email-masked]>
Date: Thu, 06 Dec 2001 11:57:16 -0500

>know where to send the Path message to reach host B?

Unfortunately, by definition when someone has a non-routable 
address they aren't directly reachable and some sort of proxy
or gatekeeper or ALG is going to be required for initial contact.
NATs bring us back to an age where we had the problem of
getting traffic between BITNET, uucp, CSNET, etc.

So, when the proxy receives the first INVITE (I'm not a SIP
person, so please forgive any gross stupidity here) it's going
to know where to forward it because the endpoint is registered
with it.  It forwards on the INVITE, and the endpoint can then
use midcom to pick up the correct public address.  I'm really
interested in working on identifying failure modes, so please
let me know as you find stuff (and you certainly will).

Melinda

---

From: Scott Brim <[email-masked]>
Date: Thu, 6 Dec 2001 11:54:02 -0500

> know where to send the Path message to reach host B?

I assume host B has a mapping for its address already installed.  But it
is indeed a chicken and egg scenario.

> they could do that. But they cannot send the "Path" message until they know

I wonder about this too.  If I simply want to get a global address for
people to use to reach me, what do I do?

Also we still don't have a solution for parallel NATs (or firewalls).

> same network behind the same NAT/Firewall.

I suppose this is like applications where you need to "register" with
some central server to get connectivity.  It would be the first time,
though, that we would do this to get IP connectivity at all.  

My work in this WG has convinced me that NATs are a big problem, but
that we can't get rid of them, and that we really want to deploy a good
just-above-IP layer, like HIP (draft-moskowitz-hip-*).

..Scott

---

From: Melinda Shore <[email-masked]>
Date: Thu, 06 Dec 2001 13:29:09 -0500

>people to use to reach me, what do I do?

First, a deployment in which a server does not have a
public address but is intended to be globally reachable
is just asking for trouble.  Endpoints (say, telephones)
are more likely to be NATted, but I think that provisioning is 
a somewhat different problem anyway, frankly.  In cases where 
you've got more than one route out of your network and the 
possibility of crossing one among a bunch of NATs (fan 
topology) you're going to have a problem, anyway.  This is 
a very nasty problem.

Melinda

---

From: Scott Brim <[email-masked]>
Date: Thu, 6 Dec 2001 14:14:59 -0500

On Thu, Dec 06, 2001 01:29:09PM -0500, Melinda Shore wrote:
> is just asking for trouble.  

There's a message I can't find in the archives, in which iirc Cedric
Aoun claimed that at least some voice service providers would be placing
voice agents behind NATs.  It's been complicating everything for me.
Cedric, are you there?