Subject: Re: Multihoming with NAT

From: [email-masked]
Date: Thu, 28 Nov 2002 08:48:40 +0530

hi,

I don't think so, multihoming can work very well behind a NAT too. if NAT can
translate one address, it can translate n addresses. I don't foresee any issue.
In fact, with NAT, its possible that a host running sctp and having single
address can appear as a multihomed host to the peer. Only NAT box has to Map
both the external addresses to a single internal address.

regards
manish
www.hssworld.com

"Randall Stewart (cisco)" <[email-masked]> on 11/28/2002 01:09:00 AM

To:   Manish Rajpal/HSS@HSS
cc:   [email-masked]

Subject:  Re: Multihoming with NAT

Doing this in the kernel is very very difficult.. (see my earlier email on
this subject).

To get by a nat one can always just send a INIT with no addresses...
After all multi-homing behind a NAT is not going to work anyway..

R

[email-masked] wrote:

>
>Hi
>
>The socket draft - 04 no-where specifies an option for user to provide a
>hostname for an address. This
>creates a problem when a multi-homed endpoint is behind a NAT. As discussed in
>sctp applicabilty
>statement, this requires a hostname to be sent in INIT/INIT ack.
>My question is how to get a hostname for the address provided in sctp-socket
>interface.
>
>regards
>manish
>www.hssworld.com
>
>DISCLAIMER: This message is proprietary to Hughes Software Systems
>Limited (HSS) and is intended solely for the use of the individual
>to whom it is addressed. It may contain  privileged or confidential
>information  and should not be circulated or used for any purpose other
>than for what it is intended. If you have received this message in error,
>please notify the originator immediately. If you are not the intended
>recipient, you are notified that you are strictly prohibited from using,
>copying, altering, or disclosing the contents of this message. HSS accepts
>no responsibility for loss or damage arising from the use of the information
>transmitted by this email including damage from virus.
>
>
>
>
>

--
Randall R. Stewart
ITD
Cisco Systems Inc.
[email-masked] 815-342-5222(cell) or 815-477-2127(office)

---

From: <[email-masked]>
Date: Thu, 28 Nov 2002 14:33:35 +0200

Hi!

> translate one address, it can translate n addresses. I don't 

	I think this is precisely the problem... NATs don't know anything about SCTP, so at most they can translate the source address of the IP packet. All the deployed NATs are not ready to recognize Protocol Number 132 and then look inside every of such packets and recognize an INIT/INT ACK chunk, so it can dig inside the packet and recognize de address parameters...

	Of course, if you re-code a NAT to do such thing, I think it would work... :-/ But, who is the one that is going to re-code all the existing NATs...?

	Besides, I don't really think that having multihoming while being behind a NAT is really anything useful... I'm not an expert, but I would say that you normally have only one NAT that is "covering" a stub domain. It means that all the packets have to go anyway through the NAT... Well, you can always have several netwok cards, and then multihoming would prevent failure if one of the cards itself fails, but it won't prevent about misbehaving routers in the way...

> foresee any issue.

	But it has to be able to do so... which is not true so far...

	BR Iván Arias Rodríguez

---

From: <[email-masked]>
Date: Thu, 28 Nov 2002 16:10:42 +0200

Hi!

> hi
> 
> No! you don't need a SCTP aware NAT, lets suppose NAT has two 
> addresses, then
> both these addresses can be used for the  association. The 
> packets sent by the
> peer to any of these addresses will be routed to the sctp 
> host which has got a
> single address. So u have a multihomed association without 
> the host having more
> than one address.

	I must confess that I really never completely understood how NATs and DNS are compatible... NATs allocate address for the use of a host during a certain time... so, are NATs changing DNS entries every time they assign different addresses to different hosts? And they have to do this so everybody can know... I don't really know how this can work... :-/ Unless DNS entries are only given to "static" hosts that have regular access to the "outside world" and that always use the same addresses...

> about the misbehaving routers, i'ld like say that its the 
> multihoming that comes
> to rescue when you have diffrent addresses belonging to 
> different networks, So
> while one network is not in good health the packets can take 
> diffrent route to
> reach destination.

	But at the end, all the packets have to go to the same destination: the NAT. Well, the NAT can be connected easily to different networks... yes you are right...

> Its just that the INIT/INIT ACK chunks that communicate the 
> addresses to the
> peer and if we can send a hostname, we can create the 
> multi-homed association.

	Could you please quickly explain me how DNS and NATs are compatible? I just don't know and feel lazy to check RFCs... :-)

> Only restrition I see is dynamically adding or delteting IP 
> addresses from such
> an association.

	Yes, that's right... Unless you change the DNS entry and then you send in the ASCONF not the IP address but the host name... I don't think anybody would support this... and I don't think it is feasible either...

> And if NAT is sctp aware, which is least likely, you don't 
> even need the
> hostname as the NAT can itself  translate the addresses in 
> INIT/INIT-ACK.
> So  we don't require anything new from existing NAT box, all 
> that is required is
> to send a hostname in the INIT/ INIT ACK that will be resolved to the
> address(es) of NAT. So probably a new interface that allows a 
> user to specify a
> hostname for a socket to bind to. If the NAT io

	Seems that the message was truncated...

	BR Iván Arias Rodríguez

> regards
> manish
> www.hssworld.com
> 
> 
> 
> 
> 
> [email-masked] on 11/28/2002 06:03:35 PM
> 
> To:   Manish Rajpal/HSS@HSS, [email-masked]
> Subject:  RE: Multihoming with NAT
> 
> 
> 
> 
>      Hi!
> 
> > hi,
> >
>      I think this is precisely the problem... NATs don't know 
> anything about
> SCTP, so at most they can translate the source address of the 
> IP packet. All the
> deployed NATs are not ready to recognize Protocol Number 132 
> and then look
> inside every of such packets and recognize an INIT/INT ACK 
> chunk, so it can dig
> inside the packet and recognize de address parameters...
> 
>      Of course, if you re-code a NAT to do such thing, I 
> think it would work...
> :-/ But, who is the one that is going to re-code all the 
> existing NATs...?
> 
>      Besides, I don't really think that having multihoming 
> while being behind a
> NAT is really anything useful... I'm not an expert, but I 
> would say that you
> normally have only one NAT that is "covering" a stub domain. 
> It means that all
> the packets have to go anyway through the NAT... Well, you 
> can always have
> several netwok cards, and then multihoming would prevent 
> failure if one of the
> cards itself fails, but it won't prevent about misbehaving 
> routers in the way...
> 
> > foresee any issue.
>      BR Iv