Re: Issue 22: is disabling NAT traversal a possibility (was: Review of draft-ietf-mobike-protocol-00)

[email protected] wrote:

>Lakshminath Dondeti wrote:
>  
>
>>  o  If NAT Traversal is supported and NAT detection payloads 
>>     were included, enables or disables NAT Traversal.
>>
>><LD>  I may be wrong, but is disabling NAT Traversal a 
>>possibility here?
>></LD>
>>    
>>
>
>Hmm.. any reasons why it wouldn't be?
>
>The text is a bit short here, but it roughly means that "if NAT 
>detection  payloads show that there's no NAT, then don't use UDP 
>encapsulation for outgoing ESP packets any more"
>
>(Or did you mean that it would be better to use some other words
>than "enable" and "disable" here?)
>  
>
I think your thinking is correct here, but the text needs
to be expanded. We have the following cases:

o NAT-T supported by responder, no NAT payloads from initiator, address 
changed
o NAT-T supported by responder, no NAT payloads from initiator, address 
not changed
o NAT-T supported by responder, NAT payloads from initiator, address changed
o NAT-T supported by responder, NAT payloads from initiator, address not 
changed
o NAT-T not supported by responder, no NAT payloads from initiator, 
address changed
o NAT-T not supported by responder, no NAT payloads from initiator, 
address not changed
o NAT-T not supported by responder, NAT payloads from initiator, address 
changed
o NAT-T not supported by responder, NAT payloads from initiator, address 
not changed

I believe only case 3 should lead to UDP encapsulation being turned
on. Cases 2, 4, 6, 8 turn it off, and cases 1, 5, and 7 should lead
to some kind of an error, I think... this may already be specified
somehow in the original IKEv2 specs, I have not checked...

--Jari