Re: Issue 41: Mandate NAT prevention if not doing NAT-T?
Francis Dupont <[email protected]>
| Newsgroups | gmane.ietf.mobike |
|---|---|
| Message-ID | <[email protected]> |
In your previous mail you wrote:
Is there an IPv6 - IPv4 translation type where the middle
ground would be useful even for an IPv6 host?
=> Mobike is not supposed to support the crossed-version case.
If not, I would suggest leaving the middle ground away
from v6 but allowing it in v4. ("NAT preventation SHOULD
be enabled by default in IPv6 if NAT traversal is not enabled.")
=> I don't like to keep a security hole in a default policy.
If yes, then I think the current text might suffice.
=> I find something strange: when I signaled the issue to Mobile IP
folks (the issue is common to signalings with NAT traversal),
they changed immediately their specs to mitigate the issue (cf
RFC 3519). When I signal it to IPsec folks, it seems it is not
a real issue. Usually, arrogance is more for French guys...
So, please do what is needed, and don't believe I'll try to
delay IKEv2 with this (i.e., now it is a Mobike issue).
Regards
[email protected]