Re: Issue 41: Mandate NAT prevention if not doing NAT-T?

 In your previous mail you wrote:

   > => for instance how the NAT-PT translates the inner header (:-).
   
   Well, it can't do that, of course -- but it's not necessarily needed,
   because there's no need for the IP versions in inner and outer
   headers to match.
   
=> if the inner header doesn't need to be translated I recommend
to use something else than NAT-PT. BTW many implementations don't
support crossed-version tunnels (they should but they don't!)

   Consider a case where we have a "remote access" VPN client connected 
   to, say, IPv6-only GPRS/UMTS network, and a corporate VPN gateway
   connected to IPv4 Internet (and presumably some IPv4 "intranet" or 
   other protected network). If the IPv6 network has "Basic-NAT-PT"
   deployed, the client could contact the gateway as usual (obtaining
   a new IPv4 address from the protected network using configuration
   payloads, etc.).
   
=> you are using IPsec tunnels as a transition mechanism and
in the real world it works only with NAT-T.

   While I'm not very familiar with NAT-PT, to me it looks like this
   would actually work just fine with normal IKEv2 (without NAT-T);

=> IMHO you need NAT-T exactly for the same usual reasons.

   and the change you're proposing would forbid that (or force the
   use of IKEv2 NAT-Traversal also for IPv6 :-)
   
=> it is not a real IPv6 and NAT-T is needed...

   (Well, that would be needed anyway once someone starts 
   deploying IPv6 NATs :-)
   
=> there is no need for IPv6 NATs (this subject is as popular in
IPv6 lists than changing text for something for RFCs in the IETF one :-).

PS: the standard solution for your example is to tunnel IPv4 over IPv6
(DTSM & co). When you add IPsec you have the choice between double
encapsulation or to NAT-PT the outer header (seems simpler but you
get all the NAT and NAT-PT issues...).

Regards

[email protected]

PS: NAT-PT is enough problematic that it is being made historic.