Arguing against using public IP space

Ray Soucy rps at
Tue Nov 15 12:32:48 CST 2011

On Tue, Nov 15, 2011 at 5:57 AM, Leigh Porter
<leigh.porter at> wrote:
> As somebody else mentioned on this thread, a NAT box with private space on one side fails closed.

This is a myth; just like NAT provides security is a myth.

It doesn't matter if your firewall performs NAT or not; if it fails,
traffic will more than likely stop flowing.

The conditions for a non-NAT firewall to fail open are very specific.
You often need to engineer it to have that functionality.

Either type of firewall system can be designed to fail open or fail closed.

Ray Soucy

Epic Communications Specialist

Phone: +1 (207) 561-3526

Networkmaine, a Unit of the University of Maine System

More information about the NANOG mailing list