<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hi Abraham,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I propose you improve EzIP by the advice in the draft on the way how to randomize small sites choice inside 240/4 (like in ULA?).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">To give the chance for the merge that may be needed for a business. Minimize probability for address duplication inside 240/4 block (that everybody would use).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">You have not discussed in the document CGNAT case that is typically called NAT444 (double NAT translation).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I assume it is possible, but would be a big question how to coordinate one 240/4 distribution between all subscribers. Because address space between Carrier and
Subscriber are Private too.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I do not see a big difference between EzIP and NAPT that we have right now. Explanation:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Initially, the majority of servers on the internet would not be capable to read Ez options (private 240/4 address extension).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hence, the Web server would see just UDP:Public_IP.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The gateway (that would be exposing 240/4 options) would need additionally to translate UDP ports to avoid a collision (as usual for NAPT).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The gateway could not stop NAPT till the last server on the internet would be capable to read address extension (240/4) in options, because the gateway would
not know what server is capable to parse EzIP options.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">It means NEVER, at least not in this century. Hence, the additional value from EzIP is small, because the primary job would be still done by NAPT.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">You could try to patch this problem. If the new server would signal to the gateway that it is capable to understand EzIP options then overlapping UDP ports from
the same Public IP address would be not a problem, because the server may additionally use private address space for traffic multiplexing.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">IMHI: it would be a very dirty work-around if servers would need to teach their capabilities to every NAPT device.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Sorry, I have not read all 55 pages, but the principal architecture questions are not possible to understand from the first 9 pages.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Your first pages are oriented for low-level engineers (“for dummies”).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Eduard<o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> NANOG [mailto:nanog-bounces+vasilenko.eduard=huawei.com@nanog.org]
<b>On Behalf Of </b>Abraham Y. Chen<br>
<b>Sent:</b> Sunday, April 3, 2022 6:14 AM<br>
<b>To:</b> Matthew Petach <mpetach@netflight.com>; Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp><br>
<b>Cc:</b> nanog@nanog.org<br>
<b>Subject:</b> Enhance CG-NAT Re: V6 still not supported<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt">Hi, Matt:</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt">1) The challenge that you described can be resolved as one part of the benefits from the EzIP proposal that I introduced to this mailing list about one month ago. That discussion has gyrated into this thread
more concerned about IPv6 related topics, instead. If you missed that introduction, please have a look at the following IETF draft to get a feel of what could be done:</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt"> <a href="https://datatracker.ietf.org/doc/html/draft-chen-ati-adaptive-ipv4-address-space">
https://datatracker.ietf.org/doc/html/draft-chen-ati-adaptive-ipv4-address-space</a>
</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt">2) With respect to the specific case you brought up, consider the EzIP address pool (240/4 netblock with about 256M addresses) as the replacement to that of CG-NAT (100.64/10 netblock with about 4M addresses).
This much bigger (2^6 times) pool enables every customer premises to get a static IP address from the 240/4 pool to operate in simple router mode, instead of requesting for a static port number and still operates in NAT mode. Within each customer premises,
the conventional three private netblocks may be used to handle the hosts (IoTs).</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt">3) There is a whitepaper that presents an overview of other possibilities based on EzIP approach:
</span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt"> <a href="https://www.avinta.com/phoenix-1/home/RevampTheInternet.pdf">
https://www.avinta.com/phoenix-1/home/RevampTheInternet.pdf</a></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt">Hope the above makes sense to you.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt">Regards,</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt">Abe (2022-04-02 23:10)</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On 2022-04-02 16:25, Matthew Petach wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Fri, Apr 1, 2022 at 6:37 AM Masataka Ohta <<a href="mailto:mohta@necom830.hpcl.titech.ac.jp">mohta@necom830.hpcl.titech.ac.jp</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal"><br>
If you make the stateful NATs static, that is, each<br>
private address has a statically configured range of<br>
public port numbers, it is extremely easy because no<br>
logging is necessary for police grade audit trail<br>
opacity. <o:p></o:p></p>
</blockquote>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal"> Masataka Ohta<o:p></o:p></p>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hi Masataka,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">One quick question. If every host is granted a range of public port <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">numbers on the static stateful NAT device, what happens when <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">two customers need access to the same port number?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Because there's no way in a DNS NS entry to specify a <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">port number, if I need to run a DNS server behind this <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">static NAT, I *have* to be given port 53 in my range; <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">there's no other way to make DNS work. This means <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">that if I have two customers that each need to run a <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">DNS server, I have to put them on separate static <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">NAT boxes--because they can't both get access to <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">port 53.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">This limits the effectiveness of a stateful static NAT <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">box to the number of customers that need hard-wired <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">port numbers to be mapped through; which, depending <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">on your customer base, could end up being all of them, <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">at which point you're back to square one, with every <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">customer needing at least 1 IPv4 address dedicated <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">to them on the NAT device.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Either that, or you simply tell your customers "so sorry <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">you didn't get on the Internet soon enough; you're all <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">second class citizens that can't run your own servers; <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">if you need to do that, you can go pay Amazon to host <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">your server needs." <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">And perhaps that's not as unreasonable as it first sounds; <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">we may all start running IPv4-IPv6 application gateways <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">on Amazon, so that IPv6-only networks can still interact <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">with the IPv4-only internet, and Amazon will be the great <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">glue that holds it all together.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">tl;dr -- "if only we'd thought of putting a port number field <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">in the NS records in DNS back in 1983..."<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Matt<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</blockquote>
<p><o:p> </o:p></p>
<div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2">
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="1" cellspacing="3" cellpadding="0" style="border:none;border-top:solid #D3D4DE 1.0pt">
<tbody>
<tr>
<td width="57" style="width:41.25pt;border:none;padding:9.75pt .75pt .75pt .75pt">
<p class="MsoNormal"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient&utm_term=icon" target="_blank"><span style="text-decoration:none"><img border="0" width="46" height="29" id="_x0000_i1025" src="https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif"></span></a><o:p></o:p></p>
</td>
<td width="415" style="width:352.5pt;border:none;padding:9.0pt .75pt .75pt .75pt">
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#41424E">Virus-free.
<a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient&utm_term=link" target="_blank">
<span style="color:#4453EA">www.avast.com</span></a> <o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>