<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffcc" text="#000000">
<br>
<div class="moz-signature"><a
href="http://www.fuelly.com/driver/dilkie/golf" target="_blank"><br>
</a></div>
<br>
On 3/25/2010 1:21 AM, Roger Marquis wrote:
<blockquote cite="mid:20100325052141.713742B208E@mx5.roble.com"
type="cite">Lee Dilkie wrote:
<br>
<blockquote type="cite">Is no one concerned that NAT breaks a lot of
networking, especially
<br>
peer-to-peer, and forces some really inefficient technologies, like
<br>
SBC's, to exist?
<br>
</blockquote>
<br>
Statements like this make me wonder if they don't teach the value of
<br>
field testing in networking curriculums. Without field testing you
<br>
wouldn't know if the packet filtering that will be needed to replace
the
<br>
privacy and security NAT provides are worse than NAT itself. Field
<br>
testing would also show that consumers don't want to register their
<br>
internal IPs, don't want end-to-end transparency, and don't want to
give
<br>
a free pass to badly designed protocols (like SIP) that they require
deep
<br>
packet inspection to work well with NAT.
<br>
</blockquote>
<br>
I feel like I've been patted on the head. Thanks old timer!<br>
<br>
<blockquote cite="mid:20100325052141.713742B208E@mx5.roble.com"
type="cite">...<br>
<br>
I don't see that. I see quite the opposite. My own VOIP sites for
<br>
example, which work seamlessly with NAT. It just works because the
<br>
firewalls do deep inspection where they have to (SIP) and we use well
<br>
designed protocols (IAX2) where we can.
<br>
<br>
Roger Marquis
<br>
<br>
</blockquote>
<br>
Indeed. You must be servicing sites that are either large enough, rich
enough, or have no choice but to accept your firewalls to be installed,
with it's "deep inspection". I don't have that luxury, my sites are
either too small or won't pay for an expensive CRE firewall. Many use
very low end devices.<br>
<br>
And on "deep packet inspection", how does your firewall handle SIP TLS
to negotiate a secure media stream (SRTP)? How are you able to inspect
that encrypted SIP and SDP? Mine works because it relies on
technologies like SBC's to backhaul medai streams to solve the
(dumb)NAT issue. Which was the whole point of my original post, NAT
makes things less efficient and less reliable because it introduces the
need for rendezvous servers (and, for the most part, protocol specific
ones at that). I was just voicing the concern that bringing NAT into
ipv6 is not a good way to proceed. My own product supports both ipv4
and ipv6 VoIP and I really like being able to get two ipv6 endpoints to
stream media directly to each other while ipv4 ones must make use of my
SBC. It makes engineering (network load) a whole lot easier (not to
mention a lot cheaper).<br>
<br>
-lee<br>
<br>
<br>
<br>
</body>
</html>