draft-ietf-behave-nat-udp-01.txt   draft-ietf-behave-nat-udp-02.txt 
BEHAVE F. Audet, Ed. BEHAVE F. Audet, Ed.
Internet-Draft Nortel Networks Internet-Draft Nortel Networks
Expires: October 13, 2005 C. Jennings Expires: December 29, 2005 C. Jennings
Cisco Systems Cisco Systems
April 11, 2005 June 27, 2005
NAT Behavioral Requirements for Unicast UDP NAT Behavioral Requirements for Unicast UDP
draft-ietf-behave-nat-udp-01 draft-ietf-behave-nat-udp-02
Status of this Memo Status of this Memo
This document is an Internet-Draft and is subject to all provisions By submitting this Internet-Draft, each author represents that any
of Section 3 of RFC 3667. By submitting this Internet-Draft, each applicable patent or other IPR claims of which he or she is aware
author represents that any applicable patent or other IPR claims of have been or will be disclosed, and any of which he or she becomes
which he or she is aware have been or will be disclosed, and any of aware will be disclosed, in accordance with Section 6 of BCP 79.
which he or she become aware will be disclosed, in accordance with
RFC 3668.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet- other groups may also distribute working documents as Internet-
Drafts. Drafts.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt. http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html. http://www.ietf.org/shadow.html.
This Internet-Draft will expire on October 13, 2005. This Internet-Draft will expire on December 29, 2005.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2005). Copyright (C) The Internet Society (2005).
Abstract Abstract
This document defines basic terminology for describing different This document defines basic terminology for describing different
types of NAT behavior when handling Unicast UDP, and defines a set of types of NAT behavior when handling Unicast UDP, and defines a set of
requirements that would allow many applications, such as multimedia requirements that would allow many applications, such as multimedia
skipping to change at page 2, line 13 skipping to change at page 2, line 12
NATs that meet this set of requirements will greatly increase the NATs that meet this set of requirements will greatly increase the
likelihood that these applications will function properly. likelihood that these applications will function properly.
Table of Contents Table of Contents
1. Applicability Statement . . . . . . . . . . . . . . . . . . . 3 1. Applicability Statement . . . . . . . . . . . . . . . . . . . 3
2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
4. Network Address and Port Translation Behavior . . . . . . . . 5 4. Network Address and Port Translation Behavior . . . . . . . . 5
4.1 Address and Port Mapping . . . . . . . . . . . . . . . . . 5 4.1 Address and Port Mapping . . . . . . . . . . . . . . . . . 5
4.2 Port Assignment . . . . . . . . . . . . . . . . . . . . . 7 4.2 Port Assignment . . . . . . . . . . . . . . . . . . . . . 8
4.2.1 Port Assignment Behavior . . . . . . . . . . . . . . . 7 4.2.1 Port Assignment Behavior . . . . . . . . . . . . . . . 8
4.2.2 Port Parity . . . . . . . . . . . . . . . . . . . . . 9 4.2.2 Port Parity . . . . . . . . . . . . . . . . . . . . . 10
4.2.3 Port Contiguity . . . . . . . . . . . . . . . . . . . 9 4.2.3 Port Contiguity . . . . . . . . . . . . . . . . . . . 10
4.3 Mapping Refresh Direction . . . . . . . . . . . . . . . . 10 4.3 Mapping Refresh . . . . . . . . . . . . . . . . . . . . . 11
4.4 Mapping Refresh Scope . . . . . . . . . . . . . . . . . . 10 5. Filtering Behavior . . . . . . . . . . . . . . . . . . . . . . 12
5. Filtering Behavior . . . . . . . . . . . . . . . . . . . . . . 11 5.1 Filtering of Unsolicited Packets . . . . . . . . . . . . . 12
5.1 Filtering of Unsolicited Packets . . . . . . . . . . . . . 11 5.2 NAT Filter Refresh . . . . . . . . . . . . . . . . . . . . 13
5.2 NAT Filter Refresh . . . . . . . . . . . . . . . . . . . . 11 6. Hairpinning Behavior . . . . . . . . . . . . . . . . . . . . . 14
6. Hairpinning Behavior . . . . . . . . . . . . . . . . . . . . . 12 7. Application Level Gateways . . . . . . . . . . . . . . . . . . 15
7. Application Level Gateways . . . . . . . . . . . . . . . . . . 12 8. Deterministic Properties . . . . . . . . . . . . . . . . . . . 15
8. Deterministic Properties . . . . . . . . . . . . . . . . . . . 13 9. ICMP Destination Unreachable Behavior . . . . . . . . . . . . 16
9. ICMP Behavior . . . . . . . . . . . . . . . . . . . . . . . . 14 10. Fragmentation of Outgoing Packets . . . . . . . . . . . . . 17
10. Fragmentation of Packets . . . . . . . . . . . . . . . . . . 14 10.1 Smaller Adjacent MTU . . . . . . . . . . . . . . . . . . . 17
10.1 Smaller Adjacent MTU . . . . . . . . . . . . . . . . . . . 14 10.2 Smaller Network MTU . . . . . . . . . . . . . . . . . . . 18
10.2 Smaller Network MTU . . . . . . . . . . . . . . . . . . . 15 11. Receiving Fragmented Packets . . . . . . . . . . . . . . . . 18
11. Receiving Fragmented Packets . . . . . . . . . . . . . . . . 15 12. Requirements . . . . . . . . . . . . . . . . . . . . . . . . 19
12. Requirements . . . . . . . . . . . . . . . . . . . . . . . . 15 13. Security Considerations . . . . . . . . . . . . . . . . . . 20
12.1 Requirement Discussion . . . . . . . . . . . . . . . . . . 17 14. IANA Considerations . . . . . . . . . . . . . . . . . . . . 21
13. Security Considerations . . . . . . . . . . . . . . . . . . 19 15. IAB Considerations . . . . . . . . . . . . . . . . . . . . . 21
14. IANA Considerations . . . . . . . . . . . . . . . . . . . . 20 16. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . 22
15. IAB Considerations . . . . . . . . . . . . . . . . . . . . . 20 17. References . . . . . . . . . . . . . . . . . . . . . . . . . 23
16. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . 21 17.1 Normative References . . . . . . . . . . . . . . . . . . . 23
17. References . . . . . . . . . . . . . . . . . . . . . . . . . 21 17.2 Informational References . . . . . . . . . . . . . . . . . 23
17.1 Normative References . . . . . . . . . . . . . . . . . . . 21 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 24
17.2 Informational References . . . . . . . . . . . . . . . . . 21 Intellectual Property and Copyright Statements . . . . . . . . 25
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 23
Intellectual Property and Copyright Statements . . . . . . . . 24
1. Applicability Statement 1. Applicability Statement
The purpose of this specification is to define a set of requirements The purpose of this specification is to define a set of requirements
for NATs that would allow many applications, such as multimedia for NATs that would allow many applications, such as multimedia
communications or on-line gaming, to work consistently. Developing communications or on-line gaming, to work consistently. Developing
NATs that meet this set of requirements will greatly increase the NATs that meet this set of requirements will greatly increase the
likelihood that these applications will function properly. likelihood that these applications will function properly.
The requirements of this specification apply generally to all NAT The requirements of this specification apply generally to all NAT
skipping to change at page 3, line 27 skipping to change at page 3, line 27
address all issues specific to all possible NAT variations. address all issues specific to all possible NAT variations.
This document is meant to cover NATs of any size, from small This document is meant to cover NATs of any size, from small
residential NATs to large Enterprise NATs. However, it should be residential NATs to large Enterprise NATs. However, it should be
understood that Enterprise NATs normally provide much more than just understood that Enterprise NATs normally provide much more than just
NAT capabilities: for example, they typically provide Firewall NAT capabilities: for example, they typically provide Firewall
capabilities. Firewalls is specifically out-of-scope of this capabilities. Firewalls is specifically out-of-scope of this
specification: however, this specification does cover the inherent specification: however, this specification does cover the inherent
filtering aspects of NAT. filtering aspects of NAT.
Approaches using directly signaled control off the middle boxes such Approaches using directly signaled control of middle boxes such as
as Midcom, UPnP, or in-path signaling are out of scope. Midcom, UPnP, or in-path signaling are out of scope.
UDP Relays are out of the scope of this document. UDP Relays are out of the scope of this document.
Application aspects are out of scope as the focus is strictly on the Application aspects are out of scope as the focus is strictly on the
NAT itself. NAT itself.
This document only covers the UDP Unicast aspects of NAT traversal This document only covers the UDP Unicast aspects of NAT traversal
and does not cover TCP, IPSEC, or other protocols. Since the and does not cover TCP, IPSEC, or other protocols. Since the
document is for UDP only, packet inspection below the UDP layer document is for UDP only, packet inspection above the UDP layer
(including RTP) is also out-of-scope. (including RTP) is also out-of-scope.
2. Introduction 2. Introduction
Network Address Translators (NAT) are well known to cause very Network Address Translators (NAT) are well known to cause very
significant problems with applications that carry IP addresses in the significant problems with applications that carry IP addresses in the
payload RFC 3027 [5]. Applications that suffer from this problem payload RFC 3027 [5]. Applications that suffer from this problem
include Voice Over IP and Multimedia Over IP (e.g., SIP [6] and H.323 include Voice Over IP and Multimedia Over IP (e.g., SIP [6] and H.323
[20]), as well as online gaming. [20]), as well as online gaming.
skipping to change at page 5, line 45 skipping to change at page 5, line 45
inadequate at describing real-life NAT behavior. This specification inadequate at describing real-life NAT behavior. This specification
therefore refers to specific individual NAT behaviors instead of therefore refers to specific individual NAT behaviors instead of
using the Cone/Symmetric terminology. using the Cone/Symmetric terminology.
4. Network Address and Port Translation Behavior 4. Network Address and Port Translation Behavior
This section describes the various NAT behaviors applicable to NAT. This section describes the various NAT behaviors applicable to NAT.
4.1 Address and Port Mapping 4.1 Address and Port Mapping
When an internal endpoint opens an outgoing UDP session through a When an internal endpoint opens an outgoing session through a NAT,
NAT, the NAT assigns the session an external IP address and port the NAT assigns the session an external IP address and port number so
number so that subsequent response packets from the external endpoint that subsequent response packets from the external endpoint can be
can be received by the NAT, translated and forwarded to the internal received by the NAT, translated and forwarded to the internal
endpoint. This is a mapping between an internal IP address and port endpoint. This is a mapping between an internal IP address and port
IP:port and external IP:port tuple. It establishes the translation IP:port and external IP:port tuple. It establishes the translation
that will be performed by the NAT for the duration of the session. that will be performed by the NAT for the duration of the session.
For many applications, it is important to distinguish the behavior of For many applications, it is important to distinguish the behavior of
the NAT when there are multiple simultaneous sessions established to the NAT when there are multiple simultaneous sessions established to
different external endpoints. different external endpoints.
The key behavior to describe is the criteria for re-use of a mapping The key behavior to describe is the criteria for re-use of a mapping
for new sessions to external endpoints, after establishing a first for new sessions to external endpoints, after establishing a first
mapping between an internal X:x address and port and an external mapping between an internal X:x address and port and an external
skipping to change at page 6, line 39 skipping to change at page 6, line 39
| | n | | n
X:x | | X:x t X:x | | X:x t
++---++ e ++---++ e
| X | r | X | r
+-----+ n +-----+ n
a a
l l
The following address and port mapping behavior are defined: The following address and port mapping behavior are defined:
External NAT mapping is endpoint independent: Endpoint Independent Mapping:
The NAT reuses the port mapping for subsequent sessions The NAT reuses the port mapping for subsequent packets sent
initiated from the same internal IP address and port (X:x) to from the same internal IP address and port (X:x) to any
any external IP address and port. Specifically, X1':x1' equals external IP address and port. Specifically, X1':x1' equals
X2':x2' for all values of Y2:y2. X2':x2' for all values of Y2:y2.
External NAT mapping is endpoint address dependent: Address Dependent Mapping:
The NAT reuses the port mapping for subsequent sessions The NAT reuses the port mapping for subsequent packets sent
initiated from the same internal IP address and port (X:x) only from the same internal IP address and port (X:x) to the same
for sessions to the same external IP address, regardless of the external IP address, regardless of the external port.
external port. Specifically, X1':x1' equals X2':x2' if, and Specifically, X1':x1' equals X2':x2' if, and only if, Y2 equals
only if, Y2 equals Y1. Y1.
External NAT mapping is endpoint address and port dependent: Address and Port Dependent Mapping:
The NAT reuses the port mapping for subsequent sessions The NAT reuses the port mapping for subsequent packets sent
initiated from the same internal IP address and port (X:x) only from the same internal IP address and port (X:x) to the same
for sessions to the same external and port. Specifically, external and port while the mapping is still active.
X1':x1' equals X2':x2' if, and only if, Y2:y2 equals Y1:y1. Specifically, X1':x1' equals X2':x2' if, and only if, Y2:y2
equals Y1:y1.
It is important to note that these three possible choices make no It is important to note that these three possible choices make no
difference to the security properties of the NAT. The security difference to the security properties of the NAT. The security
properties are fully determined by which packets the NAT allows in properties are fully determined by which packets the NAT allows in
and which it does not. This is determined by the filtering behavior and which it does not. This is determined by the filtering behavior
in the filtering portions of the NAT. in the filtering portions of the NAT.
REQ-1: A NAT MUST have an "External NAT mapping is endpoint
independent" behavior.
Justification for REQ-1: In order for UNSAF methods to work, REQ-1
needs to be met. Failure to meet REQ-1 will force the use of a
Media Relay which is very often impractical.
Some NATs are capable of assigning IP addresses from a pool of IP Some NATs are capable of assigning IP addresses from a pool of IP
addresses on the external side of the NAT, as opposed to just a addresses on the external side of the NAT, as opposed to just a
single IP address. This is especially common with larger NATs. Some single IP address. This is especially common with larger NATs. Some
NATs use the external IP address mapping in an arbitrary fashion NATs use the external IP address mapping in an arbitrary fashion
(i.e. randomly): one internal IP address could have multiple external (i.e. randomly): one internal IP address could have multiple external
IP address mappings active at the same time for different sessions. IP address mappings active at the same time for different sessions.
These NATs have an "IP address pooling" behavior of "Arbitrary". These NATs have an "IP address pooling" behavior of "Arbitrary".
Some large Enterprise NATs use an IP address pooling behavior of Some large Enterprise NATs use an IP address pooling behavior of
"Arbitrary" as a means of hiding the IP address assigned to specific "Arbitrary" as a means of hiding the IP address assigned to specific
endpoints by making their assignment less predictable. Other NATs endpoints by making their assignment less predictable. Other NATs
use the same external IP address mapping for all sessions associated use the same external IP address mapping for all sessions associated
with the same internal IP address. These NATs have an "IP address with the same internal IP address. These NATs have an "IP address
pooling" behavior of "Paired." NATs that use an "IP address pooling" pooling" behavior of "Paired." NATs that use an "IP address pooling"
behavior of "arbitrary" can cause issues for applications that use behavior of "arbitrary" can cause issues for applications that use
multiple ports from the same endpoint but do not negotiate IP multiple ports from the same endpoint but do not negotiate IP
addresses individually (e.g., some applications using RTP and RTCP). addresses individually (e.g., some applications using RTP and RTCP).
REQ-2: It is RECOMMENDED that a NAT have an "IP address pooling"
behavior of "Paired". Note that this requirement is not
applicable to NATs that do not support IP address pooling.
Justification for REQ-2: This will allow applications that use
multiple ports originating from the same internal IP address to
also have the same external IP address. This is to avoid breaking
peer-to-peer applications which are not capable of negotiating the
IP address for RTP and the IP address for RTCP separately. As
such it is envisioned that this requirement will become less
important as applications become NAT-friendlier with time. The
main reason why this requirement is here is because in a peer-to-
peer application, you are subject to the other peer's mistake. In
particular, in the context of SIP, if my application supports the
extensions defined in RFC 3605 [9] for indicating RTP and RTCP
addresses and ports separately, but the other peer does not, there
may still be breakage in the form of lost of the RTP stream. This
requirements will avoid the loss of RTP in this context, although
the loss of RTCP may be inevitable in this particular example. It
is also worth noting that RFC 3605 is unfortunately not a
mandatory part of SIP (i.e., RFC 3261). This requirement will
therefore address a particularly nasty problem that will prevail
for a significant amount of time.
4.2 Port Assignment 4.2 Port Assignment
4.2.1 Port Assignment Behavior 4.2.1 Port Assignment Behavior
This section uses the following diagram for reference. This section uses the following diagram for reference.
E E
+-------+ +-------+ x +-------+ +-------+ x
| Y1 | | Y2 | t | Y1 | | Y2 | t
+---+---+ +---+---+ e +---+---+ +---+---+ e
skipping to change at page 8, line 42 skipping to change at page 9, line 13
the NAT needs to switch from Basic NAT to a Network Address and Port the NAT needs to switch from Basic NAT to a Network Address and Port
Translator (NAPT) mode (i.e., X'=X1'=X2' and x=x1=x2 but x1'!=x2', or Translator (NAPT) mode (i.e., X'=X1'=X2' and x=x1=x2 but x1'!=x2', or
a mapping of X1:x to X':x1' and X2:x to X':x2'). This port a mapping of X1:x to X':x1' and X2:x to X':x2'). This port
assignment behavior is referred to as "port preservation". It does assignment behavior is referred to as "port preservation". It does
not guarantee that the external port x' will always be the same as not guarantee that the external port x' will always be the same as
the internal port x but only that the NAT will preserve the port if the internal port x but only that the NAT will preserve the port if
possible. possible.
A NAT that does not attempt to make the external port numbers match A NAT that does not attempt to make the external port numbers match
the internal port numbers in any case (i.e., X1:x to X':x1', X2:x to the internal port numbers in any case (i.e., X1:x to X':x1', X2:x to
X':x2') is referred to as "no port preservation". X':x2') is referred to as "No port preservation".
Some NATs use "Port overloading", i.e. they always use port Some NATs use "Port overloading", i.e. they always use port
preservation even in the case of collision (i.e., X'=X1'=X2' and preservation even in the case of collision (i.e., X'=X1'=X2' and
x=x1=x2=x1'=x2', or a mapping of X1:x to X':x, and X2:x to X':x). x=x1=x2=x1'=x2', or a mapping of X1:x to X':x, and X2:x to X':x).
These NATs rely on the source of the response from the external These NATs rely on the source of the response from the external
endpoint (Y1:y1, Y2:y2) to forward a packet to the proper internal endpoint (Y1:y1, Y2:y2) to forward a packet to the proper internal
endpoint (X1 or X2). Port overloading fails if the two internal endpoint (X1 or X2). Port overloading fails if the two internal
endpoints are establishing sessions to the same external destination. endpoints are establishing sessions to the same external destination.
Most applications fail in some cases with "Port Overloading". It is Most applications fail in some cases with "Port Overloading". It is
skipping to change at page 9, line 24 skipping to change at page 9, line 44
source port that is already registered is unlikely to have any bad source port that is already registered is unlikely to have any bad
effects. Some NATs may choose to use only the ports in the dynamic effects. Some NATs may choose to use only the ports in the dynamic
range; the only down side of this practice is that it limits the range; the only down side of this practice is that it limits the
number of ports available. Other NAT devices may use everything but number of ports available. Other NAT devices may use everything but
the well-known range and may prefer to use the dynamics range first the well-known range and may prefer to use the dynamics range first
or possibly avoid the actual registered ports in the registered or possibly avoid the actual registered ports in the registered
range. Other NATs preserve the port range if it is in the well-known range. Other NATs preserve the port range if it is in the well-known
range. It should be noted that port 0 is reserved and must not be range. It should be noted that port 0 is reserved and must not be
used. used.
REQ-3: A NAT MUST NOT have a "Port assignment" behavior of "Port
overloading".
a) If the host's source port was in the range 1-1023, it is
RECOMMENDED the NAT's source port also be in the same range.
If the host's source port was in the range 1024-65535, it is
RECOMMENDED that the NAT's source port also be in that range.
Justification for REQ-3: This requirement must be met in order to
enable two applications on the internal side of the NAT both to
use the same port to try to communicate with the same destination.
NATs that implement port preservation have to deal with conflicts
on ports, and the multiple code paths this introduces often result
in nondeterministic behavior. However, it should be understood
that when a port is randomly assigned, it may just randomly happen
to be assigned the same port. Applications must therefore be able
to deal with both port preservation, and no port preservation.
a) Certain applications expect the source UDP port to be in the
well-known range. See RFC 2623 for an example.
4.2.2 Port Parity 4.2.2 Port Parity
Some NATs preserve the parity of the UDP port, i.e., an even port Some NATs preserve the parity of the UDP port, i.e., an even port
will be mapped to an even port, and an odd port will be mapped to an will be mapped to an even port, and an odd port will be mapped to an
odd port. This behavior respects the RFC 3550 [8] rule that RTP use odd port. This behavior respects the RFC 3550 [8] rule that RTP use
even ports, and RTCP use odd ports. Some NATs preserve the parity of even ports, and RTCP use odd ports. RFC 3550 allows any port numbers
the UDP port, i.e., an even port will be mapped to an even port, and to be used for RTP and RTCP if the two numbers are specified
an odd port will be mapped to an odd port. This behavior respects separately, for example using RFC 3605 [9]. However, some
the RFC 3550 rule that RTP use even ports and RTCP use odd ports when
the application takes a single port number as a parameter and derives
the RTP and RTCP port pair from that number. RFC 3550 allows any
port numbers to be used for RTP and RTCP if the two numbers are
specified separately, for example using RFC 3605 [9]. However, some
implementations do not include RFC 3605 and do not recognize when the implementations do not include RFC 3605 and do not recognize when the
peer has specified the RTCP port separately using RFC 3605. If such peer has specified the RTCP port separately using RFC 3605. If such
an implementation receives an odd RTP port number from the peer an implementation receives an odd RTP port number from the peer
(perhaps after having been translated by a NAT), and then follows the (perhaps after having been translated by a NAT), and then follows the
RFC 3550 rule to change the RTP port to the next lower even number, RFC 3550 rule to change the RTP port to the next lower even number,
this would obviously result in the loss of RTP. NAT-friendly this would obviously result in the loss of RTP. NAT-friendly
application aspects are outside the scope of this document. It is application aspects are outside the scope of this document. It is
expected that this issue will fade away with time, as implementations expected that this issue will fade away with time, as implementations
improve. Preserving the port parity allows for supporting improve. Preserving the port parity allows for supporting
communication with peers that do not support explicit specification communication with peers that do not support explicit specification
of both RTP and RTCP port numbers. of both RTP and RTCP port numbers.
REQ-4: It is RECOMMENDED that a NAT have a "Port parity preservation"
behavior of "Yes".
Justification for REQ-4: This is to avoid breaking peer-to-peer
applications which do not explicity and separately specify RTP and
RTCP port numbers and which follow the RFC 3550 rule to decrement
an odd RTP port to make it even. The same considerations as per
the IP address pooling requirement apply.
4.2.3 Port Contiguity 4.2.3 Port Contiguity
Some NATs attempt to preserve the port contiguity rule of RTCP=RTP+1. Some NATs attempt to preserve the port contiguity rule of RTCP=RTP+1.
These NATs do things like sequential assignment or port reservation.
Sequential port assignment assumes that the application will open a
mapping for RTP first and then open a mapping for RTCP. It is not
practical to enforce this requirement on all applications.
These NATs do things like sequential assignment, port reservation and Furthermore, there is a glaring problem if many applications (or
so forth. Sequential port assignment assumes that the application
will open a mapping for RTP first and then open a mapping for RTCP.
It is not practical to enforce this requirement on all applications.
Furthermore, there is a glare problem if many applications (or
endpoints) are trying to open mapping simultaneously. Port endpoints) are trying to open mapping simultaneously. Port
reservation is also problematic since it is wasteful, especially reservation is also problematic since it is wasteful, especially
considering that a NAT can not reliably distinguish between RTP over considering that a NAT can not reliably distinguish between RTP over
UDP and other UDP packets where there is no contiguity rule. For UDP and other UDP packets where there is no contiguity rule. For
those reasons, it would be too complex to attempt to preserve the those reasons, it would be too complex to attempt to preserve the
contiguity rule by suggesting specific NAT behavior, and it would contiguity rule by suggesting specific NAT behavior, and it would
certainly break the deterministic behavior rule. certainly break the deterministic behavior rule.
In order to support both RTP and RTCP, it will therefore be necessary In order to support both RTP and RTCP, it will therefore be necessary
that applications follows rules to negotiate both RTP and RTCP that applications follows rules to negotiate both RTP and RTCP
separately, and account for the very real possibility that the separately, and account for the very real possibility that the
RTCP=RTP+1 rule will be broken. As this is an application RTCP=RTP+1 rule will be broken. As this is an application
requirement, it is outside of the scope of this document. requirement, it is outside of the scope of this document.
4.3 Mapping Refresh Direction 4.3 Mapping Refresh
NAT UDP mapping timeout implementations vary but include the timer's NAT mapping timeout implementations vary but include the timer's
value and the way the mapping timer is refreshed to keep the mapping value and the way the mapping timer is refreshed to keep the mapping
alive. alive.
The mapping timer is defined as the time a mapping will stay active The mapping timer is defined as the time a mapping will stay active
without packets traversing the NAT. There is great variation in the without packets traversing the NAT. There is great variation in the
values used by different NATs. values used by different NATs.
REQ-5: A NAT UDP mapping timer MUST NOT expire in less than 2
minutes.
a) The value of the NAT UDP mapping timer MAY be configurable.
b) A default value of 5 minutes for the NAT UDP mapping timer is
RECOMMENDED.
Justification for REQ-5: This requirement is to ensure that the
timeout is long enough to avoid too frequent timer refresh
packets.
a) Configuration is desirable for adapting to specific networks
and troubleshooting.
b) This default is to avoid too frequent timer refresh packets.
Some NATs keep the mapping active (i.e., refresh the timer value) Some NATs keep the mapping active (i.e., refresh the timer value)
when a packet goes from the internal side of the NAT to the external when a packet goes from the internal side of the NAT to the external
side of the NAT. This is referred to as having a NAT Outbound side of the NAT. This is referred to as having a NAT Outbound
refresh behavior of "True". refresh behavior of "True".
Some NATs keep the mapping active when a packet goes from the Some NATs keep the mapping active when a packet goes from the
external side of the NAT to the internal side of the NAT. This is external side of the NAT to the internal side of the NAT. This is
referred to as having a NAT Inbound Refresh Behavior of "True". referred to as having a NAT Inbound Refresh Behavior of "True".
Some NATs keep the mapping active on both, in which case both Some NATs keep the mapping active on both, in which case both
properties are "True". properties are "True".
4.4 Mapping Refresh Scope REQ-6: The NAT mapping Refresh Direction MUST have a "NAT Outbound
refresh behavior" of "True".
a) The NAT mapping Refresh Direction MAY have a "NAT Inbound
refresh behavior" of "True".
If the mapping is refreshed for all sessions on that mapping by any Justification for REQ-6: Outbound refresh is necessary for allowing
outbound traffic, the NAT is said to have a NAT Mapping Refresh Scope the client to keep the mapping alive.
of "Per mapping". If the mapping is refreshed only on a specific a) Inbound refresh may be useful for applications where there is
session on that particular mapping by any outbound traffic, the NAT no outgoing UDP traffic.
is said to have a "Per session" NAT mapping Refresh Scope.
5. Filtering Behavior 5. Filtering Behavior
This section describes various filtering behaviors observed in NATs. This section describes various filtering behaviors observed in NATs.
5.1 Filtering of Unsolicited Packets 5.1 Filtering of Unsolicited Packets
When an internal endpoint opens an outgoing UDP session through a When an internal endpoint opens an outgoing session through a NAT,
NAT, the NAT assigns a filtering rule for the mapping between an the NAT assigns a filtering rule for the mapping between an internal
internal IP:port (X:x) and external IP:port (Y:y) tuple. IP:port (X:x) and external IP:port (Y:y) tuple.
The key behavior to describe is what criteria are used by the NAT to The key behavior to describe is what criteria are used by the NAT to
filter packets originating from specific external endpoints. filter packets originating from specific external endpoints.
External filtering is endpoint independent: Endpoint Independent Filtering:
The NAT filters out only packets not destined to the internal The NAT filters out only packets not destined to the internal
address and port X:x, regardless of the external IP address and address and port X:x, regardless of the external IP address and
port source (Z:z). The NAT forwards any packets destined to port source (Z:z). The NAT forwards any packets destined to
X:x. In other words, sending packets from the internal side of X:x. In other words, sending packets from the internal side of
the NAT to any external IP address is sufficient to allow any the NAT to any external IP address is sufficient to allow any
packets back to the internal endpoint. packets back to the internal endpoint.
External filtering is endpoint address dependent: Address Dependent Filtering:
The NAT filters out packets not destined to the internal The NAT filters out packets not destined to the internal
address X:x. Additionally, the NAT will filter out packets address X:x. Additionally, the NAT will filter out packets
from Y:y destined for the internal endpoint X:x if X:x has not from Y:y destined for the internal endpoint X:x if X:x has not
sent packets to Y previously (independently of the port used by sent packets to Y:any previously (independently of the port
Y). In other words, for receiving packets from a specific used by Y). In other words, for receiving packets from a
external endpoint, it is necessary for the internal endpoint to specific external endpoint, it is necessary for the internal
send packets first to that specific external endpoint's IP endpoint to send packets first to that specific external
address. endpoint's IP address.
External filtering is endpoint address and port dependent: Address and Port Dependent Filtering:
This is similar to the previous behavior, except that the This is similar to the previous behavior, except that the
external port is also relevant. The NAT filters out packets external port is also relevant. The NAT filters out packets
not destined for the internal address X:x. Additionally, the not destined for the internal address X:x. Additionally, the
NAT will filter out packets from Y:y destined for the internal NAT will filter out packets from Y:y destined for the internal
endpoint X:x if X:x has not sent packets to Y:y previously. In endpoint X:x if X:x has not sent packets to Y:y previously. In
other words, for receiving packets from a specific external other words, for receiving packets from a specific external
endpoint, it is necessary for the internal endpoint to send endpoint, it is necessary for the internal endpoint to send
packets first to that external endpoint's IP address and port. packets first to that external endpoint's IP address and port.
REQ-7: If application transparency is most important, it is
RECOMMENDED that a NAT have an "Endpoint independent filtering"
behavior. If a more stringent filtering behavior is most
important, it is RECOMMENDED that a NAT have an "Address dependent
filtering" behavior.
a) The filtering behavior MAY be an option configurable by the
administrator of the NAT.
OPEN ISSUE: Should REQ-7a be a SHOULD instead of a MAY?
Justification for REQ-7: The recommendation to use Endpoint
Independent Filtering is aimed at maximizing application
transparency, in particular for applications that receive media
simultaneously from multiple locations (e.g., gaming), or
applications that use rendezvous techniques. However, it is also
possible that in some circumstances, it may be preferable to have
a more stringent filtering behavior. Filtering independently of
the external endpoint is not as secure: an unauthorized packet
could get a specific port while the port was kept open if it was
lucky enough to find the port open. In theory, filtering based on
both IP address and port is more secure than filtering based only
on the IP address (because the external endpoint could in reality
be two endpoints behind another NAT, where one of the two
endpoints is an attacker): however, such a policy could interfere
with applications that expect to receive UDP packets on more than
one UDP port. Using Endpoint Independent Filtering or Address
Dependent Filetering instead of Address and Port Dependent
Filtering on a NAT (say NAT-A) also has benefits when the other
enpoint is behind a non-BEHAVE compliant NAT (say NAT-B) which
doesn't support REQ-1. When the endpoints use ICE, if NAT-A uses
Address and Port Dependent Filtering, connectivity will require a
Media Relay. However, if NAT-A uses Endpoint Indepent Filtering
or Address Dependent Filtering, ICE will ultimately find
connectivity without requiring a Media Relay. Having the
filtering behavior being an option configurable by the
administrator of the NAT ensures that a NAT can be used in the
widest variety of deployment scenarios.
5.2 NAT Filter Refresh 5.2 NAT Filter Refresh
The time for which a NAT filter is valid can be refreshed based on The time for which a NAT filter is valid can be refreshed based on
packets that are inbound, outbound, or going either direction. In packets that are inbound, outbound, or going either direction.
the case of "External Filtering" of "Address dependent" or "Address
and port dependent" NATs, the scope of the refresh could include the
filters for just the particular port and destination or for all the
ports and destinations sharing the same external address and port on
the NAT.
6. Hairpinning Behavior 6. Hairpinning Behavior
If two hosts (called X1 and X2) are behind the same NAT and If two hosts (called X1 and X2) are behind the same NAT and
exchanging traffic, the NAT may allocate an address on the outside of exchanging traffic, the NAT may allocate an address on the outside of
the NAT for X2, called X2':x2'. If X1 sends traffic to X2':x2', it the NAT for X2, called X2':x2'. If X1 sends traffic to X2':x2', it
goes to the NAT, which must relay the traffic from X1 to X2. This is goes to the NAT, which must relay the traffic from X1 to X2. This is
referred to as hairpinning and is illustrated below. referred to as hairpinning and is illustrated below.
NAT NAT
skipping to change at page 12, line 43 skipping to change at page 14, line 41
X2:x2, back to that internal address X2:x2. Note that typically X1' X2:x2, back to that internal address X2:x2. Note that typically X1'
is the same as X2'. is the same as X2'.
Furthermore, the NAT may present the hairpinned packet with either an Furthermore, the NAT may present the hairpinned packet with either an
internal or an external source IP address and port. The hairpinning internal or an external source IP address and port. The hairpinning
NAT behavior can therefore be either "External source IP address and NAT behavior can therefore be either "External source IP address and
port" or "Internal source IP address and port". "Internal source IP port" or "Internal source IP address and port". "Internal source IP
address and port" may cause problems by confusing an implementation address and port" may cause problems by confusing an implementation
that is expecting an external IP address and port. that is expecting an external IP address and port.
REQ-8: A NAT MUST support "Hairpinning".
a) A NAT Hairpinning behavior MUST be "External source IP address
and port".
Justification for REQ-8: This requirement is to allow communications
between two endpoints behind the same NAT when they are trying
each other's external IP addresses.
a) Using the external IP address is necessary for applications
with a restrictive policy of not accepting packets from IP
addresses that differ from what is expected.
7. Application Level Gateways 7. Application Level Gateways
Certain NATs have implemented Application Level Gateways (ALGs) for Certain NATs have implemented Application Level Gateways (ALGs) for
various protocols, including protocols for negotiating peer-to-peer various protocols, including protocols for negotiating peer-to-peer
UDP sessions such as SIP. sessions such as SIP.
Certain NATs have these ALGs turned on permanently, others have them Certain NATs have these ALGs turned on permanently, others have them
turned on by default but let them be be turned off, and others have turned on by default but let them be be turned off, and others have
them turned off by default but let them be turned on. them turned off by default but let them be turned on.
NAT ALGs may interfere with UNSAF methods and must therefore be used NAT ALGs may interfere with UNSAF methods or protocols that try to be
with extreme caution. NAT-aware and must therefore be used with extreme caution.
REQ-9: If a NAT includes ALGs, it is RECOMMENDED that all of those
ALGs (except for DNS [19] and FTP [18]) be disabled by default.
a) If a NAT includes ALGs, it is RECOMMENDED that the NAT allow
the NAT administrator to enable or disable each ALG separately.
Justification for REQ-9: NAT ALGs may interfere with UNSAF methods.
a) This requirement allows the user to enable ALGs which are
necessary to aid operation of some applications without
enabling ALGs which interfere with operation of other
applications.
8. Deterministic Properties 8. Deterministic Properties
The classification of NATs is further complicated by the fact that The classification of NATs is further complicated by the fact that
under some conditions the same NAT will exhibit different behaviors. under some conditions the same NAT will exhibit different behaviors.
This has been seen on NATs that preserve ports or have specific This has been seen on NATs that preserve ports or have specific
algorithms for selecting a port other than a free one. If the algorithms for selecting a port other than a free one. If the
external port that the NAT wishes to use is already in use by another external port that the NAT wishes to use is already in use by another
session, the NAT must select a different port. This results in session, the NAT must select a different port. This results in
different code paths for this conflict case, which results in different code paths for this conflict case, which results in
skipping to change at page 13, line 41 skipping to change at page 16, line 16
addresses to two different external IP addresses. For example, X1:x addresses to two different external IP addresses. For example, X1:x
is going to Y1:y1 and X2:x is going to Y2:y2, where Y1:y1 does not is going to Y1:y1 and X2:x is going to Y2:y2, where Y1:y1 does not
equal Y2:y2. Some NATs will map X1:x to X1':x and will also map X2:x equal Y2:y2. Some NATs will map X1:x to X1':x and will also map X2:x
to X1':x. This works in the case where the NAT mapping is address to X1':x. This works in the case where the NAT mapping is address
port dependent. However some NATs change their behavior when this port dependent. However some NATs change their behavior when this
type of port reuse is happening. The NAT may look like it has NAT type of port reuse is happening. The NAT may look like it has NAT
mappings that are independent when this type of reuse is not mappings that are independent when this type of reuse is not
happening but may change to Address Port Dependent when this reuse happening but may change to Address Port Dependent when this reuse
happens. happens.
Any NAT that changes the NAT mapping or the External Filtering at any Any NAT that changes the NAT mapping or the External Filtering
point in time under any particular conditions is referred to as a without configuration changes, at any point in time under any
"non-deterministic" NAT. NATs that don't are called "deterministic". particular conditions is referred to as a "non-deterministic" NAT.
NATs that don't are called "deterministic".
Non-deterministic NATs generally change behavior when a conflict of Non-deterministic NATs generally change behavior when a conflict of
some sort happens, i.e. when the port that would normally be used is some sort happens, i.e. when the port that would normally be used is
already in use by another mapping. The NAT mapping and External already in use by another mapping. The NAT mapping and External
Filtering in the absence of conflict is referred to as the Primary Filtering in the absence of conflict is referred to as the Primary
behavior. The behavior after the first conflict is referred to as behavior. The behavior after the first conflict is referred to as
Secondary and after the second conflict is referred to as Tertiary. Secondary and after the second conflict is referred to as Tertiary.
No NATs have been observed that change on further conflicts but it is No NATs have been observed that change on further conflicts but it is
certainly possible that they exist. certainly possible that they exist.
9. ICMP Behavior REQ-10: A NAT MUST have deterministic behavior, i.e., it MUST NOT
change the NAT mapping or the External External Filtering Behavior
at any point in time or under any particular conditions.
When a NAT sends a UDP packet towards a host on the other side of the Justification for REQ-10: Non-deterministic NATs are very difficult
to troubleshoot because they require more intensive testing. This
non-deterministic behavior is the root cause of much of the
uncertainty that NATs introduce about whether or not applications
will work.
9. ICMP Destination Unreachable Behavior
When a NAT sends a packet towards a host on the other side of the
NAT, an ICMP message may be sent in response to that packet. That NAT, an ICMP message may be sent in response to that packet. That
ICMP message may be sent by the destination host or by any router ICMP message may be sent by the destination host or by any router
along the network path. The NAT's default configuration SHOULD NOT along the network path. The NAT's default configuration SHOULD NOT
filter ICMP messages based on their source IP address. Such ICMP filter ICMP messages based on their source IP address. Such ICMP
messages SHOULD be rewritten by the NAT (specifically the IP headers messages SHOULD be rewritten by the NAT (specifically the IP headers
and the ICMP payload) and forwarded to the appropriate internal or and the ICMP payload) and forwarded to the appropriate internal or
external host. The NAT needs to perform this function for as long as external host. The NAT needs to perform this function for as long as
the UDP mapping is active. Receipt of any sort of ICMP message MUST the UDP mapping is active. Receipt of any sort of ICMP message MUST
NOT destroy the NAT binding. A NAT which performs the functions NOT destroy the NAT mapping. A NAT which performs the functions
described in the paragraph above is referred to as "UDP Support described in the paragraph above is referred to as "UDP Support
Destination Unreachable". Destination Unreachable".
There is no significant security advantage to blocking ICMP There is no significant security advantage to blocking ICMP
Destination Unreachable packets. Destination Unreachable packets.
Additionally, blocking ICMP Destination Unreachable packets can Additionally, blocking ICMP Destination Unreachable packets can
interfere with application failover, UDP Path MTU Discovery (see interfere with application failover, UDP Path MTU Discovery (see
RFC1191 [10] and RFC1435 [15]), and with traceroute. Blocking any RFC1191 [10] and RFC1435 [15]), and with traceroute. Blocking any
ICMP message is discouraged, and blocking ICMP Destination ICMP message is discouraged, and blocking ICMP Destination
Unreachable is strongly discouraged. Unreachable is strongly discouraged.
10. Fragmentation of Packets REQ-11: It is RECOMMENDED that a NAT support ICMP Destination
Unreachable.
a) The ICMP timeout SHOULD be greater than 2 seconds.
Justification for REQ-11: This is easy to do, is used for many things
including MTU discovery and rapid detection of error conditions,
and has no negative consequences.
a) The ICMP timeout SHOULD be greater than 2 seconds.
10. Fragmentation of Outgoing Packets
When sending a packet, there are two situations that may cause IP When sending a packet, there are two situations that may cause IP
fragmentation for packets from the inside to the outside. It is fragmentation for packets from the inside to the outside. It is
worth noting that many IP stacks do not use Path MTU Discovery with worth noting that many IP stacks do not use Path MTU Discovery with
UDP packets. UDP packets.
10.1 Smaller Adjacent MTU 10.1 Smaller Adjacent MTU
The first situation is when the MTU of the adjacent link is too The first situation is when the MTU of the adjacent link is too
small. This can occur if the NAT is doing PPPoE, or if the NAT has small. This can occur if the NAT is doing PPPoE, or if the NAT has
been configured with a small MTU to reduce serialization delay when been configured with a small MTU to reduce serialization delay when
sending large packets and small, higher-priority packets. sending large packets and small higher-priority packets, or for other
reasons.
The packet could have its Don't Fragment bit set to 1 (DF=1) or 0 The packet could have its Don't Fragment bit set to 1 (DF=1) or 0
(DF=0). (DF=0).
If the packet has DF=1, the NAT should send back an ICMP message If the packet has DF=1, the NAT SHOULD send back an ICMP message
"fragmentation needed and DF set" message to the host as described in "fragmentation needed and DF set" message to the host as described in
RFC 792 [13]. RFC 792 [13].
If the packet has DF=0, the NAT should fragment the packet and send If the packet has DF=0, the NAT SHOULD fragment the packet and send
the fragments, in order. This is the same function a router performs the fragments, in order. This is the same function a router performs
in a similar situation RFC 1812 [14]. in a similar situation RFC 1812 [14].
NATs that operate as described in this section are described as NATs that operate as described in this section are described as
"Supports Fragmentation" (abbreviated SF). "Supports Fragmentation" (abbreviated SF).
10.2 Smaller Network MTU 10.2 Smaller Network MTU
The second situation is when the MTU on some link in the middle of The second situation is when the MTU on some link in the middle of
the network that is not the adjacent link is too small. If DF=0, the the network that is not the adjacent link is too small. If DF=0, the
router adjacent to the small-MTU segment will fragment the packet and router adjacent to the small-MTU segment will fragment the packet and
forward the fragments RFC 1812. forward the fragments as specified in RFC 1812 [14].
If DF=1, the router adjacent to the small-MTU segment will send the If DF=1, the router adjacent to the small-MTU segment will send the
ICMP message "fragmentation needed and DF set" back towards the NAT. ICMP message "fragmentation needed and DF set" back towards the NAT.
The NAT needs to forward this ICMP message to the inside host. The NAT needs to forward this ICMP message to the inside host.
The classification of NATs that perform this behavior is covered in The classification of NATs that perform this behavior is covered in
the ICMP section of this document. the ICMP section of this document.
REQ-12: A NAT MUST support fragmentation of packets larger than link
MTU.
Justification for REQ-12: Fragmented packets become more common with
large video packets and should continue to work. Applications can
use MTU discovery to work around this problem.
11. Receiving Fragmented Packets 11. Receiving Fragmented Packets
For a variety of reasons, a NAT may receive a fragmented UDP packet. For a variety of reasons, a NAT may receive a fragmented packet. The
The IP packet containing the UDP header could arrive first or last IP packet containing the header could arrive in any fragment
depending on network conditions, packet ordering, and the depending on network conditions, packet ordering, and the
implementation of the IP stack that generated the fragments. implementation of the IP stack that generated the fragments.
A NAT that is capable only of receiving UDP fragments in order (that A NAT that is capable only of receiving fragments in order (that is,
is, with the UDP header in the first packet) and forwarding each of with the header in the first packet) and forwarding each of the
the fragments to the internal host is described as "Received fragments to the internal host is described as "Received Fragments
Fragments Ordered". Ordered".
A NAT that is capable of receiving UDP fragments in or out of order A NAT that is capable of receiving fragments in or out of order and
and forwarding the individual packets (or a reassembled packet) to forwarding the individual packets (or a reassembled packet) to the
the internal host is referred to as "Receive Fragments Out of Order". internal host is referred to as "Receive Fragments Out of Order".
See the Security Considerations section of this document for a See the Security Considerations section of this document for a
discussion of this behavior. discussion of this behavior.
A NAT that is neither of these is referred to as "Receive Fragments A NAT that is neither of these is referred to as "Receive Fragments
None". None".
REQ-13: A NAT MUST support receiving in order fragments, so it MUST
be "Received Fragment Ordered" or "Received Fragment Out of
Order".
a) A NAT MAY support receiving fragmented packets that are out of
order and be of type "Received Fragment Out of Order".
Justification for REQ-13: See Security Considerations.
12. Requirements 12. Requirements
The requirements in this section are aimed at minimizing the The requirements in this section are aimed at minimizing the
complications caused by NATs to applications such as realtime complications caused by NATs to applications such as realtime
communications and online gaming. communications and online gaming. The requirements listed earlier in
the document are consolidated here into a single section.
It should be understood, however, that applications normally do not It should be understood, however, that applications normally do not
know in advance if the NAT conforms to the recommendations defined in know in advance if the NAT conforms to the recommendations defined in
this section. Peer-to-peer media applications still need to use this section. Peer-to-peer media applications still need to use
normal procedures such as ICE [16]. normal procedures such as ICE [16].
A NAT that supports all of the mandatory requirements of this A NAT that supports all of the mandatory requirements of this
specification (i.e., the "MUST"), is "compliant with this specification (i.e., the "MUST"), is "compliant with this
specification." A NAT that supports all of the requirements of this specification." A NAT that supports all of the requirements of this
specification (i.e., included the "RECOMMENDED") is "fully compliant specification (i.e., included the "RECOMMENDED") is "fully compliant
with all the mandatory and recommended requirements of this with all the mandatory and recommended requirements of this
specification." specification."
REQ-1 A NAT MUST have an "External NAT mapping is endpoint REQ-1: A NAT MUST have an "External NAT mapping is endpoint
independent" behavior. independent" behavior.
REQ-2 It is RECOMMENDED that a NAT have an "IP address pooling" REQ-2: It is RECOMMENDED that a NAT have an "IP address pooling"
behavior of "Paired". Note that this requirement is not behavior of "Paired". Note that this requirement is not
applicable to NATs that do not support IP address pooling. applicable to NATs that do not support IP address pooling.
REQ-3 IA NAT MUST NOT have a "Port assignment" behavior of "Port REQ-3: A NAT MUST NOT have a "Port assignment" behavior of "Port
overloading". overloading".
a) If the host's source port was in the range 1-1023, it is a) If the host's source port was in the range 1-1023, it is
RECOMMENDED the NAT's source port also be in the same RECOMMENDED the NAT's source port also be in the same range.
range. If the host's source port was in the range 1024- If the host's source port was in the range 1024-65535, it is
65535, it is RECOMMENDED that the NAT's source port also be RECOMMENDED that the NAT's source port also be in that range.
in that range. REQ-4: It is RECOMMENDED that a NAT have a "Port parity preservation"
REQ-4 It is RECOMMENDED that a NAT have a "Port parity preservation"
behavior of "Yes". behavior of "Yes".
REQ-5 A NAT UDP mapping timer MUST NOT expire in less than 2 REQ-5: A NAT UDP mapping timer MUST NOT expire in less than 2
minutes. minutes.
a) The value of the NAT UDP mapping timer MAY be configurable. a) The value of the NAT UDP mapping timer MAY be configurable.
b) A default value of 5 minutes for the NAT UDP mapping timer b) A default value of 5 minutes for the NAT UDP mapping timer is
is RECOMMENDED. RECOMMENDED.
REQ-6 The NAT mapping Refresh Direction MUST have a "NAT Outbound REQ-6: The NAT mapping Refresh Direction MUST have a "NAT Outbound
refresh behavior" of "True". refresh behavior" of "True".
a) The NAT mapping Refresh Direction MAY have a "NAT Inbound a) The NAT mapping Refresh Direction MAY have a "NAT Inbound
refresh behavior" of "True". refresh behavior" of "True".
b) The NAT mapping Refresh Direction MUST have a "NAT refresh REQ-7: If application transparency is most important, it is
method behavior" of "Per mapping" (i.e. refresh all RECOMMENDED that a NAT have an "Endpoint independent filtering"
sessions active on a particular mapping). behavior. If a more stringent filtering behavior is most
REQ-7 It is RECOMMENDED that a NAT have an "External filtering is important, it is RECOMMENDED that a NAT have an "Address dependent
endpoint address dependent" behavior. filtering" behavior.
REQ-8 A NAT MUST support "Hairpinning". a) The filtering behavior MAY be an option configurable by the
a) A NAT Hairpinning behavior MUST be "External source IP administrator of the NAT.
address and port". OPEN ISSUE: Should REQ-7a be a SHOULD instead of a MAY?
REQ-9 If a NAT includes ALGs, it is RECOMMENDED that all of those REQ-8: A NAT MUST support "Hairpinning".
ALGs (except for DNS [19] and FTP [18]) be disabled by a) A NAT Hairpinning behavior MUST be "External source IP address
default. and port".
REQ-9: If a NAT includes ALGs, it is RECOMMENDED that all of those
a) If a NAT includes ALGs, it is RECOMMENDED that the NAT ALGs (except for DNS [19] and FTP [18]) be disabled by default.
allow the user to enable or disable each ALG separately. a) If a NAT includes ALGs, it is RECOMMENDED that the NAT allow
REQ-10 A NAT MUST have deterministic behavior, i.e., it MUST NOT the NAT administrator to enable or disable each ALG separately.
change the NAT mapping or the External External Filtering REQ-10: A NAT MUST have deterministic behavior, i.e., it MUST NOT
Behavior at any point in time or under any particular change the NAT mapping or the External External Filtering Behavior
conditions. at any point in time or under any particular conditions.
REQ-11 It is RECOMMENDED that a NAT support ICMP Destination REQ-11: It is RECOMMENDED that a NAT support ICMP Destination
Unreachable. Unreachable.
a) The ICMP timeout SHOULD be greater than 2 seconds. a) The ICMP timeout SHOULD be greater than 2 seconds.
REQ-12 A NAT MUST support fragmentation of packets larger than link REQ-12: A NAT MUST support fragmentation of packets larger than link
MTU. MTU.
REQ-13 A NAT MUST support receiving in order fragments, so it MUST be REQ-13: A NAT MUST support receiving in order fragments, so it MUST
"Received Fragment Ordered" or "Received Fragment Out of be "Received Fragment Ordered" or "Received Fragment Out of
Order". Order".
a) A NAT MAY support receiving fragmented packets that are out a) A NAT MAY support receiving fragmented packets that are out of
of order and be of type "Received Fragment Out of Order". order and be of type "Received Fragment Out of Order".
12.1 Requirement Discussion
This section describes why each of these requirements was chosen and
the consequences of violating any of them:
REQ-1 In order for UNSAF methods to work, REQ-1 needs to be met.
Failure to meet REQ-1 will force the use of a Media Relay
which is very often impractical.
REQ-2 This will allow applications that use multiple ports
originating from the same internal IP address to also have the
same external IP address. This is to avoid breaking peer-to-
peer applications which are not capable of negotiating the IP
address for RTP and the IP address for RTCP separately. As
such it is envisioned that this requirement will become less
important as applications become NAT-friendlier with time.
The main reason why this requirement is here is because in a
peer-to-peer application, you are subject to the other peer's
mistake. In particular, in the context of SIP, if my
application supports the extensions defined in RFC 3605 [9]
for indicating RTP and RTCP addresses and ports separately,
but the other peer does not, there may still be breakage in
the form of lost of the RTP stream. This requirements will
avoid the loss of RTP in this context, although the loss of
RTCP may be inevitable in this particular example. It is also
worth noting that RFC 3605 is unfortunately not a mandatory
part of SIP (i.e., RFC 3261). This requirement will therefore
address a particularly nasty problem that will prevail for a
significant amount of time.
REQ-3 This requirement must be met in order to enable two
applications on the internal side of the NAT both to use the
same port to try to communicate with the same destination.
NATs that implement port preservation have to deal with
conflicts on ports, and the multiple code paths this
introduces often result in nondeterministic behavior.
However, it should be understood that a NAT that when a port
is randomly assigned, it may just randomly happen to be
assigned the same port. Applications must therefore be able
to deal with both port preservation, and no port preservation.
a) Certain applications expect the source UDP port to be in
the well-known range. See RFC 2623 for an example.
REQ-4 This is to avoid breaking peer-to-peer applications which do
not explicity and separately specify RTP and RTCP port numbers
and which follow the RFC 3550 rule to decrement an odd RTP
port to make it even. The same considerations as per the IP
address pooling requirement apply.
REQ-5 This requirement is to ensure that the timeout is long enough
to avoid too frequent timer refresh packets.
a) Configuration is desirable for adapting to specific
networks and troubleshooting.
b) This default is to avoid too frequent timer refresh
packets.
REQ-6 Outbound refresh is necessary for allowing the client to keep
the mapping alive.
a) Inbound refresh may be useful for applications where there
is no outgoing UDP traffic.
b) Using the refresh on a per mapping basis avoids the need
for separate keep alive packets for all the available
sessions.
REQ-7 Filtering based on the IP address is felt to have the maximum
balance between security and usefulness. Filtering
independently of the external IP address and port is not as
secure: an unauthorized packet could get at a specific port
while the port was kept open if it was lucky enough to find
the port open. In theory, filtering based on both IP address
and port is more secure than filtering based only on the IP
address (because the external endpoint could in reality be two
endpoints behind another NAT, where one of the two endpoints
is an attacker). However, such a restrictive policy could
interfere with certain applications that use more than one
port.
REQ-8 This requirement is to allow communications between two
endpoints behind the same NAT when they are trying each
other's external IP addresses.
a) Using the external IP address is necessary for applications
with a restrictive policy of not accepting packets from IP
addresses that differ from what is expected.
REQ-9 NAT ALGs may interfere with UNSAF methods.
a) This requirement allows the user to enable ALGs which are
necessary to aid operation of some applications without
enabling ALGs which interfere with operation of other
applications.
REQ-10 Non-deterministic NATs are very difficult to troubleshoot
because they require more intensive testing. This non-
deterministic behavior is the root cause of much of the
uncertainty that NATs introduce about whether or not
applications will work.
REQ-11 This is easy to do, is used for many things including MTU
discovery and rapid detection of error conditions, and has no
negative consequences.
REQ-12 Fragmented packets become more common with large video packets
and should continue to work. Applications can use MTU
discovery to work around this problem.
REQ-13 See Security Considerations.
13. Security Considerations 13. Security Considerations
NATs are often deployed to achieve security goals. Most of the NATs are often deployed to achieve security goals. Most of the
recommendations and requirements in this document do not affect the recommendations and requirements in this document do not affect the
security properties of these devices, but a few of them do have security properties of these devices, but a few of them do have
security implications and are discussed in this section. security implications and are discussed in this section.
This work recommends that the timers for mapping be refreshed only on This work recommends that the timers for mapping be refreshed only on
outgoing packets and does not make recommendations about whether or outgoing packets and does not make recommendations about whether or
skipping to change at page 20, line 25 skipping to change at page 21, line 34
the external filtering behavior, which is independent of the mapping the external filtering behavior, which is independent of the mapping
behavior. behavior.
When a fragmented packet is received from the external side and the When a fragmented packet is received from the external side and the
packets are out of order so that the initial fragment does not arrive packets are out of order so that the initial fragment does not arrive
first, many systems simply discard the out of order packets. first, many systems simply discard the out of order packets.
Moreover, since some networks deliver small packets ahead of large Moreover, since some networks deliver small packets ahead of large
ones, there can be many out of order fragments. NATs that are ones, there can be many out of order fragments. NATs that are
capable of delivering these out of order packets are possible but capable of delivering these out of order packets are possible but
they need to store the out of order fragments, which can open up a they need to store the out of order fragments, which can open up a
DoS opportunity. Fragmentation has been a tool used in many attacks, DoS opportunity if done incorrectly. Fragmentation has been a tool
some involving passing fragmented packets through NATs and others used in many attacks, some involving passing fragmented packets
involving DoS attacks based on the state needed to reassemble the through NATs and others involving DoS attacks based on the state
fragments. NAT implementers should be aware of RFC 3128 [12] and RFC needed to reassemble the fragments. NAT implementers should be aware
1858 [11]. of RFC 3128 [12] and RFC 1858 [11].
14. IANA Considerations 14. IANA Considerations
There are no IANA considerations. There are no IANA considerations.
15. IAB Considerations 15. IAB Considerations
The IAB has studied the problem of "Unilateral Self Address Fixing", The IAB has studied the problem of "Unilateral Self Address Fixing",
which is the general process by which a client attempts to determine which is the general process by which a client attempts to determine
its address in another realm on the other side of a NAT through a its address in another realm on the other side of a NAT through a
skipping to change at page 21, line 29 skipping to change at page 22, line 39
with NATs for applications like VoIP. This work and STUN with NATs for applications like VoIP. This work and STUN
have pointed out more than anything else the brittleness NATs have pointed out more than anything else the brittleness NATs
introduce and the difficulty of addressing these issues. introduce and the difficulty of addressing these issues.
Arch-5: This work and the test results [17] provide a reference model Arch-5: This work and the test results [17] provide a reference model
for what any UNSAF proposal might encounter in deployed NATs. for what any UNSAF proposal might encounter in deployed NATs.
16. Acknowledgments 16. Acknowledgments
The editor would like to acknowledge Bryan Ford, Pyda Srisuresh and The editor would like to acknowledge Bryan Ford, Pyda Srisuresh and
Dan Kegel for the their multiple contributions on peer-to-peer Dan Kegel for the their multiple contributions on peer-to-peer
communications accross a NAT, from which a lot of the material in communications accross a NAT.
this specification is derived.
Dan Wing contributed substantial text on IP fragmentation and ICMP Dan Wing contributed substantial text on IP fragmentation and ICMP
behavior. behavior.
Thanks to Rohan Mahy, Jonathan Rosenberg, Mary Barnes, Melinda Shore, Thanks to Rohan Mahy, Jonathan Rosenberg, Mary Barnes, Melinda Shore,
Lyndsay Campbell, Geoff Huston, Jiri Kuthan, Harald Welte, Steve Lyndsay Campbell, Geoff Huston, Jiri Kuthan, Harald Welte, Steve
Casner, Robert Sanders and Spencer Dawkins for their important Casner, Robert Sanders, Spencer Dawkins, Saikat Guha, Christian
Huitema, Yutaka Takeda and Paul Hoffman for their important
contributions. contributions.
17. References 17. References
17.1 Normative References 17.1 Normative References
[1] Bradner, S., "Key words for use in RFCs to Indicate Requirement [1] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997. Levels", BCP 14, RFC 2119, March 1997.
[2] Daigle, L. and IAB, "IAB Considerations for UNilateral Self- [2] Daigle, L. and IAB, "IAB Considerations for UNilateral Self-
 End of changes. 

This html diff was produced by rfcdiff 1.24, available from http://www.levkowetz.com/ietf/tools/rfcdiff/