draft-ietf-behave-nat-udp-08.txt   rfc4787.txt 
BEHAVE F. Audet, Ed. Network Working Group F. Audet, Ed.
Internet-Draft Nortel Networks Request for Comments: 4787 Nortel Networks
Intended status: Standards Track C. Jennings BCP: 127 C. Jennings
Expires: April 13, 2007 Cisco Systems Category: Best Current Practice Cisco Systems
October 10, 2006 January 2007
NAT Behavioral Requirements for Unicast UDP
draft-ietf-behave-nat-udp-08
Status of this Memo
By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at Network Address Translation (NAT) Behavioral Requirements
http://www.ietf.org/ietf/1id-abstracts.txt. for Unicast UDP
The list of Internet-Draft Shadow Directories can be accessed at Status of This Memo
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on April 13, 2007. This document specifies an Internet Best Current Practices for the
Internet Community, and requests discussion and suggestions for
improvements. Distribution of this memo is unlimited.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2006). Copyright (C) The IETF Trust (2007).
Abstract Abstract
This document defines basic terminology for describing different This document defines basic terminology for describing different
types of NAT behavior when handling Unicast UDP and also defines a types of Network Address Translation (NAT) behavior when handling
set of requirements that would allow many applications, such as Unicast UDP and also defines a set of requirements that would allow
multimedia communications or on-line gaming, to work consistently. many applications, such as multimedia communications or online
Developing NATs that meet this set of requirements will greatly gaming, to work consistently. Developing NATs that meet this set of
increase the likelihood that these applications will function requirements will greatly increase the likelihood that these
properly. applications will function properly.
Table of Contents Table of Contents
1. Applicability Statement . . . . . . . . . . . . . . . . . . . 3 1. Applicability Statement . . . . . . . . . . . . . . . . . . . 3
2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
4. Network Address and Port Translation Behavior . . . . . . . . 5 4. Network Address and Port Translation Behavior . . . . . . . . 5
4.1. Address and Port Mapping . . . . . . . . . . . . . . . . . 5 4.1. Address and Port Mapping . . . . . . . . . . . . . . . . . 5
4.2. Port Assignment . . . . . . . . . . . . . . . . . . . . . 8 4.2. Port Assignment . . . . . . . . . . . . . . . . . . . . . 9
4.2.1. Port Assignment Behavior . . . . . . . . . . . . . . . 8 4.2.1. Port Assignment Behavior . . . . . . . . . . . . . . . 9
4.2.2. Port Parity . . . . . . . . . . . . . . . . . . . . . 10 4.2.2. Port Parity . . . . . . . . . . . . . . . . . . . . . 11
4.2.3. Port Contiguity . . . . . . . . . . . . . . . . . . . 11 4.2.3. Port Contiguity . . . . . . . . . . . . . . . . . . . 11
4.3. Mapping Refresh . . . . . . . . . . . . . . . . . . . . . 11 4.3. Mapping Refresh . . . . . . . . . . . . . . . . . . . . . 12
4.4. Conflicting Internal and External IP Address Spaces . . . 13 4.4. Conflicting Internal and External IP Address Spaces . . . 13
5. Filtering Behavior . . . . . . . . . . . . . . . . . . . . . . 14 5. Filtering Behavior . . . . . . . . . . . . . . . . . . . . . . 15
6. Hairpinning Behavior . . . . . . . . . . . . . . . . . . . . . 16 6. Hairpinning Behavior . . . . . . . . . . . . . . . . . . . . . 16
7. Application Level Gateways . . . . . . . . . . . . . . . . . . 17 7. Application Level Gateways . . . . . . . . . . . . . . . . . . 17
8. Deterministic Properties . . . . . . . . . . . . . . . . . . . 17 8. Deterministic Properties . . . . . . . . . . . . . . . . . . . 18
9. ICMP Destination Unreachable Behavior . . . . . . . . . . . . 19 9. ICMP Destination Unreachable Behavior . . . . . . . . . . . . 19
10. Fragmentation of Outgoing Packets . . . . . . . . . . . . . . 19 10. Fragmentation of Outgoing Packets . . . . . . . . . . . . . . 20
11. Receiving Fragmented Packets . . . . . . . . . . . . . . . . . 20 11. Receiving Fragmented Packets . . . . . . . . . . . . . . . . . 20
12. Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 20 12. Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 21
13. Security Considerations . . . . . . . . . . . . . . . . . . . 22 13. Security Considerations . . . . . . . . . . . . . . . . . . . 24
14. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 24 14. IAB Considerations . . . . . . . . . . . . . . . . . . . . . . 25
15. IAB Considerations . . . . . . . . . . . . . . . . . . . . . . 24 15. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 26
16. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 25 16. References . . . . . . . . . . . . . . . . . . . . . . . . . . 26
17. References . . . . . . . . . . . . . . . . . . . . . . . . . . 25 16.1. Normative References . . . . . . . . . . . . . . . . . . . 26
17.1. Normative References . . . . . . . . . . . . . . . . . . . 25 16.2. Informative References . . . . . . . . . . . . . . . . . . 26
17.2. Informational References . . . . . . . . . . . . . . . . . 25
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 27
Intellectual Property and Copyright Statements . . . . . . . . . . 29
1. Applicability Statement 1. Applicability Statement
The purpose of this specification is to define a set of requirements The purpose of this specification is to define a set of requirements
for NATs that would allow many applications, such as multimedia for NATs that would allow many applications, such as multimedia
communications or on-line gaming, to work consistently. Developing communications or online gaming, to work consistently. Developing
NATs that meet this set of requirements will greatly increase the NATs that meet this set of requirements will greatly increase the
likelihood that these applications will function properly. likelihood that these applications will function properly.
The requirements of this specification apply to Traditional NATs as The requirements of this specification apply to Traditional NATs as
described in [RFC2663]. described in [RFC2663].
This document is meant to cover NATs of any size, from small This document is meant to cover NATs of any size, from small
residential NATs to large Enterprise NATs. However, it should be residential NATs to large Enterprise NATs. However, it should be
understood that Enterprise NATs normally provide much more than just understood that Enterprise NATs normally provide much more than just
NAT capabilities: for example, they typically provide firewall NAT capabilities; for example, they typically provide firewall
functionalities. A comprehensive description of firewall behaviors functionalities. A comprehensive description of firewall behaviors
and associated requirements is specifically out-of-scope for this and associated requirements is specifically out-of-scope for this
specification. However, this specification does cover basic firewall specification. However, this specification does cover basic firewall
aspects present in NATs (see Section 5). aspects present in NATs (see Section 5).
Approaches using directly signaled control of middle boxes are out of Approaches using directly signaled control of middle boxes are out of
scope. scope.
UDP Relays (e.g., TURN [I-D.ietf-behave-turn]) are out-of-scope. UDP Relays (e.g., Traversal Using Relay NAT [TURN]) are out of scope.
Application aspects are out-of-scope, as the focus here is strictly Application aspects are out of scope, as the focus here is strictly
on the NAT itself. on the NAT itself.
This document only covers aspects of NAT traversal related to Unicast This document only covers aspects of NAT traversal related to Unicast
UDP [RFC0768] over IP [RFC0791] and their dependencies on other UDP [RFC0768] over IP [RFC0791] and their dependencies on other
protocols. protocols.
2. Introduction 2. Introduction
Network Address Translators (NATs) are well known to cause very Network Address Translators (NATs) are well known to cause very
significant problems with applications that carry IP addresses in the significant problems with applications that carry IP addresses in the
payload (see [RFC3027]). Applications that suffer from this problem payload (see [RFC3027]). Applications that suffer from this problem
include Voice Over IP and Multimedia Over IP (e.g., SIP [RFC3261] and include Voice Over IP and Multimedia Over IP (e.g., SIP [RFC3261] and
H.323 [ITU.H323]), as well as online gaming. H.323 [ITU.H323]), as well as online gaming.
Many techniques are used to attempt to make realtime multimedia Many techniques are used to attempt to make realtime multimedia
applications, online games, and other applications work across NATs. applications, online games, and other applications work across NATs.
Application Level Gateways [RFC2663] are one such mechanism. STUN Application Level Gateways [RFC2663] are one such mechanism. STUN
[I-D.ietf-behave-rfc3489bis] describes a UNilateral Self-Address [RFC3489bis] describes a UNilateral Self-Address Fixing (UNSAF)
Fixing (UNSAF) mechanism [RFC3424]. Teredo [RFC4380] describes an mechanism [RFC3424]. Teredo [RFC4380] describes an UNSAF mechanism
UNSAF mechanism consisting of tunnelling IPv6 [RFC2460] over UDP/ consisting of tunnelling IPv6 [RFC2460] over UDP/IPv4. UDP Relays
IPv4. UDP Relays have also been used to enable applications across have also been used to enable applications across NATs, but these are
NATs, but these are generally seen as a solution of last resort. ICE generally seen as a solution of last resort. Interactive
[I-D.ietf-mmusic-ice] describes a methodology for using many of these Connectivity Establishment [ICE] describes a methodology for using
techniques and avoiding a UDP relay unless the type of NAT is such many of these techniques and avoiding a UDP relay, unless the type of
that it forces the use of such a UDP relay. This specification NAT is such that it forces the use of such a UDP relay. This
defines requirements for improving NATs. Meeting these requirements specification defines requirements for improving NATs. Meeting these
ensures that applications will not be forced to use UDP relay. requirements ensures that applications will not be forced to use UDP
relay.
As pointed out in UNSAF [RFC3424], "From observations of deployed As pointed out in UNSAF [RFC3424], "From observations of deployed
networks, it is clear that different NAT box implementations vary networks, it is clear that different NAT box implementations vary
widely in terms of how they handle different traffic and addressing widely in terms of how they handle different traffic and addressing
cases." This wide degree of variability is one factor in the overall cases". This wide degree of variability is one factor in the overall
brittleness introduced by NATs and makes it extremely difficult to brittleness introduced by NATs and makes it extremely difficult to
predict how any given protocol will behave on a network traversing predict how any given protocol will behave on a network traversing
NAT. Discussions with many of the major NAT vendors have made it NAT. Discussions with many of the major NAT vendors have made it
clear that they would prefer to deploy NATs that were deterministic clear that they would prefer to deploy NATs that were deterministic
and caused the least harm to applications while still meeting the and caused the least harm to applications while still meeting the
requirements that caused their customers to deploy NATs in the first requirements that caused their customers to deploy NATs in the first
place. The problem NAT vendors face is that they are not sure how place. The problem NAT vendors face is that they are not sure how
best to do that or how to document how their NATs behave. best to do that or how to document their NATs' behavior.
The goals of this document are to define a set of common terminology The goals of this document are to define a set of common terminology
for describing the behavior of NATs and to produce a set of for describing the behavior of NATs and to produce a set of
requirements on a specific set of behaviors for NATs. requirements on a specific set of behaviors for NATs.
This document forms a common set of requirements that are simple and This document forms a common set of requirements that are simple and
useful for voice, video, and games, which can be implemented by NAT useful for voice, video, and games, which can be implemented by NAT
vendors. This document will simplify the analysis of protocols for vendors. This document will simplify the analysis of protocols for
deciding whether or not they work in this environment and will allow deciding whether or not they work in this environment and will allow
providers of services that have NAT traversal issues to make providers of services that have NAT traversal issues to make
skipping to change at page 4, line 46 skipping to change at page 4, line 46
3. Terminology 3. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
Readers are urged to refer to [RFC2663] for information on NAT Readers are urged to refer to [RFC2663] for information on NAT
taxonomy and terminology. Traditional NAT is the most common type of taxonomy and terminology. Traditional NAT is the most common type of
NAT device deployed. Readers may refer to [RFC3022] for detailed NAT device deployed. Readers may refer to [RFC3022] for detailed
information on traditional NAT. Traditional NAT has two main information on traditional NAT. Traditional NAT has two main
varieties - Basic NAT and Network Address/Port Translator (NAPT). varieties -- Basic NAT and Network Address/Port Translator (NAPT).
NAPT is by far the most commonly deployed NAT device. NAPT allows NAPT is by far the most commonly deployed NAT device. NAPT allows
multiple internal hosts to share a single public IP address multiple internal hosts to share a single public IP address
simultaneously. When an internal host opens an outgoing TCP or UDP simultaneously. When an internal host opens an outgoing TCP or UDP
session through a NAPT, the NAPT assigns the session a public IP session through a NAPT, the NAPT assigns the session a public IP
address and port number, so that subsequent response packets from the address and port number, so that subsequent response packets from the
external endpoint can be received by the NAPT, translated, and external endpoint can be received by the NAPT, translated, and
forwarded to the internal host. The effect is that the NAPT forwarded to the internal host. The effect is that the NAPT
establishes a NAT session to translate the (private IP address, establishes a NAT session to translate the (private IP address,
private port number) tuple to (public IP address, public port number) private port number) tuple to a (public IP address, public port
tuple and vice versa for the duration of the session. An issue of number) tuple, and vice versa, for the duration of the session. An
relevance to peer-to-peer applications is how the NAT behaves when an issue of relevance to peer-to-peer applications is how the NAT
internal host initiates multiple simultaneous sessions from a single behaves when an internal host initiates multiple simultaneous
(private IP, private port) endpoint to multiple distinct endpoints on sessions from a single (private IP, private port) endpoint to
the external network. In this specification, the term "NAT" refers multiple distinct endpoints on the external network. In this
to both "Basic NAT" and "Network Address/Port Translator (NAPT)". specification, the term "NAT" refers to both "Basic NAT" and "Network
Address/Port Translator (NAPT)".
This document uses the term "session" as defined in RFC 2663: "TCP/ This document uses the term "session" as defined in RFC 2663: "TCP/
UDP sessions are uniquely identified by the tuple of (source IP UDP sessions are uniquely identified by the tuple of (source IP
address, source TCP/UDP ports, target IP address, target TCP/UDP address, source TCP/UDP ports, target IP address, target TCP/UDP
Port)." Port)".
This document uses the term "address and port mapping" as the This document uses the term "address and port mapping" as the
translation between an external address and port and an internal translation between an external address and port and an internal
address and port. Note that this is not the same as an "address address and port. Note that this is not the same as an "address
binding" as defined in RFC 2663. binding" as defined in RFC 2663.
This document uses IANA terminology for port ranges, i.e., "Well This document uses IANA terminology for port ranges, i.e., "Well
Known Ports" is 0-1023, "Registered" is 1024-49151, and "Dynamic Known Ports" is 0-1023, "Registered" is 1024-49151, and "Dynamic
and/or Private" is 49152-65535, as defined in and/or Private" is 49152-65535, as defined in
http://www.iana.org/assignments/port-numbers. http://www.iana.org/assignments/port-numbers.
STUN [RFC3489] used the terms "Full Cone", "Restricted Cone", "Port STUN [RFC3489] used the terms "Full Cone", "Restricted Cone", "Port
Restricted Cone" and "Symmetric" to refer to different variations of Restricted Cone", and "Symmetric" to refer to different variations of
NATs applicable to UDP only. Unfortunately, this terminology has NATs applicable to UDP only. Unfortunately, this terminology has
been the source of much confusion as it has proven inadequate at been the source of much confusion, as it has proven inadequate at
describing real-life NAT behavior. This specification therefore describing real-life NAT behavior. This specification therefore
refers to specific individual NAT behaviors instead of using the refers to specific individual NAT behaviors instead of using the
Cone/Symmetric terminology. Cone/Symmetric terminology.
4. Network Address and Port Translation Behavior 4. Network Address and Port Translation Behavior
This section describes the various NAT behaviors applicable to NATs. This section describes the various NAT behaviors applicable to NATs.
4.1. Address and Port Mapping 4.1. Address and Port Mapping
skipping to change at page 6, line 10 skipping to change at page 6, line 9
the NAT assigns the session an external IP address and port number so the NAT assigns the session an external IP address and port number so
that subsequent response packets from the external endpoint can be that subsequent response packets from the external endpoint can be
received by the NAT, translated, and forwarded to the internal received by the NAT, translated, and forwarded to the internal
endpoint. This is a mapping between an internal IP address and port endpoint. This is a mapping between an internal IP address and port
IP:port and external IP:port tuple. It establishes the translation IP:port and external IP:port tuple. It establishes the translation
that will be performed by the NAT for the duration of the session. that will be performed by the NAT for the duration of the session.
For many applications, it is important to distinguish the behavior of For many applications, it is important to distinguish the behavior of
the NAT when there are multiple simultaneous sessions established to the NAT when there are multiple simultaneous sessions established to
different external endpoints. different external endpoints.
The key behavior to describe is the criteria for re-use of a mapping The key behavior to describe is the criteria for reuse of a mapping
for new sessions to external endpoints, after establishing a first for new sessions to external endpoints, after establishing a first
mapping between an internal X:x address and port and an external mapping between an internal X:x address and port and an external
Y1:y1 address tuple. Let's assume that the internal IP address and Y1:y1 address tuple. Let's assume that the internal IP address and
port X:x is mapped to X1':x1' for this first session. The endpoint port X:x are mapped to X1':x1' for this first session. The endpoint
then sends from X:x to an external address Y2:y2 and gets a mapping then sends from X:x to an external address Y2:y2 and gets a mapping
of X2':x2' on the NAT. The relationship between X1':x1' and X2':x2' of X2':x2' on the NAT. The relationship between X1':x1' and X2':x2'
for various combinations of the relationship between Y1:y1 and Y2:y2 for various combinations of the relationship between Y1:y1 and Y2:y2
is critical for describing the NAT behavior. This arrangement is is critical for describing the NAT behavior. This arrangement is
illustrated in the following diagram: illustrated in the following diagram:
E E
+------+ +------+ x +------+ +------+ x
| Y1 | | Y2 | t | Y1 | | Y2 | t
+--+---+ +---+--+ e +--+---+ +---+--+ e
skipping to change at page 6, line 44 skipping to change at page 6, line 43
++---++ e ++---++ e
| X | r | X | r
+-----+ n +-----+ n
a a
l l
Address and Port Mapping Address and Port Mapping
The following address and port mapping behavior are defined: The following address and port mapping behavior are defined:
Endpoint Independent Mapping: Endpoint-Independent Mapping:
The NAT reuses the port mapping for subsequent packets sent The NAT reuses the port mapping for subsequent packets sent
from the same internal IP address and port (X:x) to any from the same internal IP address and port (X:x) to any
external IP address and port. Specifically, X1':x1' equals external IP address and port. Specifically, X1':x1' equals
X2':x2' for all values of Y2:y2. X2':x2' for all values of Y2:y2.
Address Dependent Mapping: Address-Dependent Mapping:
The NAT reuses the port mapping for subsequent packets sent The NAT reuses the port mapping for subsequent packets sent
from the same internal IP address and port (X:x) to the same from the same internal IP address and port (X:x) to the same
external IP address, regardless of the external port. external IP address, regardless of the external port.
Specifically, X1':x1' equals X2':x2' if, and only if, Y2 equals Specifically, X1':x1' equals X2':x2' if and only if, Y2 equals
Y1. Y1.
Address and Port Dependent Mapping: Address and Port-Dependent Mapping:
The NAT reuses the port mapping for subsequent packets sent The NAT reuses the port mapping for subsequent packets sent
from the same internal IP address and port (X:x) to the same from the same internal IP address and port (X:x) to the same
external IP address and port while the mapping is still active. external IP address and port while the mapping is still active.
Specifically, X1':x1' equals X2':x2' if, and only if, Y2:y2 Specifically, X1':x1' equals X2':x2' if and only if, Y2:y2
equals Y1:y1. equals Y1:y1.
It is important to note that these three possible choices make no It is important to note that these three possible choices make no
difference to the security properties of the NAT. The security difference to the security properties of the NAT. The security
properties are fully determined by which packets the NAT allows in properties are fully determined by which packets the NAT allows in
and which it does not. This is determined by the filtering behavior and which it does not. This is determined by the filtering behavior
in the filtering portions of the NAT. in the filtering portions of the NAT.
REQ-1: A NAT MUST have an "Endpoint Independent Mapping" behavior. REQ-1: A NAT MUST have an "Endpoint-Independent Mapping" behavior.
Justification: In order for UNSAF methods to work, REQ-1 needs to be Justification: In order for UNSAF methods to work, REQ-1 needs to be
met. Failure to meet REQ-1 will force the use of a UDP relay met. Failure to meet REQ-1 will force the use of a UDP relay,
which is very often impractical. which is very often impractical.
Some NATs are capable of assigning IP addresses from a pool of IP Some NATs are capable of assigning IP addresses from a pool of IP
addresses on the external side of the NAT, as opposed to just a addresses on the external side of the NAT, as opposed to just a
single IP address. This is especially common with larger NATs. Some single IP address. This is especially common with larger NATs. Some
NATs use the external IP address mapping in an arbitrary fashion NATs use the external IP address mapping in an arbitrary fashion
(i.e. randomly): one internal IP address could have multiple external (i.e., randomly): one internal IP address could have multiple
IP address mappings active at the same time for different sessions. external IP address mappings active at the same time for different
These NATs have an "IP address pooling" behavior of "Arbitrary". sessions. These NATs have an "IP address pooling" behavior of
Some large Enterprise NATs use an IP address pooling behavior of "Arbitrary". Some large Enterprise NATs use an IP address pooling
"Arbitrary" as a means of hiding the IP address assigned to specific behavior of "Arbitrary" as a means of hiding the IP address assigned
endpoints by making their assignment less predictable. Other NATs to specific endpoints by making their assignment less predictable.
use the same external IP address mapping for all sessions associated Other NATs use the same external IP address mapping for all sessions
with the same internal IP address. These NATs have an "IP address associated with the same internal IP address. These NATs have an "IP
pooling" behavior of "Paired." NATs that use an "IP address pooling" address pooling" behavior of "Paired". NATs that use an "IP address
behavior of "arbitrary" can cause issues for applications that use pooling" behavior of "Arbitrary" can cause issues for applications
multiple ports from the same endpoint but do not negotiate IP that use multiple ports from the same endpoint, but that do not
addresses individually (e.g., some applications using RTP and RTCP). negotiate IP addresses individually (e.g., some applications using
RTP and RTCP).
REQ-2: It is RECOMMENDED that a NAT have an "IP address pooling" REQ-2: It is RECOMMENDED that a NAT have an "IP address pooling"
behavior of "Paired". Note that this requirement is not behavior of "Paired". Note that this requirement is not
applicable to NATs that do not support IP address pooling. applicable to NATs that do not support IP address pooling.
Justification: This will allow applications that use multiple ports Justification: This will allow applications that use multiple ports
originating from the same internal IP address to also have the originating from the same internal IP address to also have the
same external IP address. This is to avoid breaking peer-to-peer same external IP address. This is to avoid breaking peer-to-peer
applications that are not capable of negotiating the IP address applications that are not capable of negotiating the IP address
for RTP and the IP address for RTCP separately. As such it is for RTP and the IP address for RTCP separately. As such it is
skipping to change at page 8, line 21 skipping to change at page 8, line 25
applications become NAT-friendlier with time. The main reason why applications become NAT-friendlier with time. The main reason why
this requirement is here is that in a peer-to-peer application, this requirement is here is that in a peer-to-peer application,
you are subject to the other peer's mistake. In particular, in you are subject to the other peer's mistake. In particular, in
the context of SIP, if my application supports the extensions the context of SIP, if my application supports the extensions
defined in [RFC3605] for indicating RTP and RTCP addresses and defined in [RFC3605] for indicating RTP and RTCP addresses and
ports separately, but the other peer does not, there may still be ports separately, but the other peer does not, there may still be
breakage in the form of the stream losing RTCP packets. This breakage in the form of the stream losing RTCP packets. This
requirement will avoid the loss of RTP in this context, although requirement will avoid the loss of RTP in this context, although
the loss of RTCP may be inevitable in this particular example. It the loss of RTCP may be inevitable in this particular example. It
is also worth noting that RFC 3605 is unfortunately not a is also worth noting that RFC 3605 is unfortunately not a
mandatory part of SIP (RFC 3261). This requirement will therefore mandatory part of SIP [RFC3261]. Therefore, this requirement will
address a particularly nasty problem that will prevail for a address a particularly nasty problem that will prevail for a
significant period of time. significant period of time.
4.2. Port Assignment 4.2. Port Assignment
4.2.1. Port Assignment Behavior 4.2.1. Port Assignment Behavior
This section uses the following diagram for reference. This section uses the following diagram for reference.
E E
skipping to change at page 8, line 44 skipping to change at page 9, line 24
+---+---+ +---+---+ e +---+---+ +---+---+ e
| Y1:y1 Y2:y2 | r | Y1:y1 Y2:y2 | r
+---------+ +---------+ n +---------+ +---------+ n
| | a | | a
X1':x1' | | X2':x2' l X1':x1' | | X2':x2' l
+--+---+--+ +--+---+--+
...........| NAT |............... ...........| NAT |...............
+--+---+--+ I +--+---+--+ I
| | n | | n
+---------+ +---------+ t +---------+ +---------+ t
| X1:x1 X2':x2 | e | X1:x1 X2:x2 | e
+---+---+ +---+---+ r +---+---+ +---+---+ r
| X1 | | X2 | n | X1 | | X2 | n
+-------+ +-------+ a +-------+ +-------+ a
l l
Port Assignment Port Assignment
Some NATs attempt to preserve the port number used internally when Some NATs attempt to preserve the port number used internally when
assigning a mapping to an external IP address and port (e.g., assigning a mapping to an external IP address and port (e.g., x1=x1',
x=x1=x2=x1'=x2', or more succinctly, a mapping of X:x to X':x). A x2=x2'). This port assignment behavior is referred to as "port
basic NAT, for example, will preserve the same port and will assign a preservation". In case of port collision, these NATs attempt a
different IP address from a pool of external IP addresses in case of variety of techniques for coping. For example, some NATs will
port collision (e.g. X1:x to X1':x and X2:x to X2':x). This is only overridden the previous mapping to preserve the same port. Other
possible as long as the NAT has enough external IP addresses. If the NATs will assign a different IP address from a pool of external IP
port x is already in use on all available external IP addresses, then addresses; this is only possible as long as the NAT has enough
the NAT needs to switch from Basic NAT to Network Address and Port external IP addresses; if the port is already in use on all available
Translator (NAPT) mode (i.e., X'=X1'=X2' and x=x1=x2 but x1'!=x2', or external IP addresses, then these NATs will pick a different port
a mapping of X1:x to X':x1' and X2:x to X':x2'). This port (i.e., they don't do port preservation anymore).
assignment behavior is referred to as "port preservation". It does
not guarantee that the external port x' will always be the same as
the internal port x but only that the NAT will preserve the port if
possible.
A NAT that does not attempt to make the external port numbers match
the internal port numbers in any case (i.e., X1:x to X':x1', X2:x to
X':x2') is referred to as "No port preservation".
Some NATs use "Port overloading", i.e. they always use port Some NATs use "Port overloading", i.e., they always use port
preservation even in the case of collision (i.e., X'=X1'=X2' and preservation even in the case of collision (i.e., X1'=X2' and
x=x1=x2=x1'=x2', or a mapping of X1:x to X':x, and X2:x to X':x). x1=x2=x1'=x2'). Most applications will fail if the NAT uses "Port
These NATs rely on the source of the response from the external overloading".
endpoint (Y1:y1, Y2:y2) to forward a packet to the proper internal
endpoint (X1 or X2). Port overloading fails if the two internal
endpoints are establishing sessions to the same external destination.
Most applications fail in some cases with "Port overloading". It is A NAT that does not attempt to make the external port numbers match
clear that "Port overloading" behavior will result in many problems. the internal port numbers in any case is referred to as "no port
For example it will fail if two internal endpoints try to reach the preservation".
same external destination, e.g., a SIP proxy server used by both
endpoints.
When NATs do allocate a new source port, there is the issue of which When NATs do allocate a new source port, there is the issue of which
IANA-defined range of port to choose. The ranges are "well-known" IANA-defined range of port to choose. The ranges are "well-known"
from 0 to 1023, "registered" from 1024 to 49151, and "dynamic/ from 0 to 1023, "registered" from 1024 to 49151, and "dynamic/
private" from 49152 through 65535. For most protocols, these are private" from 49152 through 65535. For most protocols, these are
destination ports and not source ports, so mapping a source port to a destination ports and not source ports, so mapping a source port to a
source port that is already registered is unlikely to have any bad source port that is already registered is unlikely to have any bad
effects. Some NATs may choose to use only the ports in the dynamic effects. Some NATs may choose to use only the ports in the dynamic
range; the only down side of this practice is that it limits the range; the only down side of this practice is that it limits the
number of ports available. Other NAT devices may use everything but number of ports available. Other NAT devices may use everything but
the well-known range and may prefer to use the dynamic range first or the well-known range and may prefer to use the dynamic range first,
possibly avoid the actual registered ports in the registered range. or possibly avoid the actual registered ports in the registered
Other NATs preserve the port range if it is in the well-known range. range. Other NATs preserve the port range if it is in the well-known
[RFC0768] specifies that the source port is set to zero if no reply range. [RFC0768] specifies that the source port is set to zero if no
packet are expected. In this case it does not matter what the NAT reply packets are expected. In this case, it does not matter what
maps it to as the source port will not be used. However, many common the NAT maps it to, as the source port will not be used. However,
OS APIs do not allow a user to send from port zero, applications do many common OS APIs do not allow a user to send from port zero,
not use port zero, and the behavior of various existing NATs with applications do not use port zero, and the behavior of various
regards to a packet with a source of port zero is unknown. This existing NATs with regards to a packet with a source of port zero is
document does not specify any normative behavior for a NAT when unknown. This document does not specify any normative behavior for a
handling a packet with a source port of zero which means that NAT when handling a packet with a source port of zero which means
applications can not count on any sort of deterministic behavior for that applications cannot count on any sort of deterministic behavior
these packets. for these packets.
REQ-3: A NAT MUST NOT have a "Port assignment" behavior of "Port REQ-3: A NAT MUST NOT have a "Port assignment" behavior of "Port
overloading". overloading".
a) If the host's source port was in the range 0-1023, it is a) If the host's source port was in the range 0-1023, it is
RECOMMENDED the NAT's source port be in the same range. If the RECOMMENDED the NAT's source port be in the same range. If the
host's source port was in the range 1024-65535, it is host's source port was in the range 1024-65535, it is
RECOMMENDED that the NAT's source port be in that range. RECOMMENDED that the NAT's source port be in that range.
Justification: This requirement must be met in order to enable two Justification: This requirement must be met in order to enable two
applications on the internal side of the NAT both to use the same applications on the internal side of the NAT both to use the same
port to try to communicate with the same destination. NATs that port to try to communicate with the same destination. NATs that
implement port preservation have to deal with conflicts on ports, implement port preservation have to deal with conflicts on ports,
and the multiple code paths this introduces often result in and the multiple code paths this introduces often result in
skipping to change at page 10, line 26 skipping to change at page 10, line 43
host's source port was in the range 1024-65535, it is host's source port was in the range 1024-65535, it is
RECOMMENDED that the NAT's source port be in that range. RECOMMENDED that the NAT's source port be in that range.
Justification: This requirement must be met in order to enable two Justification: This requirement must be met in order to enable two
applications on the internal side of the NAT both to use the same applications on the internal side of the NAT both to use the same
port to try to communicate with the same destination. NATs that port to try to communicate with the same destination. NATs that
implement port preservation have to deal with conflicts on ports, implement port preservation have to deal with conflicts on ports,
and the multiple code paths this introduces often result in and the multiple code paths this introduces often result in
nondeterministic behavior. However, it should be understood that nondeterministic behavior. However, it should be understood that
when a port is randomly assigned, it may just randomly happen to when a port is randomly assigned, it may just randomly happen to
be assigned the same port. Applications must therefore be able to be assigned the same port. Applications must, therefore, be able
deal with both port preservation and no port preservation. to deal with both port preservation and no port preservation.
a) Certain applications expect the source UDP port to be in the a) Certain applications expect the source UDP port to be in the
well-known range. See the discussion of Network File System well-known range. See the discussion of Network File System
port expectations in [RFC2623] for an example. port expectations in [RFC2623] for an example.
4.2.2. Port Parity 4.2.2. Port Parity
Some NATs preserve the parity of the UDP port, i.e., an even port Some NATs preserve the parity of the UDP port, i.e., an even port
will be mapped to an even port, and an odd port will be mapped to an will be mapped to an even port, and an odd port will be mapped to an
odd port. This behavior respects the [RFC3550] rule that RTP use odd port. This behavior respects the [RFC3550] rule that RTP use
even ports, and RTCP use odd ports. RFC 3550 allows any port numbers even ports, and RTCP use odd ports. RFC 3550 allows any port numbers
to be used for RTP and RTCP if the two numbers are specified to be used for RTP and RTCP if the two numbers are specified
separately, for example using [RFC3605]. However, some separately; for example, using [RFC3605]. However, some
implementations do not include RFC 3605 and do not recognize when the implementations do not include RFC 3605, and do not recognize when
peer has specified the RTCP port separately using RFC 3605. If such the peer has specified the RTCP port separately using RFC 3605. If
an implementation receives an odd RTP port number from the peer such an implementation receives an odd RTP port number from the peer
(perhaps after having been translated by a NAT), and then follows the (perhaps after having been translated by a NAT), and then follows the
RFC 3550 rule to change the RTP port to the next lower even number, RFC 3550 rule to change the RTP port to the next lower even number,
this would obviously result in the loss of RTP. NAT-friendly this would obviously result in the loss of RTP. NAT-friendly
application aspects are outside the scope of this document. It is application aspects are outside the scope of this document. It is
expected that this issue will fade away with time, as implementations expected that this issue will fade away with time, as implementations
improve. Preserving the port parity allows for supporting improve. Preserving the port parity allows for supporting
communication with peers that do not support explicit specification communication with peers that do not support explicit specification
of both RTP and RTCP port numbers. of both RTP and RTCP port numbers.
REQ-4: It is RECOMMENDED that a NAT have a "Port parity REQ-4: It is RECOMMENDED that a NAT have a "Port parity
preservation" behavior of "Yes". preservation" behavior of "Yes".
Justification: This is to avoid breaking peer-to-peer applications Justification: This is to avoid breaking peer-to-peer applications
which do not explicitly and separately specify RTP and RTCP port that do not explicitly and separately specify RTP and RTCP port
numbers and which follow the RFC 3550 rule to decrement an odd RTP numbers and that follow the RFC 3550 rule to decrement an odd RTP
port to make it even. The same considerations as per the IP port to make it even. The same considerations apply, as per the
address pooling requirement apply. IP address pooling requirement.
4.2.3. Port Contiguity 4.2.3. Port Contiguity
Some NATs attempt to preserve the port contiguity rule of RTCP=RTP+1. Some NATs attempt to preserve the port contiguity rule of RTCP=RTP+1.
These NATs do things like sequential assignment or port reservation. These NATs do things like sequential assignment or port reservation.
Sequential port assignment assumes that the application will open a Sequential port assignment assumes that the application will open a
mapping for RTP first and then open a mapping for RTCP. It is not mapping for RTP first and then open a mapping for RTCP. It is not
practical to enforce this requirement on all applications. practical to enforce this requirement on all applications.
Furthermore, there is a problem with glare if many applications (or Furthermore, there is a problem with glare if many applications (or
endpoints) are trying to open mapping simultaneously. Port endpoints) are trying to open mappings simultaneously. Port
preservation is also problematic since it is wasteful, especially preservation is also problematic since it is wasteful, especially
considering that a NAT cannot reliably distinguish between RTP over considering that a NAT cannot reliably distinguish between RTP over
UDP and other UDP packets where there is no contiguity rule. For UDP and other UDP packets where there is no contiguity rule. For
those reasons, it would be too complex to attempt to preserve the those reasons, it would be too complex to attempt to preserve the
contiguity rule by suggesting specific NAT behavior, and it would contiguity rule by suggesting specific NAT behavior, and it would
certainly break the deterministic behavior rule. certainly break the deterministic behavior rule.
In order to support both RTP and RTCP, it will therefore be necessary In order to support both RTP and RTCP, it will therefore be necessary
that applications follow rules to negotiate RTP and RTCP separately, that applications follow rules to negotiate RTP and RTCP separately,
and account for the very real possibility that the RTCP=RTP+1 rule and account for the very real possibility that the RTCP=RTP+1 rule
will be broken. As this is an application requirement, it is outside will be broken. As this is an application requirement, it is outside
of the scope of this document. the scope of this document.
4.3. Mapping Refresh 4.3. Mapping Refresh
NAT mapping timeout implementations vary but include the timer's NAT mapping timeout implementations vary, but include the timer's
value and the way the mapping timer is refreshed to keep the mapping value and the way the mapping timer is refreshed to keep the mapping
alive. alive.
The mapping timer is defined as the time a mapping will stay active The mapping timer is defined as the time a mapping will stay active
without packets traversing the NAT. There is great variation in the without packets traversing the NAT. There is great variation in the
values used by different NATs. values used by different NATs.
REQ-5: A NAT UDP mapping timer MUST NOT expire in less than 2 REQ-5: A NAT UDP mapping timer MUST NOT expire in less than two
minutes, unless REQ-5a applies. minutes, unless REQ-5a applies.
a) For specific destination ports in the well-known port range a) For specific destination ports in the well-known port range
(ports 0-1023), a NAT MAY have shorter UDP mapping timers that (ports 0-1023), a NAT MAY have shorter UDP mapping timers that
are specific to the IANA-registered application running over are specific to the IANA-registered application running over
that specific destination port. that specific destination port.
b) The value of the NAT UDP mapping timer MAY be configurable. b) The value of the NAT UDP mapping timer MAY be configurable.
c) A default value of 5 minutes or more for the NAT UDP mapping
c) A default value of five minutes or more for the NAT UDP mapping
timer is RECOMMENDED. timer is RECOMMENDED.
Justification: This requirement is to ensure that the timeout is Justification: This requirement is to ensure that the timeout is
long enough to avoid too frequent timer refresh packets. long enough to avoid too-frequent timer refresh packets.
a) Some UDP protocols using UDP use very short-lived connections. a) Some UDP protocols using UDP use very short-lived connections.
There can be very many such connections; keeping them all in a There can be very many such connections; keeping them all in a
connections table could cause considerable load on the NAT. connections table could cause considerable load on the NAT.
Having shorter timers for these specific applications is Having shorter timers for these specific applications is,
therefore an optimization technique. It is important that the therefore, an optimization technique. It is important that the
shorter timers applied to specific protocols be used sparingly, shorter timers applied to specific protocols be used sparingly,
and only for protocols using well-known destination port that and only for protocols using well-known destination ports that
are known to have a shorter timer, and that are known not to be are known to have a shorter timer, and that are known not to be
used by any applications for other purposes. used by any applications for other purposes.
b) Configuration is desirable for adapting to specific networks b) Configuration is desirable for adapting to specific networks
and troubleshooting. and troubleshooting.
c) This default is to avoid too frequent timer refresh packets.
c) This default is to avoid too-frequent timer refresh packets.
Some NATs keep the mapping active (i.e., refresh the timer value) Some NATs keep the mapping active (i.e., refresh the timer value)
when a packet goes from the internal side of the NAT to the external when a packet goes from the internal side of the NAT to the external
side of the NAT. This is referred to as having a NAT Outbound side of the NAT. This is referred to as having a NAT Outbound
refresh behavior of "True". refresh behavior of "True".
Some NATs keep the mapping active when a packet goes from the Some NATs keep the mapping active when a packet goes from the
external side of the NAT to the internal side of the NAT. This is external side of the NAT to the internal side of the NAT. This is
referred to as having a NAT Inbound Refresh Behavior of "True". referred to as having a NAT Inbound Refresh Behavior of "True".
Some NATs keep the mapping active on both, in which case both Some NATs keep the mapping active on both, in which case, both
properties are "True". properties are "True".
REQ-6: The NAT mapping Refresh Direction MUST have a "NAT Outbound REQ-6: The NAT mapping Refresh Direction MUST have a "NAT Outbound
refresh behavior" of "True". refresh behavior" of "True".
a) The NAT mapping Refresh Direction MAY have a "NAT Inbound a) The NAT mapping Refresh Direction MAY have a "NAT Inbound
refresh behavior" of "True". refresh behavior" of "True".
Justification: Outbound refresh is necessary for allowing the client Justification: Outbound refresh is necessary for allowing the client
to keep the mapping alive. to keep the mapping alive.
a) Inbound refresh may be useful for applications with no outgoing a) Inbound refresh may be useful for applications with no outgoing
UDP traffic. However, allowing inbound refresh may allow an UDP traffic. However, allowing inbound refresh may allow an
external attacker or misbehaving application to keep a mapping external attacker or misbehaving application to keep a mapping
alive indefinitely. This may be a security risk. Also, if the alive indefinitely. This may be a security risk. Also, if the
process is repeated with different ports, over time it could process is repeated with different ports, over time, it could
use up all the ports on the NAT. use up all the ports on the NAT.
4.4. Conflicting Internal and External IP Address Spaces 4.4. Conflicting Internal and External IP Address Spaces
Many NATs, particularly consumer-level devices designed to be Many NATs, particularly consumer-level devices designed to be
deployed by nontechnical users, routinely obtain their external IP deployed by nontechnical users, routinely obtain their external IP
address, default router, and other IP configuration information for address, default router, and other IP configuration information for
their external interface dynamically from an external network such as their external interface dynamically from an external network, such
an upstream ISP. The NAT in turn automatically sets up its own as an upstream ISP. The NAT, in turn, automatically sets up its own
internal subnet in one of the private IP address spaces assigned to internal subnet in one of the private IP address spaces assigned to
this purpose in [RFC1918], typically providing dynamic IP this purpose in [RFC1918], typically providing dynamic IP
configuration services for hosts on this internal network. configuration services for hosts on this internal network.
Auto-configuration of NATs and private networks can be problematic, Auto-configuration of NATs and private networks can be problematic,
however, if the NAT's external network is also in RFC 1918 private however, if the NAT's external network is also in RFC 1918 private
address space. In a common scenario, an ISP places its customers address space. In a common scenario, an ISP places its customers
behind a NAT and hands out private RFC 1918 addresses to them. Some behind a NAT and hands out private RFC 1918 addresses to them. Some
of these customers in turn deploy consumer-level NATs, which in of these customers, in turn, deploy consumer-level NATs, which, in
effect act as "second-level" NATs, multiplexing their own private RFC effect, act as "second-level" NATs, multiplexing their own private
1918 IP subnets onto the single RFC 1918 IP address provided by the RFC 1918 IP subnets onto the single RFC 1918 IP address provided by
ISP. There is no inherent guarantee in this case that the ISP's the ISP. There is no inherent guarantee, in this case, that the
"intermediate" privately-addressed network and the customer's ISP's "intermediate" privately-addressed network and the customer's
internal privately-addressed network will not use numerically internal privately-addressed network will not use numerically
identical or overlapping RFC 1918 IP subnets. Customers of consumer- identical or overlapping RFC 1918 IP subnets. Furthermore, customers
level NATs further cannot be expected to have the technical knowledge of consumer-level NATs cannot be expected to have the technical
to prevent this scenario from occurring by manually configuring their knowledge to prevent this scenario from occurring by manually
internal network with non-conflicting RFC 1918 subnets. configuring their internal network with non-conflicting RFC 1918
subnets.
NAT vendors need to design their NATs to ensure that they function NAT vendors need to design their NATs to ensure that they function
correctly and robustly even in such problematic scenarios. One correctly and robustly even in such problematic scenarios. One
possible solution is for the NAT to ensure that whenever its external possible solution is for the NAT to ensure that whenever its external
link is configured with an RFC 1918 private IP address, the NAT link is configured with an RFC 1918 private IP address, the NAT
automatically selects a different, non-conflicting RFC 1918 IP subnet automatically selects a different, non-conflicting RFC 1918 IP subnet
for its internal network. A disadvantage of this solution is that if for its internal network. A disadvantage of this solution is that,
the NAT's external interface is dynamically configured or re- if the NAT's external interface is dynamically configured or re-
configured after its internal network is already in use, then the NAT configured after its internal network is already in use, then the NAT
may have to renumber its entire internal network dynamically if it may have to renumber its entire internal network dynamically if it
detects a conflict. detects a conflict.
An alternative solution is for the NAT to be designed so that it can An alternative solution is for the NAT to be designed so that it can
translate and forward traffic correctly even when its external and translate and forward traffic correctly, even when its external and
internal interfaces are configured with numerically overlapping IP internal interfaces are configured with numerically overlapping IP
subnets. In this scenario, for example, if the NAT's external subnets. In this scenario, for example, if the NAT's external
interface has been assigned an IP address P in RFC 1918 space, then interface has been assigned an IP address P in RFC 1918 space, then
there might also be an internal node I having the same RFC 1918 there might also be an internal node I having the same RFC 1918
private IP address P. An IP packet with destination address P on the private IP address P. An IP packet with destination address P on the
external network is directed at the NAT, whereas an IP packet with external network is directed at the NAT, whereas an IP packet with
the same destination address P on the internal network is directed at the same destination address P on the internal network is directed at
node I. The NAT therefore needs to maintain a clear operational node I. The NAT therefore needs to maintain a clear operational
distinction between "external IP addresses" and "internal IP distinction between "external IP addresses" and "internal IP
addresses" to avoid confusing internal node I with its own external addresses" to avoid confusing internal node I with its own external
interface. In general, the NAT needs to allow all internal nodes interface. In general, the NAT needs to allow all internal nodes
(including I) to communicate with all external nodes having public (including I) to communicate with all external nodes having public
(non-RFC 1918) IP addresses or having private IP addresses that do (non-RFC 1918) IP addresses, or having private IP addresses that do
not conflict with the addresses used by its internal network. not conflict with the addresses used by its internal network.
REQ-7: A NAT device whose external IP interface can be configured REQ-7: A NAT device whose external IP interface can be configured
dynamically MUST either (1) automatically ensure that its internal dynamically MUST either (1) automatically ensure that its internal
network uses IP addresses that do not conflict with its external network uses IP addresses that do not conflict with its external
network, or (2) be able to translate and forward traffic between network, or (2) be able to translate and forward traffic between
all internal nodes and all external nodes whose IP addresses all internal nodes and all external nodes whose IP addresses
numerically conflicts with the internal network. numerically conflict with the internal network.
Justification: If a NAT's external and internal interfaces are Justification: If a NAT's external and internal interfaces are
configured with overlapping IP subnets, then there is of course no configured with overlapping IP subnets, then there is, of course,
way for an internal host with RFC 1918 IP address Q to initiate a no way for an internal host with RFC 1918 IP address Q to initiate
direct communication session to an external node having the same a direct communication session to an external node having the same
RFC 1918 address Q, or to other external nodes with IP addresses RFC 1918 address Q, or to other external nodes with IP addresses
that numerically conflict with the internal subnet. Such nodes that numerically conflict with the internal subnet. Such nodes
can still open communication sessions indirectly via NAT traversal can still open communication sessions indirectly via NAT traversal
techniques, however, with the help of a third-party server such as techniques, however, with the help of a third-party server, such
a STUN server having a public, non-RFC 1918 IP address. In this as a STUN server having a public, non-RFC 1918 IP address. In
case, nodes with conflicting private RFC 1918 addresses on this case, nodes with conflicting private RFC 1918 addresses on
opposite sides of the second-level NAT can communicate with each opposite sides of the second-level NAT can communicate with each
other via their respective temporary public endpoints on the main other via their respective temporary public endpoints on the main
Internet, as long as their common first-level NAT (e.g., the Internet, as long as their common, first-level NAT (e.g., the
upstream ISP's NAT) supports hairpinning behavior as described in upstream ISP's NAT) supports hairpinning behavior, as described in
Section 6. Section 6.
5. Filtering Behavior 5. Filtering Behavior
This section describes various filtering behaviors observed in NATs. This section describes various filtering behaviors observed in NATs.
When an internal endpoint opens an outgoing session through a NAT, When an internal endpoint opens an outgoing session through a NAT,
the NAT assigns a filtering rule for the mapping between an internal the NAT assigns a filtering rule for the mapping between an internal
IP:port (X:x) and external IP:port (Y:y) tuple. IP:port (X:x) and external IP:port (Y:y) tuple.
The key behavior to describe is what criteria are used by the NAT to The key behavior to describe is what criteria are used by the NAT to
filter packets originating from specific external endpoints. filter packets originating from specific external endpoints.
Endpoint Independent Filtering: Endpoint-Independent Filtering:
The NAT filters out only packets not destined to the internal The NAT filters out only packets not destined to the internal
address and port X:x, regardless of the external IP address and address and port X:x, regardless of the external IP address and
port source (Z:z). The NAT forwards any packets destined to port source (Z:z). The NAT forwards any packets destined to
X:x. In other words, sending packets from the internal side of X:x. In other words, sending packets from the internal side of
the NAT to any external IP address is sufficient to allow any the NAT to any external IP address is sufficient to allow any
packets back to the internal endpoint. packets back to the internal endpoint.
Address Dependent Filtering: Address-Dependent Filtering:
The NAT filters out packets not destined to the internal The NAT filters out packets not destined to the internal
address X:x. Additionally, the NAT will filter out packets address X:x. Additionally, the NAT will filter out packets
from Y:y destined for the internal endpoint X:x if X:x has not from Y:y destined for the internal endpoint X:x if X:x has not
sent packets to Y:any previously (independently of the port sent packets to Y:any previously (independently of the port
used by Y). In other words, for receiving packets from a used by Y). In other words, for receiving packets from a
specific external endpoint, it is necessary for the internal specific external endpoint, it is necessary for the internal
endpoint to send packets first to that specific external endpoint to send packets first to that specific external
endpoint's IP address. endpoint's IP address.
Address and Port Dependent Filtering: Address and Port-Dependent Filtering:
This is similar to the previous behavior, except that the This is similar to the previous behavior, except that the
external port is also relevant. The NAT filters out packets external port is also relevant. The NAT filters out packets
not destined for the internal address X:x. Additionally, the not destined for the internal address X:x. Additionally, the
NAT will filter out packets from Y:y destined for the internal NAT will filter out packets from Y:y destined for the internal
endpoint X:x if X:x has not sent packets to Y:y previously. In endpoint X:x if X:x has not sent packets to Y:y previously. In
other words, for receiving packets from a specific external other words, for receiving packets from a specific external
endpoint, it is necessary for the internal endpoint to send endpoint, it is necessary for the internal endpoint to send
packets first to that external endpoint's IP address and port. packets first to that external endpoint's IP address and port.
REQ-8: If application transparency is most important, it is REQ-8: If application transparency is most important, it is
RECOMMENDED that a NAT have an "Endpoint independent filtering" RECOMMENDED that a NAT have an "Endpoint-Independent Filtering"
behavior. If a more stringent filtering behavior is most behavior. If a more stringent filtering behavior is most
important, it is RECOMMENDED that a NAT have an "Address dependent important, it is RECOMMENDED that a NAT have an "Address-Dependent
filtering" behavior. Filtering" behavior.
a) The filtering behavior MAY be an option configurable by the a) The filtering behavior MAY be an option configurable by the
administrator of the NAT. administrator of the NAT.
Justification: The recommendation to use Endpoint Independent Justification: The recommendation to use Endpoint-Independent
Filtering is aimed at maximizing application transparency, in Filtering is aimed at maximizing application transparency; in
particular for applications that receive media simultaneously from particular, for applications that receive media simultaneously
multiple locations (e.g., gaming), or applications that use from multiple locations (e.g., gaming), or applications that use
rendezvous techniques. However, it is also possible that in some rendezvous techniques. However, it is also possible that, in some
circumstances, it may be preferable to have a more stringent circumstances, it may be preferable to have a more stringent
filtering behavior. Filtering independently of the external filtering behavior. Filtering independently of the external
endpoint is not as secure: an unauthorized packet could get endpoint is not as secure: An unauthorized packet could get
through a specific port while the port was kept open if it was through a specific port while the port was kept open if it was
lucky enough to find the port open. In theory, filtering based on lucky enough to find the port open. In theory, filtering based on
both IP address and port is more secure than filtering based only both IP address and port is more secure than filtering based only
on the IP address (because the external endpoint could in reality on the IP address (because the external endpoint could, in
be two endpoints behind another NAT, where one of the two reality, be two endpoints behind another NAT, where one of the two
endpoints is an attacker): however, such a policy could interfere endpoints is an attacker). However, such a policy could interfere
with applications that expect to receive UDP packets on more than with applications that expect to receive UDP packets on more than
one UDP port. Using Endpoint Independent Filtering or Address one UDP port. Using Endpoint-Independent Filtering or Address-
Dependent Filtering instead of Address and Port Dependent Dependent Filtering instead of Address and Port-Dependent
Filtering on a NAT (say NAT-A) also has benefits when the other Filtering on a NAT (say, NAT-A) also has benefits when the other
endpoint is behind a non-BEHAVE compliant NAT (say NAT-B) that endpoint is behind a non-BEHAVE compliant NAT (say, NAT-B) that
does not support REQ-1. When the endpoints use ICE, if NAT-A uses does not support REQ-1. When the endpoints use ICE, if NAT-A uses
Address and Port Dependent Filtering, connectivity will require a Address and Port-Dependent Filtering, connectivity will require a
UDP relay. However, if NAT-A uses Endpoint Independent Filtering UDP relay. However, if NAT-A uses Endpoint-Independent Filtering
or Address Dependent Filtering, ICE will ultimately find or Address-Dependent Filtering, ICE will ultimately find
connectivity without requiring a UDP relay. Having the filtering connectivity without requiring a UDP relay. Having the filtering
behavior being an option configurable by the administrator of the behavior being an option configurable by the administrator of the
NAT ensures that a NAT can be used in the widest variety of NAT ensures that a NAT can be used in the widest variety of
deployment scenarios. deployment scenarios.
6. Hairpinning Behavior 6. Hairpinning Behavior
If two hosts (called X1 and X2) are behind the same NAT and If two hosts (called X1 and X2) are behind the same NAT and
exchanging traffic, the NAT may allocate an address on the outside of exchanging traffic, the NAT may allocate an address on the outside of
the NAT for X2, called X2':x2'. If X1 sends traffic to X2':x2', it the NAT for X2, called X2':x2'. If X1 sends traffic to X2':x2', it
skipping to change at page 16, line 42 skipping to change at page 17, line 25
Hairpinning Behavior Hairpinning Behavior
Hairpinning allows two endpoints on the internal side of the NAT to Hairpinning allows two endpoints on the internal side of the NAT to
communicate even if they only use each other's external IP addresses communicate even if they only use each other's external IP addresses
and ports. and ports.
More formally, a NAT that supports hairpinning forwards packets More formally, a NAT that supports hairpinning forwards packets
originating from an internal address, X1:x1, destined for an external originating from an internal address, X1:x1, destined for an external
address X2':x2' that has an active mapping to an internal address address X2':x2' that has an active mapping to an internal address
X2:x2, back to that internal address X2:x2. Note that typically X1' X2:x2, back to that internal address, X2:x2. Note that typically X1'
is the same as X2'. is the same as X2'.
Furthermore, the NAT may present the hairpinned packet with either an Furthermore, the NAT may present the hairpinned packet with either an
internal (X1:x1) or an external (X1':x1') source IP address and port. internal (X1:x1) or an external (X1':x1') source IP address and port.
The hairpinning NAT behavior can therefore be either "External source Therefore, the hairpinning NAT behavior can be either "External
IP address and port" or "Internal source IP address and port". source IP address and port" or "Internal source IP address and port".
"Internal source IP address and port" may cause problems by confusing "Internal source IP address and port" may cause problems by confusing
implementations that expect an external IP address and port. implementations that expect an external IP address and port.
REQ-9: A NAT MUST support "Hairpinning". REQ-9: A NAT MUST support "Hairpinning".
a) A NAT Hairpinning behavior MUST be "External source IP address a) A NAT Hairpinning behavior MUST be "External source IP address
and port". and port".
Justification: This requirement is to allow communications between Justification: This requirement is to allow communications between
two endpoints behind the same NAT when they are trying each two endpoints behind the same NAT when they are trying each
other's external IP addresses. other's external IP addresses.
a) Using the external source IP address is necessary for a) Using the external source IP address is necessary for
applications with a restrictive policy of not accepting packets applications with a restrictive policy of not accepting packets
from IP addresses that differ from what is expected. from IP addresses that differ from what is expected.
7. Application Level Gateways 7. Application Level Gateways
Certain NATs have implemented Application Level Gateways (ALGs) for Certain NATs have implemented Application Level Gateways (ALGs) for
various protocols, including protocols for negotiating peer-to-peer various protocols, including protocols for negotiating peer-to-peer
sessions such as SIP. sessions, such as SIP.
Certain NATs have these ALGs turned on permanently, others have them Certain NATs have these ALGs turned on permanently, others have them
turned on by default but let them be be turned off, and others have turned on by default but allow them to be turned off, and others have
them turned off by default but let them be turned on. them turned off by default but allow them be turned on.
NAT ALGs may interfere with UNSAF methods or protocols that try to be NAT ALGs may interfere with UNSAF methods or protocols that try to be
NAT-aware and must therefore be used with extreme caution. NAT-aware and therefore must be used with extreme caution.
REQ-10: To eliminate interference with UNSAF NAT traversal REQ-10: To eliminate interference with UNSAF NAT traversal
mechanisms and allow integrity protection of UDP communications, mechanisms and allow integrity protection of UDP communications,
NAT ALGs for UDP-based protocols SHOULD be turned off. Future NAT ALGs for UDP-based protocols SHOULD be turned off. Future
standards track specifications that define an ALG can update this standards track specifications that define ALGs can update this to
to recommend that the ALGs they define default on. recommend the defaults for the ALGs that they define.
a) If a NAT includes ALGs, it is RECOMMENDED that the NAT allow a) If a NAT includes ALGs, it is RECOMMENDED that the NAT allow
the NAT administrator to enable or disable each ALG separately. the NAT administrator to enable or disable each ALG separately.
Justification: NAT ALGs may interfere with UNSAF methods. Justification: NAT ALGs may interfere with UNSAF methods.
a) This requirement allows the user to enable those ALGs that are a) This requirement allows the user to enable those ALGs that are
necessary to aid in the operation of some applications without necessary to aid in the operation of some applications without
enabling ALGs which interfere with the operation of other enabling ALGs, which interfere with the operation of other
applications. applications.
8. Deterministic Properties 8. Deterministic Properties
The classification of NATs is further complicated by the fact that The classification of NATs is further complicated by the fact that,
under some conditions the same NAT will exhibit different behaviors. under some conditions, the same NAT will exhibit different behaviors.
This has been seen on NATs that preserve ports or have specific This has been seen on NATs that preserve ports or have specific
algorithms for selecting a port other than a free one. If the algorithms for selecting a port other than a free one. If the
external port that the NAT wishes to use is already in use by another external port that the NAT wishes to use is already in use by another
session, the NAT must select a different port. This results in session, the NAT must select a different port. This results in
different code paths for this conflict case, which results in different code paths for this conflict case, which results in
different behavior. different behavior.
For example, if three hosts X1, X2, and X3 all send from the same For example, if three hosts X1, X2, and X3 all send from the same
port x, through a port preserving NAT with only one external IP port x, through a port preserving NAT with only one external IP
address, called X1', the first one to send (i.e., X1) will get an address, called X1', the first one to send (i.e., X1) will get an
external port of x but the next two will get x2' and x3' (where these external port of x, but the next two will get x2' and x3' (where
are not equal to x). There are NATs where the External NAT mapping these are not equal to x). There are NATs where the External NAT
characteristics and the External Filter characteristics change mapping characteristics and the External Filter characteristics
between the X1:x and the X2:x mapping. To make matters worse, there change between the X1:x and the X2:x mapping. To make matters worse,
are NATs where the behavior may be the same on the X1:x and X2:x there are NATs where the behavior may be the same on the X1:x and
mappings but different on the third X3:x mapping. X2:x mappings, but different on the third X3:x mapping.
Another example is that some NATs have an "Endpoint Independent Another example is that some NATs have an "Endpoint-Independent
Mapping" combined with "Port Overloading" as long as two endpoints Mapping", combined with "Port Overloading", as long as two endpoints
are not establishing sessions to the same external direction, but are not establishing sessions to the same external direction, but
then switch their behavior to "Address and Port Dependent Mapping" then switch their behavior to "Address and Port-Dependent Mapping"
without "Port Preservation" upon detection of these conflicting without "Port Preservation" upon detection of these conflicting
sessions establishments. sessions establishments.
Any NAT that changes the NAT Mapping or the Filtering behavior Any NAT that changes the NAT Mapping or the Filtering behavior
without configuration changes, at any point in time under any without configuration changes, at any point in time, under any
particular conditions is referred to as a "non-deterministic" NAT. particular conditions, is referred to as a "non-deterministic" NAT.
NATs that don't are called "deterministic". NATs that don't are called "deterministic".
Non-deterministic NATs generally change behavior when a conflict of Non-deterministic NATs generally change behavior when a conflict of
some sort happens, i.e. when the port that would normally be used is some sort happens, i.e., when the port that would normally be used is
already in use by another mapping. The NAT mapping and External already in use by another mapping. The NAT mapping and External
Filtering in the absence of conflict is referred to as the Primary Filtering in the absence of conflict is referred to as the Primary
behavior. The behavior after the first conflict is referred to as behavior. The behavior after the first conflict is referred to as
Secondary and after the second conflict is referred to as Tertiary. Secondary and after the second conflict is referred to as Tertiary.
No NATs have been observed that change on further conflicts but it is No NATs have been observed that change on further conflicts, but it
certainly possible that they exist. is certainly possible that they exist.
REQ-11: A NAT MUST have deterministic behavior, i.e., it MUST NOT REQ-11: A NAT MUST have deterministic behavior, i.e., it MUST NOT
change the NAT translation (Section 4) or the Filtering change the NAT translation (Section 4) or the Filtering
(Section 5) Behavior at any point in time or under any particular (Section 5) Behavior at any point in time, or under any particular
conditions. conditions.
Justification: Non-deterministic NATs are very difficult to Justification: Non-deterministic NATs are very difficult to
troubleshoot because they require more intensive testing. This troubleshoot because they require more intensive testing. This
non-deterministic behavior is the root cause of much of the non-deterministic behavior is the root cause of much of the
uncertainty that NATs introduce about whether or not applications uncertainty that NATs introduce about whether or not applications
will work. will work.
9. ICMP Destination Unreachable Behavior 9. ICMP Destination Unreachable Behavior
When a NAT sends a packet towards a host on the other side of the When a NAT sends a packet toward a host on the other side of the NAT,
NAT, an ICMP message may be sent in response to that packet. That an ICMP message may be sent in response to that packet. That ICMP
ICMP message may be sent by the destination host or by any router message may be sent by the destination host or by any router along
along the network path. The NAT's default configuration SHOULD NOT the network path. The NAT's default configuration SHOULD NOT filter
filter ICMP messages based on their source IP address. Such ICMP ICMP messages based on their source IP address. Such ICMP messages
messages SHOULD be rewritten by the NAT (specifically the IP headers SHOULD be rewritten by the NAT (specifically, the IP headers and the
and the ICMP payload) and forwarded to the appropriate internal or ICMP payload) and forwarded to the appropriate internal or external
external host. The NAT needs to perform this function for as long as host. The NAT needs to perform this function for as long as the UDP
the UDP mapping is active. Receipt of any sort of ICMP message MUST mapping is active. Receipt of any sort of ICMP message MUST NOT
NOT destroy the NAT mapping. A NAT which performs the functions destroy the NAT mapping. A NAT that performs the functions described
described in the paragraph above is referred to as "support ICMP in the paragraph above is referred to as "support ICMP Processing".
Processing".
There is no significant security advantage to blocking ICMP There is no significant security advantage to blocking ICMP
Destination Unreachable packets. Additionally, blocking ICMP Destination Unreachable packets. Additionally, blocking ICMP
Destination Unreachable packets can interfere with application Destination Unreachable packets can interfere with application
failover, UDP Path MTU Discovery (see [RFC1191] and [RFC1435]), and failover, UDP Path MTU Discovery (see [RFC1191] and [RFC1435]), and
traceroute. Blocking any ICMP message is discouraged, and blocking traceroute. Blocking any ICMP message is discouraged, and blocking
ICMP Destination Unreachable is strongly discouraged. ICMP Destination Unreachable is strongly discouraged.
REQ-12: Receipt of any sort of ICMP message MUST NOT terminate the REQ-12: Receipt of any sort of ICMP message MUST NOT terminate the
NAT mapping. NAT mapping.
skipping to change at page 19, line 29 skipping to change at page 20, line 7
There is no significant security advantage to blocking ICMP There is no significant security advantage to blocking ICMP
Destination Unreachable packets. Additionally, blocking ICMP Destination Unreachable packets. Additionally, blocking ICMP
Destination Unreachable packets can interfere with application Destination Unreachable packets can interfere with application
failover, UDP Path MTU Discovery (see [RFC1191] and [RFC1435]), and failover, UDP Path MTU Discovery (see [RFC1191] and [RFC1435]), and
traceroute. Blocking any ICMP message is discouraged, and blocking traceroute. Blocking any ICMP message is discouraged, and blocking
ICMP Destination Unreachable is strongly discouraged. ICMP Destination Unreachable is strongly discouraged.
REQ-12: Receipt of any sort of ICMP message MUST NOT terminate the REQ-12: Receipt of any sort of ICMP message MUST NOT terminate the
NAT mapping. NAT mapping.
a) The NAT's default configuration SHOULD NOT filter ICMP messages a) The NAT's default configuration SHOULD NOT filter ICMP messages
based on their source IP address. based on their source IP address.
b) It is RECOMMENDED that a NAT support ICMP Destination b) It is RECOMMENDED that a NAT support ICMP Destination
Unreachable messages. Unreachable messages.
Justification: This is easy to do, is used for many things including Justification: This is easy to do and is used for many things
MTU discovery and rapid detection of error conditions, and has no including MTU discovery and rapid detection of error conditions,
negative consequences. and has no negative consequences.
10. Fragmentation of Outgoing Packets 10. Fragmentation of Outgoing Packets
When the MTU of the adjacent link is too small, fragmentation of When the MTU of the adjacent link is too small, fragmentation of
packets going from the internal side to the external side of the NAT packets going from the internal side to the external side of the NAT
may occur. This can occur if the NAT is doing PPPoE, or if the NAT may occur. This can occur if the NAT is doing Point-to-Point over
has been configured with a small MTU to reduce serialization delay Ethernet (PPPoE), or if the NAT has been configured with a small MTU
when sending large packets and small higher-priority packets, or for to reduce serialization delay when sending large packets and small
other reasons. higher-priority packets, or for other reasons.
It is worth noting that many IP stacks do not use Path MTU Discovery It is worth noting that many IP stacks do not use Path MTU Discovery
with UDP packets. with UDP packets.
The packet could have its Don't Fragment bit set to 1 (DF=1) or 0 The packet could have its Don't Fragment bit set to 1 (DF=1) or 0
(DF=0). (DF=0).
REQ-13: If the packet received on an internal IP address has DF=1, REQ-13: If the packet received on an internal IP address has DF=1,
the NAT MUST send back an ICMP message "fragmentation needed and the NAT MUST send back an ICMP message "Fragmentation needed and
DF set" message to the host as described in [RFC0792]. DF set" to the host, as described in [RFC0792].
a) If the packet has DF=0, the NAT MUST fragment the packet and a) If the packet has DF=0, the NAT MUST fragment the packet and
SHOULD send the fragments in order. SHOULD send the fragments in order.
Justification: This is as per RFC 792. Justification: This is as per RFC 792.
a) This is the same function a router performs in a similar a) This is the same function a router performs in a similar
situation [RFC1812]. situation [RFC1812].
11. Receiving Fragmented Packets 11. Receiving Fragmented Packets
For a variety of reasons, a NAT may receive a fragmented packet. The For a variety of reasons, a NAT may receive a fragmented packet. The
IP packet containing the header could arrive in any fragment IP packet containing the header could arrive in any fragment,
depending on network conditions, packet ordering, and the depending on network conditions, packet ordering, and the
implementation of the IP stack that generated the fragments. implementation of the IP stack that generated the fragments.
A NAT that is capable only of receiving fragments in order (that is, A NAT that is capable only of receiving fragments in order (that is,
with the header in the first packet) and forwarding each of the with the header in the first packet) and forwarding each of the
fragments to the internal host is described as "Received Fragments fragments to the internal host is described as "Received Fragments
Ordered". Ordered".
A NAT that is capable of receiving fragments in or out of order and A NAT that is capable of receiving fragments in or out of order and
forwarding the individual fragments (or a reassembled packet) to the forwarding the individual fragments (or a reassembled packet) to the
internal host is referred to as "Receive Fragments Out of Order". internal host is referred to as "Receive Fragments Out of Order".
See the Security Considerations section of this document for a See the Security Considerations section of this document for a
discussion of this behavior. discussion of this behavior.
A NAT that is neither of these is referred to as "Receive Fragments A NAT that is neither of these is referred to as "Receive Fragments
None". None".
REQ-14: A NAT MUST support receiving in order and out of order REQ-14: A NAT MUST support receiving in-order and out-of-order
fragments, so it MUST have "Received Fragment Out of Order" fragments, so it MUST have "Received Fragment Out of Order"
behavior. behavior.
a) A NAT's out of order fragment processing mechanism MUST be
a) A NAT's out-of-order fragment processing mechanism MUST be
designed so that fragmentation-based DoS attacks do not designed so that fragmentation-based DoS attacks do not
compromise the NAT's ability to process in-order and compromise the NAT's ability to process in-order and
unfragmented IP packets. unfragmented IP packets.
Justification: See Security Considerations. Justification: See Security Considerations.
12. Requirements 12. Requirements
The requirements in this section are aimed at minimizing the The requirements in this section are aimed at minimizing the
complications caused by NATs to applications such as realtime complications caused by NATs to applications, such as realtime
communications and online gaming. The requirements listed earlier in communications and online gaming. The requirements listed earlier in
the document are consolidated here into a single section. the document are consolidated here into a single section.
It should be understood, however, that applications normally do not It should be understood, however, that applications normally do not
know in advance if the NAT conforms to the recommendations defined in know in advance if the NAT conforms to the recommendations defined in
this section. Peer-to-peer media applications still need to use this section. Peer-to-peer media applications still need to use
normal procedures such as ICE [I-D.ietf-mmusic-ice]. normal procedures, such as ICE [ICE].
A NAT that supports all of the mandatory requirements of this A NAT that supports all the mandatory requirements of this
specification (i.e., the "MUST"), is "compliant with this specification (i.e., the "MUST"), is "compliant with this
specification." A NAT that supports all of the requirements of this specification". A NAT that supports all the requirements of this
specification (i.e., including the "RECOMMENDED") is "fully compliant specification (i.e., including the "RECOMMENDED") is "fully compliant
with all the mandatory and recommended requirements of this with all the mandatory and recommended requirements of this
specification." specification".
REQ-1: A NAT MUST have an "Endpoint-Independent Mapping" behavior.
REQ-1: A NAT MUST have an "Endpoint Independent Mapping" behavior.
REQ-2: It is RECOMMENDED that a NAT have an "IP address pooling" REQ-2: It is RECOMMENDED that a NAT have an "IP address pooling"
behavior of "Paired". Note that this requirement is not behavior of "Paired". Note that this requirement is not
applicable to NATs that do not support IP address pooling. applicable to NATs that do not support IP address pooling.
REQ-3: A NAT MUST NOT have a "Port assignment" behavior of "Port REQ-3: A NAT MUST NOT have a "Port assignment" behavior of "Port
overloading". overloading".
a) If the host's source port was in the range 0-1023, it is a) If the host's source port was in the range 0-1023, it is
RECOMMENDED the NAT's source port be in the same range. If the RECOMMENDED the NAT's source port be in the same range. If the
host's source port was in the range 1024-65535, it is host's source port was in the range 1024-65535, it is
RECOMMENDED that the NAT's source port be in that range. RECOMMENDED that the NAT's source port be in that range.
REQ-4: It is RECOMMENDED that a NAT have a "Port parity REQ-4: It is RECOMMENDED that a NAT have a "Port parity
preservation" behavior of "Yes". preservation" behavior of "Yes".
REQ-5: A NAT UDP mapping timer MUST NOT expire in less than 2
REQ-5: A NAT UDP mapping timer MUST NOT expire in less than two
minutes, unless REQ-5a applies. minutes, unless REQ-5a applies.
a) For specific destination ports in the well-known port range a) For specific destination ports in the well-known port range
(ports 0-1023), a NAT MAY have shorter UDP mapping timers that (ports 0-1023), a NAT MAY have shorter UDP mapping timers that
are specific to the IANA-registered application running over are specific to the IANA-registered application running over
that specific destination port. that specific destination port.
b) The value of the NAT UDP mapping timer MAY be configurable. b) The value of the NAT UDP mapping timer MAY be configurable.
c) A default value of 5 minutes or more for the NAT UDP mapping
c) A default value of five minutes or more for the NAT UDP mapping
timer is RECOMMENDED. timer is RECOMMENDED.
REQ-6: The NAT mapping Refresh Direction MUST have a "NAT Outbound REQ-6: The NAT mapping Refresh Direction MUST have a "NAT Outbound
refresh behavior" of "True". refresh behavior" of "True".
a) The NAT mapping Refresh Direction MAY have a "NAT Inbound a) The NAT mapping Refresh Direction MAY have a "NAT Inbound
refresh behavior" of "True". refresh behavior" of "True".
REQ-7 A NAT device whose external IP interface can be configured REQ-7 A NAT device whose external IP interface can be configured
dynamically MUST either (1) Automatically ensure that its internal dynamically MUST either (1) Automatically ensure that its internal
network uses IP addresses that do not conflict with its external network uses IP addresses that do not conflict with its external
network, or (2) Be able to translate and forward traffic between network, or (2) Be able to translate and forward traffic between
all internal nodes and all external nodes whose IP addresses all internal nodes and all external nodes whose IP addresses
numerically conflicts with the internal network. numerically conflict with the internal network.
REQ-8: If application transparency is most important, it is REQ-8: If application transparency is most important, it is
RECOMMENDED that a NAT have "Endpoint independent filtering" RECOMMENDED that a NAT have "Endpoint-Independent Filtering"
behavior. If a more stringent filtering behavior is most behavior. If a more stringent filtering behavior is most
important, it is RECOMMENDED that a NAT have "Address dependent important, it is RECOMMENDED that a NAT have "Address-Dependent
filtering" behavior. Filtering" behavior.
a) The filtering behavior MAY be an option configurable by the a) The filtering behavior MAY be an option configurable by the
administrator of the NAT. administrator of the NAT.
REQ-9: A NAT MUST support "Hairpinning". REQ-9: A NAT MUST support "Hairpinning".
a) A NAT Hairpinning behavior MUST be "External source IP address a) A NAT Hairpinning behavior MUST be "External source IP address
and port". and port".
REQ-10: To eliminate interference with UNSAF NAT traversal REQ-10: To eliminate interference with UNSAF NAT traversal
mechanisms and allow integrity protection of UDP communications, mechanisms and allow integrity protection of UDP communications,
NAT ALGs for UDP-based protocols SHOULD be turned off. Future NAT ALGs for UDP-based protocols SHOULD be turned off. Future
standards track specifications that define an ALG can update this standards track specifications that define an ALG can update this
to recommend that the ALGs they define default on. to recommend the ALGs on which they define default.
a) If a NAT includes ALGs, it is RECOMMENDED that the NAT allow a) If a NAT includes ALGs, it is RECOMMENDED that the NAT allow
the NAT administrator to enable or disable each ALG separately. the NAT administrator to enable or disable each ALG separately.
REQ-11: A NAT MUST have deterministic behavior, i.e., it MUST NOT REQ-11: A NAT MUST have deterministic behavior, i.e., it MUST NOT
change the NAT translation (Section 4) or the Filtering change the NAT translation (Section 4) or the Filtering
(Section 5) Behavior at any point in time or under any particular (Section 5) Behavior at any point in time, or under any particular
conditions. conditions.
REQ-12: Receipt of any sort of ICMP message MUST NOT terminate the REQ-12: Receipt of any sort of ICMP message MUST NOT terminate the
NAT mapping. NAT mapping.
a) The NAT's default configuration SHOULD NOT filter ICMP messages a) The NAT's default configuration SHOULD NOT filter ICMP messages
based on their source IP address. based on their source IP address.
b) It is RECOMMENDED that a NAT support ICMP Destination b) It is RECOMMENDED that a NAT support ICMP Destination
Unreachable messages. Unreachable messages.
REQ-13 If the packet received on an internal IP address has DF=1, REQ-13 If the packet received on an internal IP address has DF=1,
the NAT MUST send back an ICMP message "fragmentation needed and the NAT MUST send back an ICMP message "Fragmentation needed and
DF set" message to the host as described in [RFC0792]. DF set" to the host, as described in [RFC0792].
a) If the packet has DF=0, the NAT MUST fragment the packet and a) If the packet has DF=0, the NAT MUST fragment the packet and
SHOULD send the fragments in order. SHOULD send the fragments in order.
REQ-14: A NAT MUST support receiving in order and out of order
REQ-14: A NAT MUST support receiving in-order and out-of-order
fragments, so it MUST have "Received Fragment Out of Order" fragments, so it MUST have "Received Fragment Out of Order"
behavior. behavior.
a) A NAT's out of order fragment processing mechanism MUST be
a) A NAT's out-of-order fragment processing mechanism MUST be
designed so that fragmentation-based DoS attacks do not designed so that fragmentation-based DoS attacks do not
compromise the NAT's ability to process in-order and compromise the NAT's ability to process in-order and
unfragmented IP packets. unfragmented IP packets.
13. Security Considerations 13. Security Considerations
NATs are often deployed to achieve security goals. Most of the NATs are often deployed to achieve security goals. Most of the
recommendations and requirements in this document do not affect the recommendations and requirements in this document do not affect the
security properties of these devices, but a few of them do have security properties of these devices, but a few of them do have
security implications and are discussed in this section. security implications and are discussed in this section.
This document recommends that the timers for mapping be refreshed This document recommends that the timers for mapping be refreshed on
only on outgoing packets (see REQ-6) and does not make outgoing packets (see REQ-6) and does not make recommendations about
recommendations about whether or not inbound packets should update whether or not inbound packets should update the timers. If inbound
the timers. If inbound packets update the timers, an external packets update the timers, an external attacker can keep the mapping
attacker can keep the mapping alive forever and attack future devices alive forever and attack future devices that may end up with the same
that may end up with the same internal address. A device that was internal address. A device that was also the DHCP server for the
also the DHCP server for the private address space could mitigate private address space could mitigate this by cleaning any mappings
this by cleaning any mappings when a DHCP lease expired. For unicast when a DHCP lease expired. For unicast UDP traffic (the scope of
UDP traffic (the scope of this document), it may not seem relevant to this document), it may not seem relevant to support inbound timer
support inbound timer refresh; however, for multicast UDP, the refresh; however, for multicast UDP, the question is harder. It is
question is harder. It is expected that future documents discussing expected that future documents discussing NAT behavior with multicast
NAT behavior with multicast traffic will refine the requirements traffic will refine the requirements around handling of the inbound
around handling of the inbound refresh timer. Some devices today do refresh timer. Some devices today do update the timers on inbound
update the timers on inbound packets. packets.
This document recommends that the NAT filters be specific to the This document recommends that the NAT filters be specific to the
external IP address only (see REQ-8) and not to the external IP external IP address only (see REQ-8) and not to the external IP
address and UDP port. It can be argued that this is less secure than address and UDP port. It can be argued that this is less secure than
using the IP and port. Devices that wish to filter on IP and port do using the IP and port. Devices that wish to filter on IP and port do
still comply with these requirements. still comply with these requirements.
Non-deterministic NATs are risky from a security point of view. They Non-deterministic NATs are risky from a security point of view. They
are very difficult to test because they are, well, non-deterministic. are very difficult to test because they are, well, non-deterministic.
Testing by a person configuring one may result in the person thinking Testing by a person configuring one may result in the person thinking
it is behaving as desired, yet under different conditions, which an it is behaving as desired, yet under different conditions, which an
attacker can create, the NAT may behave differently. These attacker can create, the NAT may behave differently. These
requirements recommend that devices be deterministic. requirements recommend that devices be deterministic.
This document requires that NATs have an "external NAT mapping is This document requires that NATs have an "external NAT mapping is
endpoint independent" behavior. This does not reduce the security of endpoint independent" behavior. This does not reduce the security of
devices. Which packets are allowed to flow across the device is devices. Which packets are allowed to flow across the device is
determined by the external filtering behavior, which is independent determined by the external filtering behavior, which is independent
of the mapping behavior. of the mapping behavior.
When a fragmented packet is received from the external side and the When a fragmented packet is received from the external side, and the
packets are out of order so that the initial fragment does not arrive packets are out of order so that the initial fragment does not arrive
first, many systems simply discard the out of order packets. first, many systems simply discard the out-of-order packets.
Moreover, since some networks deliver small packets ahead of large Moreover, since some networks deliver small packets ahead of large
ones, there can be many out of order fragments. NATs that are ones, there can be many out-of-order fragments. NATs that are
capable of delivering these out of order packets are possible but capable of delivering these out-of-order packets are possible, but
they need to store the out of order fragments, which can open up a they need to store the out-of-order fragments, which can open up a
DoS opportunity if done incorrectly. Fragmentation has been a tool Denial-of-Service (DoS) opportunity, if done incorrectly.
used in many attacks, some involving passing fragmented packets Fragmentation has been a tool used in many attacks, some involving
through NATs and others involving DoS attacks based on the state passing fragmented packets through NATs, and others involving DoS
needed to reassemble the fragments. NAT implementers should be aware attacks based on the state needed to reassemble the fragments. NAT
of [RFC3128] and [RFC1858]. implementers should be aware of [RFC3128] and [RFC1858].
14. IANA Considerations
There are no IANA considerations.
15. IAB Considerations 14. IAB Considerations
The IAB has studied the problem of "Unilateral Self Address Fixing", The IAB has studied the problem of "Unilateral Self Address Fixing",
which is the general process by which a client attempts to determine which is the general process by which a client attempts to determine
its address in another realm on the other side of a NAT through a its address in another realm on the other side of a NAT through a
collaborative protocol reflection mechanism [RFC3424]. collaborative protocol reflection mechanism [RFC3424].
This specification does not in itself constitute an UNSAF This specification does not, in itself, constitute an UNSAF
application. It consists of a series of requirements for NATs aimed application. It consists of a series of requirements for NATs aimed
at minimizing the negative impact that those devices have on peer-to- at minimizing the negative impact that those devices have on peer-to-
peer media applications, especially when those applications are using peer media applications, especially when those applications are using
UNSAF methods. UNSAF methods.
Section 3 of UNSAF lists several practical issues with solutions to Section 3 of UNSAF lists several practical issues with solutions to
NAT problems. This document makes recommendations to reduce the NAT problems. This document makes recommendations to reduce the
uncertainty and problems introduced by these practical issues with uncertainty and problems introduced by these practical issues with
NATs. In addition, UNSAF lists five architectural considerations. NATs. In addition, UNSAF lists five architectural considerations.
Although this is not an UNSAF proposal, it is interesting to consider Although this is not an UNSAF proposal, it is interesting to consider
skipping to change at page 24, line 32 skipping to change at page 25, line 33
Section 3 of UNSAF lists several practical issues with solutions to Section 3 of UNSAF lists several practical issues with solutions to
NAT problems. This document makes recommendations to reduce the NAT problems. This document makes recommendations to reduce the
uncertainty and problems introduced by these practical issues with uncertainty and problems introduced by these practical issues with
NATs. In addition, UNSAF lists five architectural considerations. NATs. In addition, UNSAF lists five architectural considerations.
Although this is not an UNSAF proposal, it is interesting to consider Although this is not an UNSAF proposal, it is interesting to consider
the impact of this work on these architectural considerations. the impact of this work on these architectural considerations.
Arch-1: The scope of this is limited to UDP packets in NATs like the Arch-1: The scope of this is limited to UDP packets in NATs like the
ones widely deployed today. The "fix" helps constrain the ones widely deployed today. The "fix" helps constrain the
variability of NATs for true UNSAF solutions such as STUN. variability of NATs for true UNSAF solutions such as STUN.
Arch-2: This will exit at the same rate that NATs exit. It does not Arch-2: This will exit at the same rate that NATs exit. It does not
imply any protocol machinery that would continue to live imply any protocol machinery that would continue to live
after NATs were gone or make it more difficult to remove after NATs were gone, or make it more difficult to remove
them. them.
Arch-3: This does not reduce the overall brittleness of NATs but
Arch-3: This does not reduce the overall brittleness of NATs, but
will hopefully reduce some of the more outrageous NAT will hopefully reduce some of the more outrageous NAT
behaviors and make it easer to discuss and predict NAT behaviors and make it easer to discuss and predict NAT
behavior in given situations. behavior in given situations.
Arch-4: This work and the results [I-D.jennings-behave-test-results]
of various NATs represent the most comprehensive work at
IETF on what the real issues are with NATs for applications
like VoIP. This work and STUN have pointed out more than
anything else the brittleness NATs introduce and the
difficulty of addressing these issues.
Arch-5: This work and the test results
[I-D.jennings-behave-test-results] provide a reference model
for what any UNSAF proposal might encounter in deployed
NATs.
16. Acknowledgments Arch-4: This work and the results [RESULTS] of various NATs
represent the most comprehensive work at IETF on what the
real issues are with NATs for applications like VoIP. This
work and STUN have pointed out, more than anything else, the
brittleness NATs introduce and the difficulty of addressing
these issues.
The editor would like to acknowledge Bryan Ford, Pyda Srisuresh and Arch-5: This work and the test results [RESULTS] provide a reference
Dan Kegel for the their multiple contributions on peer-to-peer model for what any UNSAF proposal might encounter in
deployed NATs.
15. Acknowledgments
The editor would like to acknowledge Bryan Ford, Pyda Srisuresh, and
Dan Kegel for their multiple contributions on peer-to-peer
communications across a NAT. Dan Wing contributed substantial text communications across a NAT. Dan Wing contributed substantial text
on IP fragmentation and ICMP behavior. Thanks to Rohan Mahy, on IP fragmentation and ICMP behavior. Thanks to Rohan Mahy,
Jonathan Rosenberg, Mary Barnes, Melinda Shore, Lyndsay Campbell, Jonathan Rosenberg, Mary Barnes, Melinda Shore, Lyndsay Campbell,
Geoff Huston, Jiri Kuthan, Harald Welte, Steve Casner, Robert Geoff Huston, Jiri Kuthan, Harald Welte, Steve Casner, Robert
Sanders, Spencer Dawkins, Saikat Guha, Christian Huitema, Yutaka Sanders, Spencer Dawkins, Saikat Guha, Christian Huitema, Yutaka
Takeda, Paul Hoffman, Lisa Dusseault, Pekka Savola, Peter Koch and Takeda, Paul Hoffman, Lisa Dusseault, Pekka Savola, Peter Koch, Jari
Jari Arkko for their contributions. Arkko, and Alfred Hoenes for their contributions.
17. References 16. References
17.1. Normative References 16.1. Normative References
[RFC0768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, [RFC0768] Postel, J., "User Datagram Protocol", STD 6, RFC 768,
August 1980. August 1980.
[RFC0791] Postel, J., "Internet Protocol", STD 5, RFC 791, [RFC0791] Postel, J., "Internet Protocol", STD 5, RFC 791,
September 1981. September 1981.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
17.2. Informational References 16.2. Informative References
[RFC0792] Postel, J., "Internet Control Message Protocol", STD 5, [RFC0792] Postel, J., "Internet Control Message Protocol", STD 5,
RFC 792, September 1981. RFC 792, September 1981.
[RFC1191] Mogul, J. and S. Deering, "Path MTU discovery", RFC 1191, [RFC1191] Mogul, J. and S. Deering, "Path MTU discovery",
November 1990. RFC 1191, November 1990.
[RFC1435] Knowles, S., "IESG Advice from Experience with Path MTU [RFC1435] Knowles, S., "IESG Advice from Experience with Path MTU
Discovery", RFC 1435, March 1993. Discovery", RFC 1435, March 1993.
[RFC1812] Baker, F., "Requirements for IP Version 4 Routers", [RFC1812] Baker, F., "Requirements for IP Version 4 Routers",
RFC 1812, June 1995. RFC 1812, June 1995.
[RFC1858] Ziemba, G., Reed, D., and P. Traina, "Security [RFC1858] Ziemba, G., Reed, D., and P. Traina, "Security
Considerations for IP Fragment Filtering", RFC 1858, Considerations for IP Fragment Filtering", RFC 1858,
October 1995. October 1995.
[RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and [RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G.,
E. Lear, "Address Allocation for Private Internets", and E. Lear, "Address Allocation for Private
BCP 5, RFC 1918, February 1996. Internets", BCP 5, RFC 1918, February 1996.
[RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 [RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version
(IPv6) Specification", RFC 2460, December 1998. 6 (IPv6) Specification", RFC 2460, December 1998.
[RFC2623] Eisler, M., "NFS Version 2 and Version 3 Security Issues [RFC2623] Eisler, M., "NFS Version 2 and Version 3 Security
and the NFS Protocol's Use of RPCSEC_GSS and Kerberos V5", Issues and the NFS Protocol's Use of RPCSEC_GSS and
RFC 2623, June 1999. Kerberos V5", RFC 2623, June 1999.
[RFC2663] Srisuresh, P. and M. Holdrege, "IP Network Address [RFC2663] Srisuresh, P. and M. Holdrege, "IP Network Address
Translator (NAT) Terminology and Considerations", Translator (NAT) Terminology and Considerations",
RFC 2663, August 1999. RFC 2663, August 1999.
[RFC3022] Srisuresh, P. and K. Egevang, "Traditional IP Network [RFC3022] Srisuresh, P. and K. Egevang, "Traditional IP Network
Address Translator (Traditional NAT)", RFC 3022, Address Translator (Traditional NAT)", RFC 3022,
January 2001. January 2001.
[RFC3027] Holdrege, M. and P. Srisuresh, "Protocol Complications [RFC3027] Holdrege, M. and P. Srisuresh, "Protocol Complications
with the IP Network Address Translator", RFC 3027, with the IP Network Address Translator", RFC 3027,
January 2001. January 2001.
[RFC3128] Miller, I., "Protection Against a Variant of the Tiny [RFC3128] Miller, I., "Protection Against a Variant of the Tiny
Fragment Attack (RFC 1858)", RFC 3128, June 2001. Fragment Attack (RFC 1858)", RFC 3128, June 2001.
[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G.,
A., Peterson, J., Sparks, R., Handley, M., and E. Johnston, A., Peterson, J., Sparks, R., Handley, M.,
Schooler, "SIP: Session Initiation Protocol", RFC 3261, and E. Schooler, "SIP: Session Initiation Protocol",
June 2002. RFC 3261, June 2002.
[RFC3489] Rosenberg, J., Weinberger, J., Huitema, C., and R. Mahy, [RFC3424] Daigle, L. and IAB, "IAB Considerations for UNilateral
"STUN - Simple Traversal of User Datagram Protocol (UDP) Self-Address Fixing (UNSAF) Across Network Address
Through Network Address Translators (NATs)", RFC 3489, Translation", RFC 3424, November 2002.
March 2003.
[RFC3489] Rosenberg, J., Weinberger, J., Huitema, C., and R.
Mahy, "STUN - Simple Traversal of User Datagram
Protocol (UDP) Through Network Address Translators
(NATs)", RFC 3489, March 2003.
[RFC3550] Schulzrinne, H., Casner, S., Frederick, R., and V. [RFC3550] Schulzrinne, H., Casner, S., Frederick, R., and V.
Jacobson, "RTP: A Transport Protocol for Real-Time Jacobson, "RTP: A Transport Protocol for Real-Time
Applications", STD 64, RFC 3550, July 2003. Applications", STD 64, RFC 3550, July 2003.
[RFC3424] Daigle, L. and IAB, "IAB Considerations for UNilateral [RFC3605] Huitema, C., "Real Time Control Protocol (RTCP)
Self-Address Fixing (UNSAF) Across Network Address attribute in Session Description Protocol (SDP)",
Translation", RFC 3424, November 2002. RFC 3605, October 2003.
[RFC3605] Huitema, C., "Real Time Control Protocol (RTCP) attribute
in Session Description Protocol (SDP)", RFC 3605,
October 2003.
[RFC4380] Huitema, C., "Teredo: Tunneling IPv6 over UDP through [RFC4380] Huitema, C., "Teredo: Tunneling IPv6 over UDP through
Network Address Translations (NATs)", RFC 4380, Network Address Translations (NATs)", RFC 4380,
February 2006. February 2006.
[I-D.ietf-behave-rfc3489bis] [RFC3489bis] Rosenberg, J., "Simple Traversal Underneath Network
Rosenberg, J., "Simple Traversal Underneath Network Address Translators (NAT) (STUN)", Work in Progress,
Address Translators (NAT) (STUN)", October 2006.
draft-ietf-behave-rfc3489bis-04 (work in progress),
July 2006.
[I-D.ietf-mmusic-ice] [ICE] Rosenberg, J., "Interactive Connectivity Establishment
Rosenberg, J., "Interactive Connectivity Establishment (ICE): A Methodology for Network Address Translator
(ICE): A Methodology for Network Address Translator (NAT) (NAT) Traversal for Offer/Answer Protocols", Work
Traversal for Offer/Answer Protocols", in Progress, October 2006.
draft-ietf-mmusic-ice-11 (work in progress), October 2006.
[I-D.jennings-behave-test-results] [RESULTS] Jennings, C., "NAT Classification Test Results", Work
Jennings, C., "NAT Classification Test Results", in Progress, October 2006.
draft-jennings-behave-test-results-02 (work in progress),
June 2006.
[I-D.ietf-behave-turn] [TURN] Rosenberg, J., "Obtaining Relay Addresses from Simple
Rosenberg, J., "Obtaining Relay Addresses from Simple Traversal Underneath NAT (STUN)", Work in Progress,
Traversal Underneath NAT (STUN)",
draft-ietf-behave-turn-02 (work in progress),
October 2006. October 2006.
[ITU.H323] [ITU.H323] "Packet-based Multimedia Communications Systems", ITU-
"Packet-based Multimedia Communications Systems", ITU-
T Recommendation H.323, July 2003. T Recommendation H.323, July 2003.
Authors' Addresses Authors' Addresses
Francois Audet (editor) Francois Audet (editor)
Nortel Networks Nortel Networks
4655 Great America Parkway 4655 Great America Parkway
Santa Clara, CA 95054 Santa Clara, CA 95054
US US
Phone: +1 408 495 3756 Phone: +1 408 495 2456
Email: audet@nortel.com EMail: audet@nortel.com
Cullen Jennings Cullen Jennings
Cisco Systems Cisco Systems
170 West Tasman Drive 170 West Tasman Drive
MS: SJC-21/2 MS: SJC-21/2
San Jose, CA 95134 San Jose, CA 95134
US US
Phone: +1 408 902 3341 Phone: +1 408 902 3341
Email: fluffy@cisco.com EMail: fluffy@cisco.com
Full Copyright Statement Full Copyright Statement
Copyright (C) The Internet Society (2006). Copyright (C) The IETF Trust (2007).
This document is subject to the rights, licenses and restrictions This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors contained in BCP 78, and except as set forth therein, the authors
retain all their rights. retain all their rights.
This document and the information contained herein are provided on an This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property Intellectual Property
The IETF takes no position regarding the validity or scope of any The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information made any independent effort to identify any such rights. Information
skipping to change at page 29, line 45 skipping to change at page 29, line 45
such proprietary rights by implementers or users of this such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr. http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at this standard. Please address the information to the IETF at
ietf-ipr@ietf.org. ietf-ipr@ietf.org.
Acknowledgment Acknowledgement
Funding for the RFC Editor function is provided by the IETF Funding for the RFC Editor function is currently provided by the
Administrative Support Activity (IASA). Internet Society.
 End of changes. 173 change blocks. 
388 lines changed or deleted 397 lines changed or added

This html diff was produced by rfcdiff 1.33. The latest version is available from http://tools.ietf.org/tools/rfcdiff/