nat firewalls and ipv6 christian huitema architect windows networking microsoft corporation l.
Download
Skip this Video
Loading SlideShow in 5 Seconds..
NAT, firewalls and IPv6 Christian Huitema Architect, Windows Networking Microsoft Corporation PowerPoint Presentation
Download Presentation
NAT, firewalls and IPv6 Christian Huitema Architect, Windows Networking Microsoft Corporation

Loading in 2 Seconds...

play fullscreen
1 / 23

NAT, firewalls and IPv6 Christian Huitema Architect, Windows Networking Microsoft Corporation - PowerPoint PPT Presentation


  • 529 Views
  • Uploaded on

NAT, firewalls and IPv6 Christian Huitema Architect, Windows Networking Microsoft Corporation 4255551212 What We Have Done So Far Released Windows XP Windows Messenger and rich APIs Progressed embedded End-to-end platform Announced update PC-to-phone provider choice & new UI

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'NAT, firewalls and IPv6 Christian Huitema Architect, Windows Networking Microsoft Corporation' - jaden


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
what we have done so far

4255551212

What We Have Done So Far
  • Released Windows XP
    • Windows Messenger and rich APIs
  • Progressed embedded
    • End-to-end platform
  • Announced update
    • PC-to-phone provider choice & new UI
nat firewalls and ipv6
NAT, Firewalls and IPv6
  • Issue
    • RTC requires “peer-to-peer” UDP for “media”, TCP for application sharing.
    • Firewalls and NAT block UDP, incoming TCP.
  • Adopting RTC in the home
    • Requires a NAT solution
  • Adopting RTC in the enterprise
    • Requires a firewall solution
  • IPv6 helps solving both problems!
what is network address translation nat

Internet

What Is Network Address Translation (NAT)?
  • Multiplexes IPv4 address space behind NAT – Internet gateway
  • Edits source address & ports in IP traffic
    • All network traffic leaving public side of the NAT appears tp originate from one IP address

192.168.0.2

157.55.0.1

192.168.0.3

192.168.0.1

Issue: breaks many

services / apps

overcoming nat to date
Overcoming NAT: To-Date
  • User: manual configuration
    • Most users not comfortable with this
    • Leads to customer dissatisfaction
    • Drives support calls & increased support cost
    • Inhibits trying new things
    • An issue for DSL & cable modem providers and retailers
  • IG vendor: Application layer gateways
    • One-off developments by device vendor
    • Doesn’t scale well to many apps & updates
upnp nat traversal a better way
UPnP™ NAT Traversal: A Better Way
  • Program NAT device via Universal Plug and Play (UPnP™)
  • Internet Gateway Device Working Committee defined schema for gateways
    • Includes method for automatically creating and removing port mappings
industry adoption of upnp nat support in gateways
Industry Adoption of UPnP™ NAT Support in Gateways
  • Leading vendors announced support
    • Available 2H 2001
  • PC with Windows XP
    • can be Internet gateway device OR
    • can work with other IG
  • UPnP™ support to become market requirement for IGcategory
address shortage causes more nat deployment
Address Shortage Causes More NAT Deployment

Extrapolating the number of DNS registered addresses shows total exhaustion in 2009. But in practice, the “H-ratio” of log10(addresses)/bits reaches 0.26 in 2002.

in the medium term we cannot program all nats
In the medium term, we cannot program all NATs

Internet

?

PC

UPNP

NAT

NAT

home

ISP

By 2002, we will see ISP using layers of NAT.

In fact, we see it in Asia and Europe now…

We need IPv6 before that!

we need ipv6 to change the internet
We need IPv6, to change the Internet
  • Addresses are the key
    • Scarcity: the user is a “client”
    • Plethora: the user is a “peer”
  • IPv6 provide enough addressing
    • 64+64 format: 1.8E+19 networks, units
    • assuming IPv4 efficiency: 1E+16 networks, 1 million networks per human
    • 2 networks per sqft of Earth (20 per m2)
  • This enables peer-to-peer!
example multiparty conference using ipv6
Example: Multiparty Conference, using IPv6

P1

P2

  • With a NAT:
    • Brittle “workaround”.
  • With IPv6:
    • Just use IPv6 addresses

Home LAN

Home LAN

Internet

Home

Gateway

Home

Gateway

P3

how to cope with firewalls
How to cope with Firewalls?
  • Issue
    • RTC requires “peer-to-peer” UDP for “media”, TCP for application sharing.
    • Firewalls block UDP, incoming TCP.
  • Classic solutions don’t work well:
    • Proxies are costly to deploy, generate additional latency and network complexity.
    • Application Layer Gateways prohibit encryption of signalling, create dependencies, prevent evolution.
preferred solution firewall control protocol fcp
Preferred Solution: Firewall Control Protocol (FCP)

Enterprisenetwork

Firewall

Internet

Media

SIP

Port 5060

SIP

Proxy

Firewall

Control Protocol

Work in progress: IETF “MIDCOM”, industry

firewall traversal ipv6
Firewall traversal & IPv6
  • Simpler configuration
    • Same view of addresses, inside and outside
  • More robust
    • Same view of addresses by multiple firewalls
  • Better security
    • Can use IP Security “end to end”
if ipv6 is so great how come it is not there yet
If IPv6 is so great, how come it is not there yet?
  • Applications
    • Need upfront investment, stacks, etc.
    • Similar to Y2K, 32 bit vs. “clean address type”
  • Network
    • Need to ramp-up investment
    • No “push-button” transition

networks

?

applications

ipv6 deployment tool box
IPv6 deployment tool-box
  • IPv6 stateless address autoconfiguration
    • Router announces a prefix, client configures an address
  • 6to4: Automatic tunneling of IPv6 over IPv4
    • Derives IPv6 /48 network prefix from IPv4 global address
  • Shipworm: Automatic tunneling of IPv6 over UDP/IPv4
    • Works through NAT, may be blocked by firewalls
  • ISATAP: Automatic tunneling of IPv6 over IPv4
    • For use behind a firewall.
6to4 tunnel ipv6 over ipv4
6to4: tunnel IPv6 over IPv4

1.2.3.4

192.88.99.1

2002:102:304::b…

3001:2:3:4:c…

6to4-A

Relay

C

A

Native IPv6

IPv4 Internet

  • 6to4 router derive IPv6 prefix from IPv4 address,
  • 6to4 relays advertise reachability of prefix 2002::/16
  • Automatic tunneling from 6to4 routers or relays
  • Single address (192.88.99.1) for all relays

2002:506:708::b…

B

Relay

6to4-B

5.6.7.8

192.88.99.1

isatap ipv6 behind firewall
ISATAP router provides IPv6 prefix

Host complements prefix with IPv4 address

Direct tunneling between ISATAP hosts

Relay through ISATAP router to IPv6 local or global

ISATAP: IPv6 behind firewall

D

IPv4

Internet

IPv6

Internet

IPv4 FW

IPv6 FW

ISATAP

Firewalled

IPv4

network

Local

“native”

IPv6

network

B

C

A

shipworm ipv6 through nat
Shipworm: IPv6 / UDP

IPv6 prefix: IP address & UDP port

Shipworm servers

Address discovery

Default “route”

Enable “shortcut” (A-B)

Shipworm relays

Send IPv6 packets directly to nodes

Works for all NAT

Shipworm: IPv6 through NAT

C

IPv6 Internet

Relay

IPv4 Internet

Server

NAT

NAT

A

B

when can we get ipv6

2000

2001

2002

When can we get IPv6?

Tech. Preview (W2K)

Developers (Windows XP)

Deployment

Now!

more information on ipv6
More Information on IPv6
  • Microsoft IPv6 web site:
    • http://www.microsoft.com/ipv6/
  • IETF standards
    • IPv6 specification,
    • IPv6 transition tools.
call to action
Call to Action
  • Apply UPnP technology to NAT traversal
    • www.upnp.org
  • Work on the Firewall Traversal Protocol
  • Start porting applications to IPv6
    • Use IPv6 stack in Windows XP
  • Start deploying IPv6 now!