rfc3027.txt

RFC3027:Protocol Complications with the IP Network Address Translator


RFC 3027            Protocol Complications with NAT         January 2001


   in detail.  If DNS packets are encrypted/authenticated per DNSSEC,
   then DNS_ALG will fail because it won't be able to perform payload
   modifications.

   Applications using DNS resolver to resolve a DNS name into an IP
   address, assume availability of address assignment for reuse by the
   application specific session.  As a result, DNS-ALG will be required
   to keep the address assignment (between private and external
   addresses) valid for a pre-configured period of time, past the DNS
   query.

   Alternately, if there isn't a need for a name server within private
   domain, private domain hosts could simply point to an external name
   server for external name lookup.  No ALG is required when the name
   server is located in external domain.

4.4 SMTP

   SMTP is a TCP based protocol ([SMTP]), used by Internet email
   programs such as sendmail to send TCP-based email messages to well-
   known port 25.  The mail server may be located within or outside
   private domain.  But, the server must be assigned a global name and
   address, accessible by external hosts.  When mail server is located
   within private domain, inbound SMTP sessions must be redirected to
   the private host from its externally assigned address.  No special
   mapping is required when Mail server is located in external domain.

   Generally speaking, mail systems are configured such that all users
   specify a single centralized address (such as [e-mail]),
   instead of including individual hosts (such as
   [e-mail]).  The central address must have an MX
   record specified in the DNS name server accessible by external hosts.

   In the majority of cases, mail messages do not contain reference to
   private IP addresses or links to content data via names that are not
   visible to outside.  However, some mail messages do contain IP
   addresses of the MTAs that relay the message in the "Received: "
   field.  Some mail messages use IP addresses in place of FQDN for
   debug purposes or due to lack of a DNS record, in "Mail From: "
   field.

   If one or more MTAs were to be located behind NAT in a private
   domain, and the mail messages are not secured by signature or
   cryptographic keys, an SMTP-ALG may be used to translate the IP
   address information registered by the MTAs.  If the MTAs have static
   address mapping, the translation would be valid across realms for
   long periods of time.




Holdrege & Srisuresh         Informational                     [Page 11]

RFC 3027            Protocol Complications with NAT         January 2001


   The ability to trace the mail route may be hampered or prevented by
   NAT alone, without the ALG.  This can cause problems when debugging
   mail problems or tracking down abusive users of mail.

4.5 SIP

   SIP (Refer [SIP]) can run on either TCP or UDP, but by default on the
   same port 5060.

   When used with UDP, a response to a SIP request does not go to the
   source port the request came from.  Rather the SIP message contains
   the port number the response should be sent to.  SIP makes use of
   ICMP port unreachable errors in the response to request
   transmissions.  Request messages are usually sent on the connected
   socket.  If responses are sent to the source port in the request,
   each thread handling a request would have to listen on the socket it
   sent the request on.  However, by allowing responses to come to a
   single port, a single thread can be used for listening instead.

   A server may prefer to place the source port of each connected socket
   in the message.  Then each thread can listen for responses
   separately.  Since the port number for a response may not go to the
   source port of the request, SIP will not normally traverse a NAT and
   would require a SIP-ALG.

   SIP messages carry arbitrary content, which is defined by a MIME
   type.  For multimedia sessions, this is usually the Session
   Description Protocol (SDP RFC 2327).  SDP may specify IP addresses or
   ports to be used for the exchange of multimedia.  These may loose
   significance when traversing a NAT.  Thus a SIP-ALG would need the
   intelligence to decipher and translate realm-relevant information.

   SIP carries URL's in its Contact, To and From fields that specify
   signaling addresses.  These URL's can contain IP addresses or domain
   names in the host port portion of the URL.  These may not be valid
   once they traverse a NAT.

   As an alternative to an SIP-ALG, SIP supports a proxy server which
   could co-reside with NAT and function on the globally significant NAT
   port.  Such a proxy would have a locally specific configuration.

4.6 RealAudio

   In default mode, RealAudio clients (say, in a private domain) access
   TCP port 7070 to initiate conversation with a real-audio server (say,
   located an external domain) and to exchange control messages during
   playback (ex: pausing or stopping the audio stream).  Audio session
   parameters are embedded in the TCP control session as byte stream.



Holdrege & Srisuresh         Informational                     [Page 12]

RFC 3027            Protocol Complications with NAT         January 2001


   The actual audio traffic is carried in the opposite direction on
   incoming UDP based packets (originated from the server) directed to
   ports in the range of 6970-7170.

   As a result, RealAudio is broken by default on a traditional NAT
   device.  A work around for this would be for the ALG to examine the
   TCP traffic to determine the audio session parameters and selectively
   enable inbound UDP sessions for the ports agreed upon in the TCP
   control session.  Alternately, the ALG could simply redirect all
   inbound UDP sessions directed to ports 6970-7170 to the client
   address in the private domain.

   For bi-Directional NAT, you will not need an ALG.  Bi-directional NAT
   could simply treat each of the TCP and UDP sessions as 2 unrelated
   sessions and perform IP and TCP/UDP header level translations.

   The readers may contact RealNetworks for detailed guidelines on how
   their applications can be made to work, traversing through NAT and
   firewall devices.

4.7 H.323

   H.323 is complex, uses dynamic ports, and includes multiple UDP
   streams.  Here is a summary of the relevant issues:

   An H.323 call is made up of many different simultaneous connections.
   At least two of the connections are TCP.  For an audio-only
   conference, there may be up to 4 different UDP 'connections' made.

   All connections except one are made to ephemeral (dynamic) ports.

   Calls can be initiated from the private as well as the external
   domain.  For conferencing to be useful, external users need to be
   able to establish calls directly with internal users' desktop
   systems.

   The addresses and port numbers are exchanged within the data stream
   of the 'next higher' connection.  For example, the port number for
   the H.245 connection is established within the Q.931 data stream.
   (This makes it particularly difficult for the ALG, which will be
   required to modify the addresses inside these data streams.)  To make
   matters worse, it is possible in Q.931, for example, to specify that
   the H.245 connection should be secure (encrypted).  If a session is
   encrypted, it is impossible for the ALG to decipher the data stream,
   unless it has access to the shared key.

   Most of the control information is encoded in ASN.1 (only the User-
   User Information within Q.931 Protocol Data Units, or PDUs, is



Holdrege & Srisuresh         Informational                     [Page 13]

RFC 3027            Protocol Complications with NAT         January 2001


   ASN.1-encoded (other parts of each Q.931 PDU are not encoded).  For
   those unfamiliar with ASN.1, suffice it to say that it is a complex
   encoding scheme, which does not end up with fixed byte offsets for
   address information.  In fact, the same version of the same
   application connecting to the same destination may negotiate to
   include different options, changing the byte offsets.

   Below is the protocol exchange for a typical H.323 call between User
   A and User B.  A's IP address is 88.88.88.88 and B's IP address is
   99.99.99.99.  Note that the Q.931 and H.245 messages are encoded in
   ASN.1 in the payload of an RTP packet.  So to accomplish a connection
   through a NAT device, an H.323-ALG will be required to examine the
   packet, decode the ASN.1, and translate the various H.323 control IP
   addresses.

   User A                                                  User B
         A establishes connection to B on well-
         known Q.931 port (1720)

         ----------------------------------------------->
         Q.931 Setup caller address = 88.88.88.88
                     caller port    = 1120
                     callee address = 99.99.99.99
                     callee port    = 1720
         <-----------------------------------------------
         Q.931 Alerting
         <-----------------------------------------------
         Q.931 Connect H.245 address = 99.99.99.99
                       H.245 port    = 1092

         User A establishes connection to User B at
         99.99.99.99, port 1092

         <---------------------------------------------->
         Several H.245 messages are exchanged (Terminal
         Capability Set, Master Slave Determination and
         their respective ACKs)

         <-----------------------------------------------
         H.245 Open Logical Channel, channel = 257
                   RTCP address = 99.99.99.99
                   RTCP port    = 1093
         ----------------------------------------------->
         H.245 Open Logical Channel Ack, channel = 257
                   RTP address = 88.88.88.88
                   RTP port    = 2002
                   (This is where User A would like RTP
                    data sent to)



Holdrege & Srisuresh         Informational                     [Page 14]

RFC 3027            Protocol Complications with NAT         January 2001


                   RTCP address = 88.88.88.88
                   RTCP port    = 2003
         ----------------------------------------------->
         H.245 Open Logical Channel, channel = 257
                   RTCP address = 88.88.88.88
                   RTCP port    = 2003
         <-----------------------------------------------
         H.245 Open Logical Channel Ack, channel = 257
                   RTP address = 99.99.99.99
                   RTP port    = 1092
                   (This is where User B would like RTP data
                    sent to)
                   RTCP address = 99.99.99.99
                   RTP port     = 1093

   Also note that if an H.323 Gateway resided inside a NAT boundary, the
   ALG would have to be cognizant of the various gateway discovery
   schemes and adapt to those schemes as well.  Or if just the H.323
   host/terminal was inside the NAT boundary and tried to register with
   a Gatekeeper, the IP information in the registration messages would
   have to be translated by NAT.

4.8 SNMP

   SNMP is a network management protocol based on UDP.  SNMP payload may
   contain IP addresses or may refer IP addresses through an index into
   a table.  As a result, when devices within a private network are
   managed by an external node, SNMP packets transiting a NAT device may
   contain information that is not relevant in external domain.  In some
   cases, as described in [SNMP-ALG], an SNMP ALG may be used to
   transparently convert realm-specific addresses into globally unique
   addresses.  Such an ALG assumes static address mapping and bi-
   directional NAT.  It can only work for the set of data types (textual
   conventions) understood by the SNMP-ALG implementation and for a
   given set of MIB modules.  Furthermore, replacing IP addresses in the
   SNMP payload may lead to communication failures due to changes in
   message size or changes in the lexicographic ordering.

   Making SNMP ALGs completely transparent to all management
   applications is not an achievable task.  The ALGs will run into
   problems with SNMPv3 security features, when authentication (and
   optionally privacy) is enabled, unless the ALG has access to security
   keys.  [NAT-ARCH] also hints at potential issues with SNMP management
   via NAT.

   Alternately,  SNMP proxies, as defined in [SNMP-APPL], may be used in
   conjunction with NAT to forward SNMP messages to external SNMP
   engines (and vice versa).  SNMP proxies are tailored to the private



Holdrege & Srisuresh         Informational                     [Page 15]