1. GIST NAT traversal and Legacy NAT traversal for GIST http://www.ietf.org/internet-drafts/draft-pashalidis-nsis-gimps-nattraversal-03.txt AND http://www.ietf.org/internet-drafts/draft-pashalidis-nsis-legacy-nattraversal-03.txt A. Pashalidis; H. Tschofenig

2. {Andreas.Pashalidis, Hannes.Tschofenig} @siemens.com NAT Traversal Previous document split in two. GIST NAT Traversal — NAT is GIST-aware Legacy NAT traversal for GIST. — NAT does not know anything about NSIS — Online, but not submitted to IETF yet Reason for splitting: material in one document does not affect material in the other.

3. {Andreas.Pashalidis, Hannes.Tschofenig} @siemens.com GIST NAT Traversal Document (still) covers two approaches: “transparent” and “non-transparent”. Both approaches are compatible with GIST main spec. However, only non-transparent approach makes use of GIST “NAT Traversal” object.

4. {Andreas.Pashalidis, Hannes.Tschofenig} @siemens.com Transparent Approach NAT GIST peer 1 GIST peer 2 1. GIST QUERY 2. TRANSLATE FLOW ID (MRI) according to NAT binding; put NAT IP address in NLI.IA field 3. GIST QUERY (translated) 4. GIST RESPONSE (sent to NLI.IA) 5. TRANSLATE MRI and NLI.IA back to original values 6. GIST RESPONSE (translated) NAT translates IP header, transport layer header, and GIST header of signalling traffic (D-mode and C-mode) in a manner consistent with the data flow NAT binding. NAT does not install a separate “NAT binding” for signalling traffic (translation above suffices) Approach hides internal addresses from public Internet. Approach does not work if IPsec/TLS is used!

5. {Andreas.Pashalidis, Hannes.Tschofenig} @siemens.com Non-transparent Approach NAT GIST peer 1 GIST peer 2 1. GIST QUERY 2. Add NAT Traversal Object 3. GIST QUERY (with NTO) 4. GIST RESPONSE (with NTO) 5. Remove NTO 6. GIST RESPONSE (without NTO) Message 3 contains translated and original MRI, thus peer 2 can map subsequent signalling messages (with untranslated MRI) to data flow. NAT installs “NAT binding” for signalling traffic after RESPONSE is received. NAT does not modify any GIST messages, except QUERY, RESPONSE. Internal addresses exposed on public Internet.

6. {Andreas.Pashalidis, Hannes.Tschofenig} @siemens.com Legacy NAT Traversal for GIST Extension to GIST For now, no changes in message formats required. — Just new behaviour at GIST nodes.

7. {Andreas.Pashalidis, Hannes.Tschofenig} @siemens.com Legacy NAT traversal: NI-side NAT GIST peer 1 GIST peer 2 1. GIST QUERY 2. GIST QUERY 3. GIST RESPONSE 4. GIST RESPONSE Peer 2 detects the NAT and proposes a UDP tunnel Peer 1 detects the NAT and sets up the UDP tunnel Both data traffic and signalling traffic is sent over the tunnel. NAT detected! UDP TUNNEL Do the NAT work… data sig

8. {Andreas.Pashalidis, Hannes.Tschofenig} @siemens.com Legacy NAT traversal: NR-side Work in progress…