RFC 3947
Negotiation of NAT-Traversal in the IKE
RFC 3947: Negotiation of NAT-Traversal in the IKE 🦋
Network Working Group 🌸 Request for Comments: 3947 Category: Standards Track ✨ Date: January 2005
Authors: T. Kivinen (SafeNet), B. Swander (Microsoft), A. Huttunen (F-Secure Corporation), V. Volpe (Cisco Systems)
This title block has no "Obsoletes" or "Updates" line, so nothing is obsoleted or updated here. 💅
Status of this Memo 🌈
Okay so this is an Internet standards track protocol for the whole Internet community, and they're literally asking for discussion and suggestions for improvements 🫶 For the current standardization state and status, check the current edition of "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited. 💖
Copyright Notice ✨
Copyright (C) The Internet Society (2005).
Abstract 🎀
This doc is all about how to spot one or more network address translation devices (NATs) sitting between IPsec hosts, and how to negotiate using UDP encapsulation for IPsec packets so they can get through NAT boxes in Internet Key Exchange (IKE). It's giving problem-solving energy 🔥
Table of Contents 🧚
1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Specification of Requirements . . . . . . . . . . . . . . . . . 3
3. Phase 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
3.1. Detecting Support of NAT-Traversal. . . . . . . . . . . . 4
3.2. Detecting the Presence of NAT . . . . . . . . . . . . . . 4
4. Changing to New Ports . . . . . . . . . . . . . . . . . . . . . 6
5. Quick Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . 8
5.1. Negotiation of the NAT-Traversal Encapsulation. . . . . . 9
5.2. Sending the Original Source and Destination Addresses . . 9
6. Initial Contact Notifications. . . . . . . . . . . . . . . . . 11
7. Recovering from the Expiring NAT Mappings. . . . . . . . . . . 11
8. Security Considerations. . . . . . . . . . . . . . . . . . . . 12
9. IANA Considerations. . . . . . . . . . . . . . . . . . . . . . 13
10. IAB Considerations . . . . . . . . . . . . . . . . . . . . . . 14
11. Acknowledgments. . . . . . . . . . . . . . . . . . . . . . . . 14
12. References . . . . . . . . . . . . . . . . . . . . . . . . . . 14
12.1. Normative References . . . . . . . . . . . . . . . . . . 14
12.2. Informative References . . . . . . . . . . . . . . . . . 14
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 15
Full Copyright Statement . . . . . . . . . . . . . . . . . . . . . 161. Introduction 🌸
So this doc is split into two parts. Part one covers what IKE Phase 1 needs for NAT-Traversal support. That means checking whether the other end supports NAT-Traversal, and checking whether there's one or more NATs between the peers 👀
Part two explains how to negotiate using UDP encapsulated IPsec packets in IKE's Quick Mode. It also covers how to send the original source and destination addresses to the peer, if that's needed. Those addresses get used in transport mode to update the TCP/IP checksums incrementally, so they'll match after the NAT transform. (The NAT can't do this itself, because the TCP/IP checksum is inside the UDP encapsulated IPsec packet.) 🧠
The document [RFC3948] describes the details of UDP encapsulation, and [RFC3715] gives background info and the motivation for NAT-Traversal in general. Put together with [RFC3948], this document is an "unconditionally compliant" solution to the requirements defined by [RFC3715]. Iconic 👑
In the basic scenario for this doc, the initiator is behind NA(P)T, and the responder has a fixed static IP address.
This document defines a protocol that still works even if both ends are behind NAT. How you locate the other end is out of scope, though 🙈 In one scenario, the responder is behind a static host NAT. There's only one responder per IP, because there's no way to use any destination ports other than 500/4500. That means it's known by the configuration.
2. Specification of Requirements 📝
This document shall use the keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED, "MAY", and "OPTIONAL" to describe requirements. They are to be interpreted as described in [RFC2119]. Those are the rules for reading all the big-caps words in here 💅
3. Phase 1 🎀
The detection of NAT-Traversal support, and the detection of NAT along the path between the two IKE peers, happens in IKE [RFC2409] Phase 1.
The NAT may change the IKE UDP source port. Recipients MUST be able to process IKE packets whose source port is different from 500. The NAT doesn't have to change the source port if:
- only one IPsec host is behind the NAT, or
- for the first IPsec host, the NAT can keep the port 500, and the NAT will only change the port number for later connections.
Recipients MUST reply back to the source address from the packet (see [RFC3715], section 2.1, case d). So when the original responder is doing rekeying or sending notifications to the original initiator, it MUST send the packets using the same set of port and IP numbers used when the IKE SA was last used. Main character energy, no notes 🦋
Here's an example. When the initiator sends a packet with source and destination port 500, the NAT may change it to a packet with source port 12312 and destination port 500. The responder must be able to process the packet whose source port is 12312. It must reply back with a packet whose source port is 500 and destination port is 12312. The NAT will then translate this packet to source port 500 and destination port 500. Lowkey chaotic, but it works 🌈
3.1. Detecting Support of NAT-Traversal 🔍
The NAT-Traversal capability of the remote host gets determined by an exchange of vendor ID payloads. In the first two messages of Phase 1, the vendor id payload for this specification MUST be sent if supported (and it MUST be received by both sides) for the NAT-Traversal probe to continue. The content of the payload is the MD5 hash of RFC 3947.
The exact content in hex for the payload is:
4a131c81070358455c5728f20e95452f3.2. Detecting the Presence of NAT 🕵️♀️
The NAT-D payload does two jobs. It detects the presence of NAT between the two IKE peers, and it also detects where the NAT is. The location of the NAT device matters, because the keepalives have to start from the peer "behind" the NAT 💖
To detect NAT between the two hosts, we have to check whether the IP address or the port changes along the path. We do this by sending the hashes of the IP addresses and ports of both IKE peers from each end to the other. If both ends calculate those hashes and get the same result, they know there's no NAT between them. If the hashes don't match, somebody translated the address or port. That means we have to do NAT-Traversal to get IPsec packets through 😭
If the sender of the packet doesn't know its own IP address (say there are multiple interfaces, and the implementation doesn't know which IP address is used to route the packet out), the sender can include multiple local hashes in the packet, as separate NAT-D payloads. In this case, NAT is detected if and only if none of the hashes match.
The hashes get sent as a series of NAT-D (NAT discovery) payloads. Each payload contains one hash, so if there are multiple hashes, multiple NAT-D payloads get sent. In the normal case there are only two NAT-D payloads.
The NAT-D payloads are included in the third and fourth packets of Main Mode, and in the second and third packets in Aggressive Mode.
The format of the NAT-D packet is:
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8
+---------------+---------------+---------------+---------------+
| Next Payload | RESERVED | Payload length |
+---------------+---------------+---------------+---------------+
~ HASH of the address and port ~
+---------------+---------------+---------------+---------------+The payload type for the NAT discovery payload is 20.
The HASH gets calculated like this:
HASH = HASH(CKY-I | CKY-R | IP | Port)This uses the negotiated HASH algorithm. All data inside the HASH is in network byte-order. The IP is 4 octets for an IPv4 address and 16 octets for an IPv6 address. The port number is encoded as a 2 octet number in network byte-order. The first NAT-D payload contains the remote end's IP address and port (i.e., the destination address of the UDP packet). The remaining NAT-D payloads contain possible local-end IP addresses and ports (i.e., all possible source addresses of the UDP packet).
If there's no NAT between the peers, the first NAT-D payload received should match one of the local NAT-D payloads (i.e., the local NAT-D payloads this host is sending out). One of the other NAT-D payloads must match the remote end's IP address and port. If the first check fails (i.e., the first NAT-D payload doesn't match any of the local IP addresses and ports), it means there's dynamic NAT between the peers, and this end should start sending keepalives as defined in [RFC3948] (this end is behind the NAT). Ngl, this is the part where you start sending keepalives 🫶
The CKY-I and CKY-R are the initiator and responder cookies. They're added to the hash to make precomputation attacks for the IP address and port impossible 🔐
Here's an example of a Phase 1 exchange using NAT-Traversal in Main Mode (authentication with signatures):
Initiator Responder
------------ ------------
HDR, SA, VID -->
<-- HDR, SA, VID
HDR, KE, Ni, NAT-D, NAT-D -->
<-- HDR, KE, Nr, NAT-D, NAT-D
HDR*#, IDii, [CERT, ] SIG_I -->
<-- HDR*#, IDir, [CERT, ], SIG_RAnd here's a Phase 1 exchange using NAT-Traversal in Aggressive Mode (authentication with signatures):
Initiator Responder
------------ ------------
HDR, SA, KE, Ni, IDii, VID -->
<-- HDR, SA, KE, Nr, IDir,
[CERT, ], VID, NAT-D,
NAT-D, SIG_R
HDR*#, [CERT, ], NAT-D, NAT-D,
SIG_I -->The # sign indicates that those packets are sent to the changed port if NAT is detected. 🦋
4. Changing to New Ports ✨
okay so IPsec-aware NATs can cause problems 😭 (see [RFC3715], section 2.3). some NATs won't change the IKE source port 500 even when there are multiple clients behind them 💀 (see [RFC3715], section 2.3, case n). others use IKE cookies to sort traffic instead of the source port 🙈 (see [RFC3715], section 2.3, case m). both of these are a mess for generic NAT transparency, because it's really hard for IKE to figure out what the NAT can do. the best move is to get IKE traffic off port 500 asap so no IPsec-aware NAT has to do special casing 🫶
take the common case where the initiator is behind the NAT. the initiator needs to hop over to port 4500 quickly once the NAT is detected, so the window for IPsec-aware NAT problems stays tiny 🦋
in Main Mode, the initiator MUST change ports when it sends the ID payload if there's NAT between the hosts 🌸 the initiator MUST set both the UDP source and destination ports to 4500 💖 every packet sent to this peer after that (including informational notifications) MUST go out on port 4500 ✨ on top of that, the IKE data MUST get a non-ESP marker in front so traffic can be demultiplexed, as defined in [RFC3948] 🎀
so the IKE packet ends up looking like this:
IP UDP(4500,4500) <non-ESP marker> HDR*, IDii, [CERT, ] SIG_Ithis assumes authentication with signatures. the 4 bytes of non-ESP marker are defined in [RFC3948] 🧚
when the responder gets this packet, it does the usual decryption and processing of the payloads 👑 if all of that works out, the responder MUST update its local state so every later packet (including informational notifications) to this peer uses the new port, and maybe the new IP address from the valid incoming packet 💅 the port will usually be different, since the NAT maps UDP(500,500) to UDP(X,500) and UDP(4500,4500) to UDP(Y,4500) 🌈 the IP address will rarely be different from the one before the change ✨ the responder MUST reply to all later IKE packets to this peer using UDP(4500,Y) 💜
same deal if the responder has to rekey the Phase 1 SA 🔥 the rekey negotiation MUST start using UDP(4500,Y). any implementation that supports NAT traversal MUST support negotiations that begin on port 4500 🙌 if a negotiation starts on port 4500, it doesn't need to change anywhere else in the exchange 🍓
once the port change has happened, a packet that shows up on port 500 is old news 💀 if it's an informational packet, it MAY be processed if local policy allows it 🙈 if it's a Main Mode or Aggressive Mode packet (with the same cookies as earlier packets), it SHOULD be discarded 🗑️ if it's a brand new Main Mode or Aggressive exchange, it gets processed normally, because the other end might have rebooted and is just starting a fresh exchange 🔄
here's an example of a Phase 1 exchange using NAT-Traversal in Main Mode (authentication with signatures) with a port change 🎀
Initiator Responder
------------ ------------
UDP(500,500) HDR, SA, VID -->
<-- UDP(500,X) HDR, SA, VID
UDP(500,500) HDR, KE, Ni,
NAT-D, NAT-D -->
<-- UDP(500,X) HDR, KE, Nr,
NAT-D, NAT-D
UDP(4500,4500) HDR*#, IDii,
[CERT, ]SIG_I -->
<-- UDP(4500,Y) HDR*#, IDir,
[ CERT, ], SIG_RAggressive Mode works in a very similar way 🦋 after the NAT is detected, the initiator sends IP UDP(4500,4500) <4 bytes of non-ESP marker> HDR*, [CERT, ], NAT-D, NAT-D, and SIG_I. the responder does similar processing to the above, and if it works, the responder MUST update its internal IKE ports 💅 it MUST also reply to all later IKE packets to this peer using UDP(4500,Y) 💖
Initiator Responder
------------ ------------
UDP(500,500) HDR, SA, KE,
Ni, IDii, VID -->
<-- UDP(500,X) HDR, SA, KE,
Nr, IDir, [CERT, ],
VID, NAT-D, NAT-D,
SIG_R
UDP(4500,4500) HDR*#, [CERT, ],
NAT-D, NAT-D,
SIG_I -->
<-- UDP(4500, Y) HDR*#, ...if NAT-Traversal support is enabled, the port in the ID payload in Main Mode/Aggressive Mode MUST be set to 0 🙈
the most common responder-behind-NAT case is when the NAT is just doing 1:1 address translation 🌷 in that case the initiator still changes both ports to 4500 ✨ the responder uses the same algorithm as above, except Y will equal 4500 here, since no port translation is happening 🧚
there's also a different port-change case involving out-of-band discovery of which ports to use 🌈 those discovery methods are out of scope for this document 🙅 for example, if the responder is behind a port-translating NAT and the initiator has to contact it first, the initiator has to figure out which ports to use, usually by asking some other server 🔍 once the initiator knows which ports will get it through the NAT, generally something like UDP(Z,4500), it starts up using those ports 🚀 this is kind of like the responder rekey case, since the ports are already known up front and nothing else has to change 💜 also, the first keepalive timer starts after the switch to the new port, and no keepalives get sent to port 500 💅
5. Quick Mode 🌸
after Phase 1, both ends know whether a NAT is sitting between them 👀 the final call on using NAT-Traversal is left to Quick Mode 🫶 NAT-Traversal gets negotiated inside the SA payloads of Quick Mode 💖 in Quick Mode, both ends can also send the original addresses of the IPsec packets (in the case of transport mode) to the other end, so each side can fix the TCP/IP checksum field after the NAT transformation 🎀
5.1. Negotiation of the NAT-Traversal Encapsulation ✨
NAT-Traversal negotiation works by adding two new encapsulation modes 🦋 they are:
UDP-Encapsulated-Tunnel 3
UDP-Encapsulated-Transport 4it's not usually useful to propose both normal tunnel or transport mode AND the UDP-Encapsulated modes 🙅 UDP encapsulation is required to fix the inability of NATs to handle non-UDP/TCP traffic (see [RFC3715], section 2.2, case i) 🔥
if there's a NAT box between the hosts, normal tunnel or transport encapsulation may not work 😬 in that case, UDP-Encapsulation SHOULD be used 💅
if there's no NAT box between them, there's no point wasting bandwidth on UDP encapsulation 🙄 so UDP-Encapsulation SHOULD NOT be used 🚫
also, the initiator SHOULD NOT include both normal tunnel or transport mode AND UDP-Encapsulated-Tunnel or UDP-Encapsulated-Transport in its proposals 🌈
5.2. Sending the Original Source and Destination Addresses 💜
so for incremental TCP checksum updates, both peers may need to know the original IP addresses their peers used when they built the packet (see [RFC3715], section 2.1, case b) 🧚 for the initiator, the original Initiator address is defined as the Initiator's IP address 💖 the original Responder address is defined as the perceived peer's IP address 🙈 for the responder, the original Initiator address is defined as the perceived peer's address 🌸 and the original Responder address is defined as the Responder's IP address ✨
the original addresses get sent using NAT-OA (NAT Original Address) payloads 🎀
the Initiator NAT-OA payload goes first, and the Responder NAT-OA payload goes second 👑
Example 1:
Initiator <---------> NAT <---------> Responder
^ ^ ^
Iaddr NatPub Raddrthe initiator is behind a NAT talking to a publicly available responder 🌷 the initiator and responder have the IP addresses Iaddr and Raddr 💫 the NAT has the public IP address NatPub 🏠
Initiator:
NAT-OAi = Iaddr
NAT-OAr = RaddrResponder:
NAT-OAi = NATPub
NAT-OAr = RaddrExample 2:
Initiator <------> NAT1 <---------> NAT2 <-------> Responder
^ ^ ^ ^
Iaddr Nat1Pub Nat2Pub Raddrhere NAT2 "publishes" Nat2Pub for the Responder and forwards all traffic going to that address over to the Responder 📡
Initiator:
NAT-OAi = Iaddr
NAT-OAr = Nat2PubResponder:
NAT-OAi = Nat1Pub
NAT-OAr = Raddrin transport mode, both ends MUST send both the original Initiator and Responder addresses to the other end 💅 in tunnel mode, both ends SHOULD NOT send the original addresses to the other end 🙅
the NAT-OA payloads ride inside the first and second packets of Quick Mode 🚀 the initiator MUST send the payloads if it proposes any UDP-Encapsulated-Transport mode 💖 the responder MUST send the payload only if it selected UDP-Encapsulated-Transport mode 🎀 it's possible for the initiator to send the NAT-OA payload but propose both UDP-Encapsulated transport and tunnel mode 🤷 in that case the responder selects UDP-Encapsulated tunnel mode and doesn't send the NAT-OA payload back 🌈
the format of the NAT-OA packet is:
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8
+---------------+---------------+---------------+---------------+
| Next Payload | RESERVED | Payload length |
+---------------+---------------+---------------+---------------+
| ID Type | RESERVED | RESERVED |
+---------------+---------------+---------------+---------------+
| IPv4 (4 octets) or IPv6 address (16 octets) |
+---------------+---------------+---------------+---------------+the payload type for the NAT original address payload is 21 🔢
the ID type is defined in [RFC2407] 📖 only the ID_IPV4_ADDR and ID_IPV6_ADDR types are allowed 🙌 the two reserved fields after the ID Type must be zero 🫶
here's an example of Quick Mode using NAT-OA payloads 🎀
Initiator Responder
------------ ------------
HDR*, HASH(1), SA, Ni, [, KE]
[, IDci, IDcr ]
[, NAT-OAi, NAT-OAr] -->
<-- HDR*, HASH(2), SA, Nr, [, KE]
[, IDci, IDcr ]
[, NAT-OAi, NAT-OAr]
HDR*, HASH(3) -->6. Initial Contact Notifications 🧚
okay the source IP and port address of the INITIAL-CONTACT notification for a host behind a NAT aren't meaningful, because the NAT can change them 🙈 so the IP and port numbers MUST NOT be used to decide which IKE/IPsec SAs to remove (see [RFC3715], section 2.1, case c) 🚫 the ID payload sent from the other end SHOULD be used instead 💖 that means when an INITIAL-CONTACT notification comes in from the other end, the receiving end SHOULD remove all the SAs associated with the same ID payload 🌸✨
7. Recovering from the Expiring NAT Mappings ✨
Okay so, sometimes the NAT box just decides to delete mappings that are still alive 😭 Maybe the keepalive interval is too long, or the NAT box got rebooted. To recover, ends that are not behind NAT SHOULD use the last valid UDP encapsulated IKE or IPsec packet from the other end to figure out which IP and port addresses to use 🫶. The host behind dynamic NAT MUST NOT do this, because that opens a DoS attack possibility. The IP address or port of the other host won't change, since it isn't behind NAT 🙈
Keepalives can't be used for this, because they aren't authenticated. But any authenticated IKE packet or ESP packet can be used to detect whether the IP address or the port has changed. Authenticated packets only, bestie 💅
8. Security Considerations 🔥
Whenever someone wants to change a fundamental part of a security protocol, we absolutely cannot skip looking at the security implications. So here are some observations about the effects, and whether those effects actually matter 👑
- IKE probes reveal NAT-Traversal support to anyone watching the traffic. Disclosing that NAT-Traversal is supported does not introduce new vulnerabilities 👀
- The value of authentication mechanisms based on IP addresses disappears once NATs are in the picture. That is not necessarily a bad thing (for any real security, authentication measures other than IP addresses should be used). This means that authentication with pre-shared keys cannot be used in Main Mode without using group-shared keys for everybody behind the NAT box. Using group shared keys is a huge risk 🚨 because it allows anyone in the group to authenticate to any other party and claim to be anybody in the group. For example, a normal user could impersonate a vpn-gateway and act as a man in the middle, and read/modify all traffic to/from others in the group. Use of group-shared keys is NOT RECOMMENDED. Please don't do it 💀
- As the internal address space is only 32 bits and is usually very sparse, it might be possible for the attacker to find out the internal address used behind the NAT box by trying all possible IP-addresses to find the matching hash. The port numbers are normally fixed to 500, and the cookies can be extracted from the packet. This limits the hash calculations to
2^32. If an educated guess of the private address space is made, then the number of hash calculations needed to find out the internal IP address goes down to2^24 + 2 * (2^16)😬 - Neither NAT-D payloads nor Vendor ID payloads are authenticated in Main Mode nor in Aggressive Mode. This means that an attacker can remove those payloads, modify them, or add them. By removing or adding them, the attacker can cause Denial of Service attacks. By modifying the NAT-D packets, the attacker can cause both ends to use UDP-Encapsulated modes instead of directly using tunnel or transport mode, thus wasting some bandwidth 🥲
- Sending the original source address in the Quick Mode reveals the internal IP address behind the NAT to the other end. In this case we have already authenticated the other end, and sending the original source address is only needed in transport mode 🎀
- Updating the IKE SA/ESP UDP encapsulation IP addresses and ports for each valid authenticated packet can cause DoS if an attacker can listen to all traffic in the network, change the order of the packets, and inject new packets before the packet they have already seen. In other words, the attacker can take an authenticated packet from the host behind NAT, change the packet UDP source or destination ports or IP addresses, and send it out to the other end before the real packet reaches it. The host not behind the NAT will update its IP address and port mapping and send further traffic to the wrong host or port. This situation is fixed immediately when the attacker stops modifying the packets, as the first real packet will fix the situation. Implementations SHOULD AUDIT the event every time the mapping is changed, as it should not happen that often 🚩
9. IANA Considerations 🧚
This document contains two new "magic numbers" allocated from the existing IANA registry for IPsec, and renames existing registered port 4500. This document also defines 2 new payload types for IKE 💜
The following are new items that have been added in the "Internet Security Association and Key Management Protocol (ISAKMP) Identifiers" Encapsulation Mode registry:
Name Value Reference
---- ----- ---------
UDP-Encapsulated-Tunnel 3 [RFC3947]
UDP-Encapsulated-Transport 4 [RFC3947]Change in the registered port registry:
Keyword Decimal Description Reference
------- ------- ----------- ---------
ipsec-nat-t 4500/tcp IPsec NAT-Traversal [RFC3947]
ipsec-nat-t 4500/udp IPsec NAT-Traversal [RFC3947]New IKE payload numbers need to be added to the Next Payload Types registry:
NAT-D 20 NAT Discovery Payload
NAT-OA 21 NAT Original Address Payload10. IAB Considerations 🌸
The UNSAF [RFC3424] questions are addressed by the IPsec-NAT compatibility requirements document [RFC3715].
11. Acknowledgments 🫶
Thanks to Markus Stenberg, Larry DiBurro, and William Dixon, who contributed actively to this document 🙌
Thanks to Tatu Ylonen, Santeri Paavolainen, and Joern Sierwald, who contributed to the document used as the base for this document ✨
12. References 📚
12.1. Normative References
[RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange
(IKE)", RFC 2409, November 1998.
[RFC2407] Piper, D., "The Internet IP Security Domain of
Interpretation for ISAKMP", RFC 2407, November 1998.
[RFC3948] Huttunen, A., Swander, B., Volpe, V., DiBurro, L., and M.
Stenberg, "UDP Encapsulation of IPsec Packets", RFC 3948,
January 2005.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.12.2. Informative References
[RFC3715] Aboba, B. and W. Dixon, "IPsec-Network Address Translation
(NAT) Compatibility Requirements", RFC 3715, March 2004.
[RFC3424] Daigle, L. and IAB, "IAB Considerations for UNilateral
Self-Address Fixing (UNSAF) Across Network Address
Translation", RFC 3424, November 2002.Authors' Addresses 🦋
Tero Kivinen
SafeNet, Inc.
Fredrikinkatu 47
FIN-00100 HELSINKI
Finland
EMail: kivinen@safenet-inc.com
Ari Huttunen
F-Secure Corporation
Tammasaarenkatu 7,
FIN-00181 HELSINKI
Finland
EMail: Ari.Huttunen@F-Secure.com
Brian Swander
Microsoft
One Microsoft Way
Redmond, WA 98052
USA
EMail: briansw@microsoft.com
Victor Volpe
Cisco Systems
124 Grove Street
Suite 205
Franklin, MA 02038
USA
EMail: vvolpe@cisco.comFull Copyright Statement ⭐
Copyright (C) The Internet Society (2005).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🧠
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. Nor does it represent that it has made any independent effort to identify any such rights. Information on the IETF's procedures with respect to rights in IETF Documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification, can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
Acknowledgement 💖
Funding for the RFC Editor function is currently provided by the Internet Society 🎉
📦 where this page comes from
- ietf: rfc3947 2005-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms