Re: NAT Traversal

[Tero Kivinen <kivinen@ssh.fi>]

Chinna N.R. Pellacuru writes:
> And you seem to suggest that this bandwidth that is being used for IKE NAT
> keeplives should not be charged by an ISP.

Why not. I didn't say anything about that. Firstly the bandwidth used
by them is neglitable. Secondly the user sending those packet can
configure them with suitable timeout that the nat box still support.
Thirdly the user sending them can also put the TTL of those packet so
low that they will only reach the NAT box not the box behind that.

> Why should an ISP bear such an abuse of their bandwidth, that they cannot
> charge for? Particulary if you consider an ISP trying to provide DSL or

ISP has can also filter those packets out if they consider
them as an abuse of their network, hopefully they will filter them
after the NAT :-)

> Cable access, where most people are having a little IPsec router (or some
> other IPsec box) at home connecting to their corporation. The ISP can
> instead choose to upgrade their NAT boxes, and suggest to all plausible
> customers to use the SPI matching technique so that bandwidth wastage for
> both the UDP encapsulation and keepalives can be saved.

I have to say that for all ISP here in Finland the price for the
keepalives is such a neglitable even when sent in 20 second interval
as suggested by the draft (I still don't understand why do you keep on
using the 9 seconds and assume that nobody can configure it. The draft
clearly says that this timeout is "locally configurable parameter with
a default value of 20 seconds").

If we assume the ISP is actually account per byte (and I assume here
they account only actual data bytes not the ethernet frame bytes).
This means that each keepalive is 20 bytes of IP header, 8 bytes of
UDP header and 1 byte of payload i.e 29 bytes. If the connection is
totally idle (and for some reason we want to keep the SA up and the
connection up even when we are not sending any traffic) there will be
4320 keepalive packets sent per day. That means 122 kB per day.

The most expensive pay per byte here is something like 2.3736 euros
per MB (www.sonera.net when using GRPS on mobile phone to connect to
the internet), meaning that those keepalives will cost 0.28 euros per
day, and note here that user here wanted to keep completely unused SA
up and running for the whole day without configuring the keepalives
longer.

If the user really cares about costs of the keepalives, he sould
propably close the connection when he is not using it, or select
operator that uses fixed price (16.6 euros / month).
-- 
kivinen@ssh.fi
SSH Communications Security                  http://www.ssh.fi/
SSH IPSEC Toolkit                            http://www.ssh.fi/ipsec/