1、 ETSI TR 187 008 V1.1.1 (2008-03)Technical Report Telecommunications and Internet converged Services andProtocols for Advanced Networking (TISPAN);NAT traversal feasibility study reportETSI ETSI TR 187 008 V1.1.1 (2008-03) 2 Reference DTR/TISPAN-07022-NGN Keywords report, security ETSI 650 Route des
2、 Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice Individual copies of the present document can be downloaded from:
3、 http:/www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall be t
4、he printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at
5、 http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http:/portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written permission. The copyrigh
6、t and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2008. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTM, TIPHONTM, the TIPHON logo and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM is a Trad
7、e Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. ETSI ETSI TR 187 008 V1.1.1 (2008-03) 3 Contents Intellectual Property Rights4 Foreword.4 1 Scope 5 2 References 5 2.1 Normative references .5 2.2 Informative references6 3 Definitions and abbreviations
8、.7 3.1 Definitions7 3.2 Abbreviations .8 4 NAT and firewall traversal considerations.8 4.1 Rationale for NAT Traversal study in the NGN.8 4.2 NAT Background .10 4.3 Types of NAT/Firewall Devices 10 4.3.1 NAT types.10 4.3.2 Filtering Behaviour.11 5 Reference architecture for NGN R2.12 6 Requirements
9、and objectives for NGN R2 NAT-T14 6.1 Objectives for NAT-T in NGN-R2.14 6.2 Requirements for use of NAT-T in NGN-R2.14 7 Existing NAT traversal methods documented in TISPAN R1 and 3GPP specifications.15 7.1 IMS-ALG in TISPAN R1.15 7.1.1 IMS-ALG with signalling not encrypted 15 7.1.2 IMS-ALG with enc
10、rypted signalling 16 7.2 ICE and outbound in TS 123 228.17 8 Feasibility, applicability, limitations of existing NAT traversal methods documented in TISPAN R1 and 3GPP specifications .18 8.1 Open issues with the NGN R1 approach for NAT traversal.18 8.1.1 Unidirectional RTP traffic 18 8.1.2 TCP conne
11、ctions initiated externally 19 8.1.3 Signalling traffic .19 8.1.4 Non IMS applications .19 8.1.5 Convergence with other standards 19 8.2 IPSec in presence of NAT 20 8.3 IMS ALG20 8.3.1 Feasibility .20 8.3.2 Applicability .21 8.3.3 Limitations21 8.4 ICE for media .22 8.4.1 Feasibility .22 8.4.2 Appli
12、cability .22 8.4.3 Limitations23 8.5 Outbound for signalling23 8.5.1 Feasibility .23 8.5.2 Applicability .24 8.6 UE ALG .25 9 Solutions for NAT traversal in NGN R225 9.1 NAT traversal for signalling.25 9.2 NAT traversal for media.26 Annex A: TVRA Summary for the NAT-T methods recommended in the pres
13、ent document.27 History 28 ETSI ETSI TR 187 008 V1.1.1 (2008-03) 4 Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-m
14、embers, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http:/webapp.etsi.org/IPR/ho
15、me.asp). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to th
16、e present document. Foreword This Technical Report (TR) has been produced by ETSI Technical Committee Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN). ETSI ETSI TR 187 008 V1.1.1 (2008-03) 5 1 Scope The present document gives the results of a NAT tra
17、versal feasibility study for the NGN in TISPAN. The term NAT Traversal is used to describe the problem of establishing connections between hosts where the IP address and port of the host is modified by a Network Address Translation (NAT) entity placed at some addressing boundary in the NGN. The term
18、 NAT in the present document refers to Network Address Port Translation (NAPT) in addition to NAT, where NAPT devices translate port numbers in addition to IP addresses. The study also considers the impact where the NAT device exhibits characteristics associated with firewalls. The document describe
19、s: Requirements for NGN R2 and open issues with the NGN R1 approach for NAT traversal. Reference architecture for NGN R2. Existing NAT traversal methods. Feasibility/applicability/limitations of those methods to solve the identified issues for NGN applications/services in an NGN environment; analysi
20、s of the potential impacts to other TISPAN documents. Scenarios for NAT traversal in NGN R2 (residential networks). The security problems associated with NAT and NAT Traversal. 2 References References are either specific (identified by date of publication and/or edition number or version number) or
21、non-specific. For a specific reference, subsequent revisions do not apply. Non-specific reference may be made only to a complete document or a part thereof and only in the following cases: - if it is accepted that it will be possible to use all future changes of the referenced document for the purpo
22、ses of the referring document; - for informative references. Referenced documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. For online referenced documents, information sufficient to identify and locate the source shall b
23、e provided. Preferably, the primary source of the referenced document should be cited, in order to ensure traceability. Furthermore, the reference should, as far as possible, remain valid for the expected life of the document. The reference shall include the method of access to the referenced docume
24、nt and the full network address, with the same punctuation and use of upper case and lower case letters. NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee their long term validity. 2.1 Normative references Not applicable. ETSI ETSI TR 187
25、008 V1.1.1 (2008-03) 6 2.2 Informative references 1 ETSI ES 282 003: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Resource and Admission Control Sub-system (RACS); Functional Architecture“. 2 ETSI TS 102 558: “Methods for Testing and Specificati
26、on (MTS); Internet Protocol Testing (IPT): IPv6 Security; Requirements Catalogue“. 3 ETSI TS 182 006: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); IP Multimedia Subsystem (IMS); Stage 2 description (3GPP TS 23.228 v7.2.0, modified)“. 4 ETSI TS 1
27、83 017: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Resource and Admission Control: DIAMETER protocol for session based policy set-up information exchange between the Application Function (AF) and the Service Policy Decision Function (SPDF); Pr
28、otocol Specification“. 5 ETSI TS 185 003: “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); TISPAN CNG Architecture and Interfaces and Reference Points“. 6 ETSI TS 187 001: “Telecommunications and Internet converged Services and Protocols for Advance
29、d Networking (TISPAN); NGN SECurity (SEC); Requirements - Release 2“. 7 ETSI TS 123 228 “Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); IP Multimedia Subsystem (IMS); Stage 2 (3GPP TS 23.228)“. 8 ETSI TS 133 203: “Digital cellular telecommun
30、ications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); 3G security; Access security for IP-based services (3GPP TS 33.203)“. 9 ETSI TS 124 229 “Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); Internet Protocol (IP) mul
31、timedia call control protocol based on Session Initiation Protocol (SIP) and Session Description Protocol (SDP); Stage 3 (3GPP TS 24.229)“. 10 ETSI TS 133 234: “Universal Mobile Telecommunications System (UMTS); 3G security; Wireless Local Area Network (WLAN) interworking security (3GPP TS 33.234)“.
32、 11 IETF RFC 1122: “Requirements for Internet Hosts - Communication Layers“. 12 IETF RFC 1631: “The IP Network Address Translator (NAT)“. 13 IETF RFC 1918: “Address Allocation for Private Internets“. 14 IETF RFC 3022: “Traditional IP Network Address Translator (Traditional NAT)“. 15 IETF RFC 3264: “
33、An Offer/Answer Model with the Session Description Protocol (SDP)“. 16 IETF RFC 3327: “Session Initiation Protocol (SIP) Extension Header Field for Registering Non-Adjacent Contacts“. 17 IETF RFC 3489: “STUN - Simple Traversal of User Datagram Protocol (UDP) Through Network Address Translators (NATs
34、)“. 18 IETF RFC 3550: “RTP: A Transport Protocol for Real-Time Applications“. 19 IETF RFC 3605: “Real Time Control Protocol (RTCP) attribute in Session Description Protocol (SDP)“. 20 IETF RFC 3715: “IPSec-Network Address Translation (NAT) Compatibility Requirements“. 21 IETF RFC 4301: “Security Arc
35、hitecture for the Internet Protocol“. ETSI ETSI TR 187 008 V1.1.1 (2008-03) 7 22 IETF RFC 4302: “IP Authentication Header“. 23 IETF RFC 4303: “IP Encapsulating Security Payload (ESP)“. 24 IETF RFC 4306: “Internet Key Exchange (IKEv2) Protocol“. 25 IETF RFC 4787: “Network Address Translation (NAT) Be
36、havioral Requirements for Unicast UDP“. 26 Draft-ietf-behave-rfc3489bis-13: “STUN - Simple Traversal of User Datagram Protocol (UDP) Through Network Address Translators (NATs)“, November 2007. 27 Draft-ietf-mmusic-ice-19: “Interactive Connectivity Establishment (ICE): A Methodology for Network Addre
37、ss Translator (NAT) Traversal for Offer/Answer Protocols“, October 29, 2007. 28 Draft-ietf-behave-turn-05: “Obtaining Relay Addresses from Simple Traversal of UDP Through NAT (STUN)“, November 15, 2007. 29 Draft-ietf-sip-outbound-11: “Managing Client Initiated Connections in the Session Initiation P
38、rotocol (SIP)“, November 10, 2007. 30 Draft-ietf-sip-gruu-15: “Obtaining and Using Globally Routable User Agent (UA) URIs (GRUU) in the Session Initiation Protocol (SIP)“, October 11, 2007. 31 Draft-ietf-avt-rtp-no-op-04: “A No-Op Payload Format for RTP“, May 21, 2007. 32 Draft-ietf-behave-nat-behav
39、ior-discovery-02: “NAT Behavior Discovery Using STUN“, November 17 2007. 33 IETF RFC 3551: “RTP Profile for Audio and Video Conferences with Minimal Control“. 34 IETF RFC 3261: “SIP: Session Initiation Protocol“. 35 ETSI TR 187 002: “Telecommunications and Internet converged Services and Protocols f
40、or Advanced Networking (TISPAN); TISPAN NGN Security (NGN_SEC); Threat, Vulnerability and Risk Analysis - Release 2“. 36 IETF RFC 4961: “Symmetric RTP / RTP Control Protocol (RTCP)“. 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the following terms and def
41、initions apply: Network Address Translation (NAT): method by which IP addresses are mapped from one realm to another in order to provide transparent routing to hosts NOTE: NAT devices are used to connect address domains with private (unregistered) addresses to public domains with globally unique (re
42、gistered) addresses. NAT Traversal (NAT-T): method to establish connections between hosts in IP networks which use NAT devices (either locally or remotely) to modify their local IP address ETSI ETSI TR 187 008 V1.1.1 (2008-03) 8 3.2 Abbreviations For the purposes of the present document, the followi
43、ng abbreviations apply: AF Application Function AH Authentication Header ALG Application Level Gateway AVP Attribute-Value Pair BGF Border Gateway Function ESP Encrypted Secure Payload FQDN Fully Qualified Domain Name ICE Interactive Connectivity Establishment IKE Internet Key Exchange IMS IP Multim
44、edia System IP Internet Protocol ISDN Integrated Services Digital Network IVR Interactive Voice Response NAPT Network Address Port Translation NAT Network Address Translation NAT-T Network Address Translation Traversal NGN Next Generation Network P-CSCF Proxy Call Session Control Function PSTN Publi
45、c Switched Telephone Network RACS Resource Admission Control Subsystem RTCP Real Time Control Protocol RTP Real Time Protocol SDI Session Description Information SDP Session Description Protocol SPDF Service-based Policy Decision Function SIP Session Initiation Protocol STUN Simple Traversal of UDP
46、through NAT TCP Transport Control Protocol TE Terminal Equipment TLS Transport Layer Security UDP User Datagram Protocol UE User Equipment VAD Voice Activity Detection 4 NAT and firewall traversal considerations 4.1 Rationale for NAT Traversal study in the NGN The model of IP assumes a single global
47、 address space where every host is reachable from all other hosts, in other words there is only one address space and it is public. In many implementations however a single address in the global address space is shared by multiple hosts, thus presenting both public and private IP address spaces. In
48、order to ensure the reachability of the hosts in the private address domain from hosts in the global address domain a border device providing Network Address Translation (NAT) is used to map public to private addresses. However many protocols work on the assumption that the host address is globally
49、unique and publish such addresses. Figure 1 illustrates the problem space by showing the restricted scope of the IP address with respect to the scope of the application name. ETSI ETSI TR 187 008 V1.1.1 (2008-03) 9 IP source addressApplication nameIP networkDHCPserverNATIP hostIP host address scopeApplication networkIPAddress_Req/IndFigure 1: NAT Traversal problem When an application uses the Host IP Address in establishing a session with an application network outside the scope of hosts IP
