RFC 4787

RFC 4787
Title	RFC 4787
Type	Informational RFC
Published	March 2007
Authors	Bob Braden, Fernando Gont
Status	Informational
Pages	27

RFC 4787

RFC 4787 is an informational document that specifies behavioral requirements for Network Address Translators (NATs) performing endpoint-dependent mapping for the Session Traversal Utilities for NAT (STUN) and related protocols. It refines operational expectations for NAT devices to improve interoperability among implementations and protocols that traverse NATs, addressing issues that emerged from earlier work on NAT behavior in the Internet Engineering Task Force (IETF). The memo aims to balance deployment realities with protocol design needs, providing practical guidance for vendors, operators, and standards bodies.

Background and Purpose

NAT behavior became a critical interoperability concern as the Internet Protocol version 4 address space constrained deployments and protocols such as Session Initiation Protocol, Real-time Transport Protocol, and Simple Traversal of UDP through NATs faced bilateral peer-to-peer connectivity problems. Lessons from earlier IETF efforts, including deliberations in the BEHAVE Working Group and analyses by contributors like Paul Francis and Jeffrey Mogul, motivated a formalized set of expectations. The document was authored amid concurrent work on STUN extensions and complements other IETF artifacts such as guidance from the IETF Operations and Management Area and investigations by the IAB into transport middleboxes. Its purpose is to provide implementers with normative descriptions of endpoint-dependent mapping NATs to support secure, reliable traversal by client and server applications.

Scope and Definitions

RFC 4787 focuses on a specific NAT behavior class often called "endpoint-dependent mapping" NATs and documents how such devices should handle mapping lifetime, mapping behavior, and port allocation across transport protocol states. The specification defines terms like "mapping," "binding," "endpoint-dependent," and "endpoint-independent" drawing upon terminology standardized in working group deliverables from the IETF and referenced experientially by stakeholders such as Cisco Systems, Juniper Networks, and academic groups at MIT and Stanford University. By constraining scope to IPv4 NATs and UDP/TCP transports the document aligns with operational realities encountered by operators at organizations including AT&T, Verizon Communications, Deutsche Telekom, and research networks like Internet2.

Behavioral Requirements for NATs

The core of RFC 4787 enumerates requirements for NAT devices handling endpoint-dependent mappings, prescribing how mappings are created, refreshed, and expired. It mandates semantic behavior for address and port preservation where feasible and dictates refresh strategies to avoid premature mapping removal that would disrupt protocols such as SIP, RTP, ICE, and WebRTC. The memo recommends that NATs implement predictable port handling consonant with expectations from vendors like Netgear and D-Link and standards bodies like the IEEE where port behavior affects application robustness. It also specifies how ICMP messages and TCP control traffic should interact with mappings, referencing operational practice at large backbone operators like Level 3 Communications and content delivery entities such as Akamai Technologies.

Security Considerations

RFC 4787 discusses security trade-offs inherent in NAT design, including risks that arise from mapping lifetime extension and from allowing unsolicited inbound packets. It examines potential misuse vectors that could affect systems operated by Microsoft, Google, Amazon Web Services, and enterprise environments in Fortune 500 companies, and recommends mitigation techniques such as conservative timeout defaults and logging consistent with best practices advocated by US-CERT and regulatory frameworks like NIST guidance. The document warns about interactions with firewall policies implemented by vendors like Palo Alto Networks and Checkpoint Software Technologies and recommends operators consider threat models developed in academic venues including USENIX and ACM SIGCOMM research.

Implementation Guidance and Interoperability

To improve cross-vendor interoperability, RFC 4787 provides pragmatic guidance for implementers from vendors including Broadcom, Intel, and Qualcomm on port allocation algorithms, ICMP handling, and mapping refresh behaviors. It addresses interactions with application-layer gateways produced by companies such as Oracle and Asterisk and with residential gateway features deployed by Arris and Technicolor. The document encourages testing against interoperability testbeds maintained by organizations like RIPE NCC and collaborative projects at IETF meetings, and suggests diagnostic approaches familiar to network engineers at CAIDA and academic centers like UC Berkeley.

Reception and Impact

Following publication, RFC 4787 influenced firmware and configuration guidance across vendor ecosystems, shaping NAT implementations in consumer equipment from Linksys to carrier-grade routers produced by Huawei Technologies and Ericsson. Its recommendations informed subsequent protocol designs in the IETF BEHAVE and RTCWEB/RTCWEB successor efforts, and were cited in deployment reports by service providers such as Skype engineering teams and large cloud providers including DigitalOcean. The memo remains a reference point in discussions about middlebox behavior in standards fora such as IETF meetings and research conferences like IEEE INFOCOM and ACM CoNEXT, contributing to ongoing work on IPv6 transition mechanisms and NAT traversal strategies.

Category:Internet standards