Bill, you said they don't support IPv6. Did you mean they don't support NAT64?
On Jul 31, 2017 6:40 PM, "Bill Fenner" <fenner@xxxxxxxxxx> wrote:
On Mon, Jul 31, 2017 at 6:05 AM, Ted Lemon <mellon@xxxxxxxxx> wrote:On Jul 30, 2017, at 10:44 AM, Bill Fenner <fenner@xxxxxxxxxx> wrote:On the other hand, the corporate VPN I use publishes a support matrix on their public web site, and specifically says that IPv6 is not supported. I don't think they're embarrassed about it.Would you be willing to share with us the name of the vendor?There's no reason to post it to this list specifically. The ticket I filed is in Lucy's list that Randy posted a link to; I also filed a ticket on the noc ticket tracker in Seoul when there was a push to test nat64 at that meeting.Let's think like a VPN vendor, though: why not provide IP addresses of the VPN server from the orchestrator to the client over the secure channel you've already established, rather than allowing the client to perform DNS lookups and perhaps succumb to an attack via that channel? The thing they're doing isn't dumb, it just doesn't work in a nat64 network.Bill