3 ms·

At worst, I see NAT being replaced with default-reject-unless-associated-with-an-existing-internally-initiated-connection border firewalls everywhere a sysadmin

At worst, I see NAT being replaced with default-reject-unless-associated-with-an-existing-internally-initiated-connection border firewalls everywhere a sysadmin with half a clue works.

jlgaddis 11y ago
And that's what I would do (basic stateful inspection), but there are too many organizations (especially SMBs with little/no I.T. staff onboard) who will simply use NAT with IPv6 to get that same end result.
- wmf 11y ago
  We'd probably be better off giving those people a default-deny firewall and calling it NAT to pacify them. But I doubt that will happen.
  - simoncion 11y ago
    I could maybe see Cisco doing such a thing.