> doesn't this require the NAT to use the same inside<->outside address
> binding for the connection between the client and the KDC as for
> the connection between the client and the application server?
> e.g. it seems like the NAT could easily change address bindings 
> during the lifetime of a ticket.

Correct.  I think Greg was thinking only of NATs which share a single
global address among multiple clients on a private network...

                                - Bill

Reply via email to