Subject: [BEHAVE] WGLC: draft-ietf-behave-nat-icmp-09

From: "Dan Wing" <[email-masked]>
Date: Tue, 7 Oct 2008 13:28:41 -0700

During IESG evaluation a DISCUSS was raised regarding the Section 4.3 RFC1812
conformance requirement.  As a result section 7.0 of
draft-ietf-behave-nat-icmp-09 was changed to specify which ICMP messages need
to be supported by a NAT.  The new text from -09 is below, and you can also
find it at:

http://tools.ietf.org/html/draft-ietf-behave-nat-icmp-09
and side-by-side diffs are available by clicking "Diff2".

The DISCUSS can be found at
https://datatracker.ietf.org/idtracker/draft-ietf-behave-nat-icmp/

I expect there may be some reaction to certain ICMP messages being in the
MUST/MAY/SHOULD NOT category -- please look this over and comment.  I will
wait one week, until October 14, before progressing the document.  Please send
comments to [email-masked] or the chairs.

Thanks.
-d

-----

   7. Conformance to RFC 1812

   NAT devices should follow the best current practices of modern
   routers when handling ICMP messages, as specified in Section 4.3 of
   [RFC1812].  However, since the publication of RFC1812 some of its
   requirements are no longer best current practices.  Thus, the
   following requirements are derived from RFC1812 and apply to NATs
   compliant with this specification:

   REQ-9: A NAT device MAY implement a policy control that prevents
   ICMP messages being generated toward certain interface(s).
   Implementation of such a policy control overrides the MUSTs in
   REQ-10.

   REQ-10: Unless overridden by REQ-9's policy, a NAT device needs to
   support ICMP messages as below, some conforming to Section 4.3 of
   [RFC1812] and some superseding the requirements of Section 4.3 of
   [RFC1812].
       a. MUST support:
          1. Destination Unreachable Message, as described in
             Section 7.1 of this document,
          2. Time Exceeded Message, as described in Section 7.2 of
             of this document,
          3. Parameter Problem Message, as described in
             Section 4.3.3.5 of [RFC1812],
          4. Echo Request/Reply Messages, as described in REQ-1,
          5. Router Advertisement and Solicitations, as described in
             Section 4.3.3.10 of [RFC1812].

       b. MAY support:
          1. Redirect Message, as described in Section 4.3.3.2 of
             [RFC1812],
          2. Source Route Options, as described in Section 7.3 of
             this document,
          3. Timestamp and TimeStamp Reply Messages, as described in
             Section 4.3.3.8 of [RFC1812],
          4. Address Mask Request/Reply Message, as described in
             Section 7.4 of this document.

       c. SHOULD NOT support:
          1. Source Quench Message, as described in Section 4.3.3.3
             of [RFC1812],
          2. Information Request/reply, as described in
             Section 4.3.3.7 of [RFC1812]).

   In addition, a NAT device is RECOMMENDED to conform to the following
   implementation considerations in [RFC1812]:
       d. TOS and Precedence, as described in Section 4.3.2.5 of
          [RFC1812],
       e. When Not to Send ICMP Errors, as described in
          Section 4.3.2.7 of [RFC1812],
       f. Rate Limiting, as described in Section 4.3.2.8 of [RFC1812].

_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave

---

From: "Dan Wing" <[email-masked]>
Date: Sun, 19 Oct 2008 09:22:39 -0700

Thanks to Fernando and Julien Laganier for their comments during the WGLC of
the changes to -behave-nat-icmp-09.

Here is my summary of the discussion and the changes that should be reflected
in the next version of the document:

The following are currently MUST in icmp-09, and should be moved to the MAY
section and should cite new text in the -behave-nat-icmp document as
justification (rather than citing RFC1812 as justification):

  - Parameter Problem Message, as described in Section 
    4.3.3.5 of [RFC1812]
  - Router Advertisement and Solicitations, as described 
    in Section 4.3.3.10 of [RFC1812].

And also incorporate the edits suggested by Fernando Gont:

1.

"If a NAT device does not support forwarding packets with
    the source route option, the NAT device SHOULD NOT forward
    outbound ICMP messages that contain source route option in the
    outer or inner ICMP header."

s/ICMP header/IP header/

2.

In Section 7.1.2, the draft says:
"   When NAT device is the recipient of "Packet Too Big" ICMP message
    from the network, the NAT device MUST forward the ICMP message back
    to the intended recipient, pursuant to the previously stated
    requirements REQ-3, REQ-4, REQ-5 and REQ-6."

Does REQ-6 really apply here? (ICMP PTBs are not query/response messages)

[resolution was that REQ-6 doesn't apply]

3.

Include SHOULD in the exception text,

"Implementation of such a policy control overrides the 
MUSTs and SHOULDs in REQ-10."
      ^^^^^^^^^^^

-d

---

From: Pyda Srisuresh <[email-masked]>
Date: Mon, 20 Oct 2008 04:47:21 -0700 (PDT)

Thanks to Fernando Gont and Julien Laganier for their comments and feedback. Thanks to Dan for summarizing the WGLC comments. Revised document (draft-ietf-behave-nat-icmp-10.txt) folding in the WG feedback is now posted. FYI.

regards,
suresh

--- On Sun, 10/19/08, Dan Wing <[email-masked]> wrote:

> From: Dan Wing <[email-masked]>
> Subject: RE: [BEHAVE] WGLC: draft-ietf-behave-nat-icmp-09
> To: "'Behave WG'" <[email-masked]>
> Cc: [email-masked], [email-masked], [email-masked]
> Date: Sunday, October 19, 2008, 9:22 AM