Subject: [BEHAVE] draft-ietf-behave-syslog-nat-logging-04 submitted

From: Tom Taylor <[email-masked]>
Date: Thu, 03 Oct 2013 12:05:57 -0400

I have submitted draft-ietf-behave-syslog-nat-logging-04. I think this 
is as good as I can do without further WG input. It has a number of 
differences from the current version of the IPFIX document (in terms of 
events covered, in particular), and assumes a bit of additional work on 
the NAT MIB. I will send out separate messages detailing these 
differences for each document.

Listed below are the changes from the -03 version, in detail for 
Sections 1-4 and more broadly for the much-rewritten but derivative 
later sections.

Tom Taylor

Sections 1-4 changes
====================

General:
-------

Classified events under two headings: events relating to allocation of 
resources to hosts, and events directed to operations and maintenance.

Replaced all instances of "transport mapping" either with "BIB entry" or 
"transport binding". The latter is the term introduced in Section 1.1 
Terminology, and avoids confusion with "address mapping".

Got rid of the optional reporting device identifier, as indicated in a 
previous message to the list.

Changed the optional "Triggering NAT procedure" parameter to "Reporting 
NAT type" for all events, as reported in a previous message.

Stripped subscriber-specific information from the operations and 
maintenance oriented events as much as seemed reasonable, to make them 
less sensitive. The necessary information for follow-up is in the 
per-subscriber MIB counters.

Speaking of subscribers, replaced that term with "hosts" in most places, 
to cover more general NAT situations.

To be consistent with the MIB, changed all threshold events to strictly 
greater than threshold, except address pool, which the MIB has "greater 
than or equal" or "less than or equal" respectively, possibly because of 
the lower resolution of the threshold.

Sections 2.2 and 2.3.1
----------------------

Fixed GW DS-Lite description by swapping roles of softwire identifier 
(SWID) and context identifier (CID).

Section 2.3.1, Generalized Internal Address
-------------------------------------------

Dropped mention of a separate length field for addresses or prefixes. 
The notation specified in Section 5.2.1 incorporates prefix length as 
part of the address value field.

Section 3, Events
-----------------

Replaced some text on "triggering NAT procedure" with a simple statement 
that it is a hint to aid in interpretation, since the parameter is 
present for more than just the resource allocation events.

Section 3.1.1 (was 3.1), session entries
----------------------------------------

Noted that it is unnecessary to specify the external destination address 
type in the encoding of that address, since it is the same as the type 
of the mapped external address.

Section 3.1.4 (was 3.4), port set allocation/deallocation
---------------------------------------------------------

Added trigger parameter (optional).

Changed "range size" to "range length" in hopes this is clearer.

Section 3.2.1 (was 3.5), address pool thresholds
------------------------------------------------

Added text defining address exhaustion and port exhaustion and relating 
them to MIB counters, as reported in previous message to the list.

Section 4, SYSLOG applicability
-------------------------------

Corrected first paragraph, which had mentioned the facility field 
separately from priority in the log header.

Revised length of session log records upwards based on example in 
5.3.1.1.1. Also noted the possibility of bursts of session deletion events.

Changes beyond Section 4
========================

General
-------

Completely re-did the MSGIDs and PARAM-NAMEs to make the naming 
conventions more consistent, since so much was new anyway.

Added all the threshold and limit events implied by the MIB. Dropped the 
address exhausted, port exhausted, and invalid port events (all as 
discussed/reported on the list).

The TRIG (trigger) parameter can take on different values (out of an 
enumerated set) depending on the event type. These are specified by 
event type. I'm not sure if this means the semantics are varied and 
hence the parameter should have a different PARAM-NAME depending on the 
event type. SYSLOG experts might weigh in.

In the log header:
------------------

Corrected discussion of Facility to leave it to the operator to select 
appropriate values. Facility=10 is probably for log-ins to the device 
itself.

Changed APP-NAME for events directed to operations and maintenance from 
"NAT" to "NATMTC".

Added discussion of timestamp precision and accuracy.

Specified that the HOSTNAME field identifies the NAT itself.

Section 5.2.1, general encoding rules
-------------------------------------

New section.

Specified that all fields are encoded as 7-bit US ASCII.

Specified presentation of IPv4 and IPv6 addresses and prefixes. IPv6 is 
based on RFC 5952 with some optional elements specified for its 
application to special addresses.

Section 5.2.4, GIATYP = generalized address type
------------------------------------------------

Enumeration spells out the different types that can be used as 
GW-initiated context identifiers, beyond IPv4 and IPv6 addresses/prefixes.

Section 6, Management Considerations
------------------------------------

Added general implementation requirements for management of logging, as 
previously reported to the list, with one addition: the ability to 
completely disable the reporting of a particular event type. This was 
added under the suppression topic.

Added discussion of threshold setting.

Section 7, Security Considerations
----------------------------------

Expanded specification of usage of RFC 5848.

Added discussion of sensitivity of logs directed to operations and 
maintenance.

Section 8, IANA Considerations
------------------------------

Moved to end. Moved in a paragraph that was previously near the 
beginning of Section 5 but was more relevant here.

Adopted the stylistic convention that SD-IDs are small letters, 
PARAM-NAMEs are all capitals.

Informational References
------------------------

Updated draft dates.