Subject: [BEHAVE] draft-ietf-behave-syslog-nat-logging-05

From: Tom Taylor <[email-masked]>
Date: Mon, 21 Oct 2013 18:36:46 -0400

I have updated this draft in response to the comments I received from 
Simon and Senthil. I believe this completes the alignment of the draft 
with -nat-mib-09. I will do another update to align with IPFIX, if 
necessary, when a new version of that document comes out.

Substantive changes:

1. Dropped reference to a realm table in the MIB in Section 2.2.

2. Dropped the reporting NAT type parameter (many sections affected).

3. Tied the description of the MIB quota table and counter in Section 
3.2.9 to the implementation in -nat-mib-09. Deleted related Editor's 
Note in Section 5.2.22.

We have a problem with realm identifiers. The MIB has them as 
SnmpAdminString (SIZE (0..32)). Corresponding to this, the SYSLOG 
document also has them as text. Senthil would prefer numbers for IPFIX. 
I have left realm as text for the moment. Maybe we need a realm mapping 
table in the MIB after all.

Tom Taylor

---

From: Simon Perreault <[email-masked]>
Date: Tue, 22 Oct 2013 15:57:35 +0200

> table in the MIB after all.

How would the administrator interpret the number? I mean, aren't VRFs
identified by strings on Cisco devices?

Simon

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Tue, 22 Oct 2013 14:18:31 +0000

Maybe I am treading too deep into the implementation, many of ASIC based
nat engines don¹t deal with strings (too expensive), they deal with
numbers.
There is a conversion layer that converts these strings to numbers, but
the actual logging happens from the dataplane engines directly
and there is no facility to convert numbers to strings. With IPFIX, we
have the collector on the other side and the collector would be
Privy to the information of vrf ID to string conversion, that is the
assumption. Syslog and MIB would happen from a layer above the
Data plane (management plane if you will), so it would be able to convert
to strings. That is the reason why I prefer numbers in IPFIX,
that is the only way it can scale.

Senthil

---

From: Simon Perreault <[email-masked]>
Date: Tue, 22 Oct 2013 16:32:30 +0200

> that is the only way it can scale.

Can we then agree that IPFIX and SNMP/syslog will do different things?

There is precedent for using strings in SNMP (SNMPv3 contexts). And for
syslog, strings would make a lot more sense.

Simon

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Tue, 22 Oct 2013 15:01:19 +0000

>Can we then agree that IPFIX and SNMP/syslog will do different things?

I would agree.

Senthil