Subject: [NAT] Re: ieftf NAT MIB Questions

From: Pyda Srisuresh <[email-masked]>
Date: Tue, 11 Dec 2001 00:33:56 -0800 (PST)

--- Chris Zacker <[email-masked]> wrote:
> Hi Pyda,
> 
> Let me introduce myself.  I am Chris Zacker and I am a software engineer for
> Broadcom Corp.  I am currently working at CableLabs in Colorado on the new
> CableHome Specification.
> 
> We are in the process of writing the specification for CableHome 1.0 which
> will be a Residential Gateway product, tied in with a DOCSIS CableModem.
> Since this product will be a NAT, Firewall, Router etc., type of device we
> thought that using some common ietf MIBs would be useful.  I located your
> NAT MIB 2.0 and thought that there was some commonality that could be used.
> 
Sounds great.

> I have be reading and studying the NAT Mib 2.0 that your team has been
> putting together and have several questions about it.
> 
> I hope that you are the correct person to answer these questions (if not I
> apologize, but if you can pass them on I would appreciate it).

No problem. I will give it a shot.

> 
> Question:
> 1)  The MIB has all the BIND and SESSION Table entries as read-only.  Does
> this mean that the MIB is primarily for viewing the topology of a NAT device
> that is automatically assigning information?  In our specification there is
> a need to be able to manual configure specific translations, or passthrough.
>

You raise a good point. I think, it should be OK to make both the BIDN and
SESSION entries SETtable as well. 
 
> 2)  What is the deference between the BIND and SESSION tables exactly?  I
> guess the concept of them is what I am missing. Does the Session specify
> active translations where the bind specifies all?
> 
BIND is essentially an action that NAT takes on each packet that
has a session match. Packets belonging to a NAT session are subject 
to address/port modification as specified by the BIND assigned to the
session.

SESSION on the other hand is a tuple match that decides whether or not 
a packet should be subject to NAT action. In other words, session is 
like a filter that gets created dynamically. When a packet doesnt have a 
matching session, NAT address maps are searched to determine whether
a new NAT session needs to be created as a result.

> I thank you in advance for any assistance.
> 
You are welcome. Please do not hesitate to raise any other questions
you might have, as the draft is likely to go through a wider WG review
shortly. Thanks.

> Chris Zacker
> Senior Software Eng
> Broadcom Corp
> Visiting Engineer for CableLabs
> 
> 
cheers,
suresh

__________________________________________________
Do You Yahoo!?
Check out Yahoo! Shopping and Yahoo! Auctions for all of
your unique holiday gifts! Buy at http://shopping.yahoo.com
or bid at http://auctions.yahoo.com

_______________________________________________
nat mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/nat

---

From: Pyda Srisuresh <[email-masked]>
Date: Tue, 11 Dec 2001 00:33:56 -0800 (PST)

Sounds great.

 

cheers,
suresh

---

From: Rajiv Raghunarayan <[email-masked]>
Date: Tue, 11 Dec 2001 21:51:48 +0530

Hi Chris,

Please find my comments inline..

> > a need to be able to manual configure specific translations, or passthrough.

The configuration is/should be done using the tables in the config 
group of the mib i.e. the natConfTable, natConfAddrMapTable, 
natInterfaceTable etc. 

The BIND and the session tables only represent the active BINDs and 
sessions (which have been based on the user specified configuration). 
Therefore, these tables are read-only tables.

HTH..

-Rajiv.

---

From: Rajiv Raghunarayan <[email-masked]>
Date: Tue, 11 Dec 2001 21:51:48 +0530

Hi Chris,

HTH..

-Rajiv.

---

From: Pyda Srisuresh <[email-masked]>
Date: Tue, 11 Dec 2001 10:47:54 -0800 (PST)

--- Rajiv Raghunarayan <[email-masked]> wrote:
<... stuff deleted>
> group of the mib i.e. the natConfTable, natConfAddrMapTable, 

Rajiv - This are no doubt the configuration parameters, but not the same
as creating BINDs and SESSIONs dynamically.
 
> Therefore, these tables are read-only tables.

Would it be a problem to make them dynamically settable by the 
SNMP application?

cheers,
suresh

_______________________________________________
nat mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nat

---

From: Pyda Srisuresh <[email-masked]>
Date: Tue, 11 Dec 2001 10:47:54 -0800 (PST)

cheers,
suresh

---

From: Rajiv Raghunarayan <[email-masked]>
Date: Thu, 13 Dec 2001 00:35:55 +0530

Hi Suresh,

> as creating BINDs and SESSIONs dynamically.

The natConfAddrMapTable is used to create BINDs/mappings (both 
static and dynamic). Dynamic/Static nat mappings are created in 
this table, and when a BIND is finally created/instantiated (on
traffic flow), it is reflected in the BIND table (with the 
appropriate session stats in the session table).

Am I missing something??

Thanks,
Rajiv.

---

From: Rajiv Raghunarayan <[email-masked]>
Date: Thu, 13 Dec 2001 00:35:55 +0530

Hi Suresh,

Am I missing something??

Thanks,
Rajiv.

---

From: Pyda Srisuresh <[email-masked]>
Date: Wed, 12 Dec 2001 22:19:50 -0800 (PST)

--- Rajiv Raghunarayan <[email-masked]> wrote:
> > > > > that is automatically assigning information?  In our specification
> there
> > > is

Yes. The natConfAddrMapTable does not refer to BINDs, It simply refers to
address/port maps. natConfBINDs are different from address mappings. 
It is true that in the case of a static address/port mapping, the static 
mapping implies a static address/port BIND. 

But, the issue is the ability to create(set) BINDs and SESSIONs dynamically
via the SNMP.

cheers,
suresh

=====

---

From: Rajiv Raghunarayan <[email-masked]>
Date: Thu, 13 Dec 2001 11:55:42 +0530

Hi Suresh,

> But, the issue is the ability to create(set) BINDs and SESSIONs dynamically

Curious - why/where would this be required?? Given a dynamic 
address map, a BIND would be created when traffic flows.

-Rajiv.

---

From: Rajiv Raghunarayan <[email-masked]>
Date: Thu, 13 Dec 2001 11:55:42 +0530

Hi Suresh,

-Rajiv.

---

From: Pyda Srisuresh <[email-masked]>
Date: Wed, 12 Dec 2001 22:19:50 -0800 (PST)

cheers,
suresh

=====

---

From: Pyda Srisuresh <[email-masked]>
Date: Fri, 14 Dec 2001 14:32:53 -0800 (PST)

> address map, a BIND would be created when traffic flows.

Rajiv - There can be several reasons. FOr example, the administartor 
may choose to force a certain binding on an as needed basis. Likewise,
the administrative may choose to force a certain session setup (or)
drop a session  that is found to be distruptive.

Administrators need a mechanism to manually override what the
NAT device does. Many NAT device vendors provide this option today.

cheers,
suresh 

=====

---

From: Pyda Srisuresh <[email-masked]>
Date: Fri, 14 Dec 2001 14:32:53 -0800 (PST)

cheers,
suresh 

=====

---

From: Rajiv Raghunarayan <[email-masked]>
Date: Tue, 18 Dec 2001 12:23:30 +0530

Hi Suresh,

> NAT device does. Many NAT device vendors provide this option today.

Thanks!! It did occur to me after I had sent the mail (a little too 
late!!). I guess, we should consider having read-create as MAX-ACCESS 
for (some) objects in the BIND table.

Thanks,
Rajiv.

---

From: Rajiv Raghunarayan <[email-masked]>
Date: Tue, 18 Dec 2001 12:23:30 +0530

Hi Suresh,

Thanks,
Rajiv.