Subject: [Ietf-behave] Issue 5 - ICMP draft issues from the IETF 65 WG meeting

From: Pyda Srisuresh <[email-masked]>
Date: Sat, 24 Jun 2006 07:31:40 -0700 (PDT)

ISSUE-5:

  5. Send ICMP error code 10 if NAT is exhausted of resources.
  This is a soft error; Saikat pointed out TCPM is modifying the
  interpretation of this ICMP error, and that this message is 
  only sent at session initiation.  Saikat suggested bringing
  discussion to the list.

RESOLUTION: After consulting with Fernando and reviewing the recommendations in
RFC 1812, we concluded that ICMP error code 13 is the correct error code to
use.  REQ-7 of the ICMP draft states the requirement as follows.

   REQ-7: When a NAT device is unable to establish a NAT Session for a
   new flow due to resource constraints or administrative restrictions,
   the NAT device SHOULD send an ICMP destination unreachable message,
   with a code of 13 (Communication administratively prohibited) to the
   sender, and drop the original packet.

The justification for using error code 13 is as follows. Section 5.2.7.1 of
[RFC1812] recommends routers to use ICMP code 13 (Communication
administratively prohibited) when they administratively filter packets.

---

From: Saikat Guha <[email-masked]>
Date: Mon, 26 Jun 2006 08:57:51 -0700 (PDT)

On Sat, 2006-06-24 at 07:31 -0700, Pyda Srisuresh wrote:

>    new flow due to resource constraints or administrative    
>    restrictions, the NAT device SHOULD send an ICMP destination
>    unreachable message, with a code of 13 (Communication 
>    administratively prohibited) to the sender, and drop the original
>    packet.

Is this for flows initiated internally, or for flows initiated
externally as well?

The TCP draft currently recommends port unreachable for externally
initiated flows (currently an open issue), but that can be changed to
admin-prohibited.

-- 
Saikat
Attachment:
signature.asc

---

From: Pyda Srisuresh <[email-masked]>
Date: Wed, 28 Jun 2006 09:44:17 -0700 (PDT)

> Is this for flows initiated internally, or for flows initiated
[suresh] This is for flows initiated internally, but are not permitted due to
resource constraints as well as flows that are administratively prohibited. 

cheers,
suresh