Subject: [Ietf-behave] Issue 3 - ICMP draft issues from the IETF 65 WG meeting

From: Pyda Srisuresh <[email-masked]>
Date: Sat, 24 Jun 2006 07:16:31 -0700 (PDT)

ISSUE-3

  3. Outbound ICMP messages need to have their IP source rewritten
  to the NAT's public IP address.

  Dan - ingress filtering (RFC2827) will cause these packets to be
  dropped, if the NAT doesn't follow this behavior.  So this is why
  such behavior is necessary.

RESOLUTION: Req-5 of the ICMP draft reflects the above consensus as follows.

  REQ-5: If a NAT device receives an ICMP error packet from private
   realm, and the NAT does not have an active mapping for the embedded
   payload, the NAT SHOULD silently drop the ICMP error packet. If the
   the NAT has active mapping for the embedded payload, then the NAT
   MUST transparently forward the ICMP error message, without modifying
   the ICMP error type or code as follows.
   a) The NAT MUST revert the IP and transport headers of the embedded
   IP packet to their original form, using the matching mapping.  
   b) If the NAT device has active mapping for the ICMP error packet
   originator, the NAT MUST translate the source IP address of the
   ICMP error packet with the public IP address in the mapping. 
   Otherwise, the NAT MUST translate the source IP address of the ICMP
   error packet with its own public IP address. 
   c) Lastly, the NAT MUST update the IP and ICMP checksums in the
   outer headers to reflect the above changes.