Subject: [BEHAVE] NAT Logging -- Port violation event for MAP-E or LW4over6 BR

From: Tom Taylor <[email-masked]>
Date: Thu, 25 Apr 2013 07:35:15 -0400

The MAP-E and LW4over6 border routers are responsible for checking that 
the ports assigned by the CE are within the set allocated to that CE. I 
think we need a NAT logging event to report detection of an out-of-range 
port.

Tom Taylor

---

From: Tom Taylor <[email-masked]>
Date: Fri, 26 Apr 2013 11:46:20 -0400

Well, this comment has triggered an interesting discussion in Softwires, 
but now that I'm putting the final touches to a reissue of the SYSLOG 
NAT logging draft, I see it doesn't fit in very neatly there. The border 
router in these cases is not a NAT, so any discussion of logging 
probably belongs in a MAP-specific document. The CE is also responsible 
for checking, and the CE is a NAT, so it fits with the CE, but I'm not 
sure if it's worth standardizing.

I'll leave it out unless I get comments otherwise.

---

From: Dan Wing <[email-masked]>
Date: Fri, 26 Apr 2013 09:29:08 -0700

On Apr 26, 2013, at 8:46 AM, Tom Taylor <[email-masked]> wrote:

> Well, this comment has triggered an interesting discussion in Softwires, but now that I'm putting the final touches to a reissue of the SYSLOG NAT logging draft, I see it doesn't fit in very neatly there. The border router in these cases is not a NAT, so any discussion of logging probably belongs in a MAP-specific document. The CE is also responsible for checking, and the CE is a NAT, so it fits with the CE, but I'm not sure if it's worth standardizing.
> 

I believe the intent of generating such logging messages is diagnostics/troubleshooting, in order to detect mis-configured equipment.  The mis-configured equipment is the CPE router.  I don't recall, but doesn't the MAP router send back ICMP errors if the subscriber's CPE sends packets with the wrong port number?

-d

> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/behave

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Fri, 26 Apr 2013 17:27:54 +0000

On 4/26/13 12:29 PM, "Dan Wing (dwing)" <[email-masked]> wrote:

>> Well, this comment has triggered an interesting discussion in
>>Softwires, but now that I'm putting the final touches to a reissue of
>>the SYSLOG NAT logging draft, I see it doesn't fit in very neatly there.
>>The border router in these cases is not a NAT, so any discussion of
>>logging probably belongs in a MAP-specific document. The CE is also
>>responsible for checking, and the CE is a NAT, so it fits with the CE,
>>but I'm not sure if it's worth standardizing.
>> 
>I believe the intent of generating such logging messages is
>diagnostics/troubleshooting, in order to detect mis-configured equipment.
> The mis-configured equipment is the CPE router.  I don't recall, but
>doesn't the MAP router send back ICMP errors if the subscriber's CPE
>sends packets with the wrong port number?

Yes, it does.

"If the packets source port
   number is found to be outside the range allowed for this CE and the
   BMR, the BR MUST drop the packet and respond with an ICMPv6
   "Destination Unreachable, Source address failed ingress/egress
   policy" (Type 1, Code 5)."