Subject: Re: [BEHAVE] I-D Action: draft-ietf-behave-ipfix-nat-logging-00.txt

From: Tom Taylor <[email-masked]>
Date: Thu, 18 Apr 2013 08:22:15 -0400

I note that explicit NAT44 and NAT64 events are defined in this draft, 
rather than general events where the address types are taken from the 
parameters. I can see that this provides a certain level of possibility 
for validation of the parameter types at the receiving end. Are there 
other advantages? The general event approach seems more natural to me.

Tom taylor

---

From: Tom Taylor <[email-masked]>
Date: Thu, 18 Apr 2013 08:47:38 -0400

By the RFC 2663 definition, amplified by the discussion in Section 3 of 
RFC 6146, a NAT session as opposed to a binding involves a specific 
destination address and port. Why are these marked not mandatory in the 
session create and delete events (Tables 4 and 5)?

Tom Taylor

---

From: Tom Taylor <[email-masked]>
Date: Thu, 18 Apr 2013 09:36:17 -0400

The parameter "NAT originating address realm"is provided for the various 
session and BIB creation and deletion events. Is that "originating" 
meant to be "internal", or to reflect instead whether the packet that 
triggered the event came from the internal or external realm?

Tom Taylor

---

From: Simon Perreault <[email-masked]>
Date: Thu, 18 Apr 2013 15:52:06 +0200

> triggered the event came from the internal or external realm?

BIB entries can only be dynamically created from the internal side. 
Therefore that parameter should be renamed to "NAT internal realm".

Simon

---

From: Tom Taylor <[email-masked]>
Date: Thu, 18 Apr 2013 10:17:16 -0400

In the quota exceeded event, are the limits expected to apply to the sum 
over all protocols, or should protocol identifier also be a parameter of 
the template?

Is it right to say that one source address, IPv4 or IPv6, MUST be 
present in the event report?

Tom taylor

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Thu, 18 Apr 2013 14:28:13 +0000

With IPFIX the templates have to be exchanged and the IE will have a type
and length.
Not sure what do you mean by general event.

On 4/18/13 8:22 AM, "Tom Taylor" <[email-masked]> wrote:

>_______________________________________________
>Behave mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/behave

---

From: Tom Taylor <[email-masked]>
Date: Thu, 18 Apr 2013 10:29:03 -0400

The address binding event description has a couple of editorial 
glitches: the sentence describing when the event happens is incomplete, 
and instead of MANDATORY or not, the translated IPv4 source address is 
"8". I assume that should be MANDATORY.

Address binding could also happen because the NAT has decided to 
allocate a new address, e.g., to effect port preservation.

Finally, as with the Quota Exhausted event, would it be right to say 
that one of IPv4 or IPv6 source address MUST be present?

Tom Taylor

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Thu, 18 Apr 2013 14:30:59 +0000

Session as it gets created in NAT will have a destination address and port.
That is not to say they MUST be logged. In fact, lsn-requirements says
desitnation information SHOULD NOT be logged for privacy reasons. That is
why  they are not mandatory.

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Thu, 18 Apr 2013 14:34:02 +0000

Once a BIB entry is created, the session can be created from the BIB
either from internal or external
realms. But that is based on the configured filtering policies. Maybe the
BIB creation shouldn¹t have the
Originating address realm. I will ask for the WG input on that.

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Thu, 18 Apr 2013 14:37:34 +0000

>over all protocols, or should protocol identifier also be a parameter of

That is a good question. I think there are limits per protocol and there
are overall
limits per nat instance. There can also be limits per host or per domain
(vrf). 

>present in the event report?

Maybe not. If you have per host limits, then a host identifier makes sense.
But if collectively the limits were exceeded, then a host identifier wont
be there.

---

From: Tom Taylor <[email-masked]>
Date: Thu, 18 Apr 2013 11:48:54 -0400

I mean a NAT session or BIB (create or delete) event where whether it is 
NAT44 or NAT64 is inferred from the type of the source address parameter.

---

From: Tom Taylor <[email-masked]>
Date: Thu, 18 Apr 2013 11:51:09 -0400

I was asking what the intention was for the parameter. Is it intended to 
reflect the triggering event, or is it intended to indicate which 
internal realm is involved?

On 18/04/2013 10:34 AM, Senthil Sivakumar (ssenthil) wrote:
> .

---

From: Tom Taylor <[email-masked]>
Date: Thu, 18 Apr 2013 11:54:13 -0400

OK, we should probably add an optional protocol identifier parameter, 
and should we add an optional VLANid/VRFid parameter with the 
requirement that one of that parameter or an IPv4 or IPv6 source address 
MUST be present?

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Thu, 18 Apr 2013 16:55:45 +0000

Intended to indicate if the creation was from internal or external realm.

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Thu, 18 Apr 2013 16:56:27 +0000

Makes sense.

---

From: Tom Taylor <[email-masked]>
Date: Fri, 19 Apr 2013 06:51:38 -0400

OK, let's nail this down. Was this was meant to be a two-valued field
(internal | external) or was it meant to be a realm number (0 - 255)?

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Fri, 19 Apr 2013 11:15:49 +0000

Two valued field - can be internal or external realm.