Subject: [BEHAVE] Comments on draft-ietf-behave-nat-mib-07

From: Dave Thaler <[email-masked]>
Date: Sat, 27 Jul 2013 17:24:39 +0000

A marked up copy with my comments (including editorial items not mentioned here) is at
http://research.microsoft.com/~dthaler/draft-ietf-behave-nat-mib-07.pdf
(or replace .pdf with .docx for a docx version).

A list of the key technical issues follows:

1.       Section 3.1 does not contain sufficient justification to deprecate all the objects it deprecates.  It does contain justification for making some be in separate conformance groups, but if we want to deprecate all of them, we need better justification.

2.       Section 3.1 argues that writability and exposing configuration parameters is bad.  The document then goes on to define new writable configuration parameters without explanation.  Furthermore, some of them appear questionable for exactly the reasons pointed out in section 3.1.

3.       The relationship between using  the NAT MIB for logging/eventing/notifications vs using IPFIX or SYSLOG for such is unclear. The chairs directed that IPFIX and SYSLOG must be consistent (or any inconsistency explained and agreed on).   This same requirement should apply to any other logging/eventing/notification proposals including SNMP. Personally I would prefer not using SNMP for notifications.

4.       The natCntProtocolTable was added without any explanation of what management question it would answer.  Why would the question be global and not (say) per-realm?

5.       The compliance statements and conformance groups assume all NATs are stateful.  They aren't.   This is labeled the "NAT MIB", not the "stateful NAT MIB", and so should cover applicability to stateless-only NATs too.

6.       The MIB (e.g. NatMapIntAddrTable) assumes there's an "external" address.  That's not a safe assumption, a NAT can be nat'ing between two internal realms.

7.       The subscriber table is indexed with a single address and doesn't seem to work for subscribers with multiple addresses/prefixes (e.g. IPv4 and IPv6).

8.       Objects relating to quotas (e.g. natCntQuota, watermarks, etc) should be in CGN-specific conformance groups, not the basic ones required for all NATs.

-Dave

---

From: Dave Thaler <[email-masked]>
Date: Sat, 27 Jul 2013 17:29:17 +0000

On issue #2, my preferred resolution is that the document should expose (only) configuration parameters that are required by other RFCs and WG documents, and that the text in 3.1 should be updated accordingly.  I note that the Syslog document currently has required configuration parameters that are not exposed in the NAT MIB.  The two documents should be consistent in my view.

Various other resolutions would also be acceptable, but above is the one I'd recommend.

-Dave

From: Dave Thaler
Sent: Saturday, July 27, 2013 7:25 PM
To: [email-masked]
Cc: [email-masked]
Subject: Comments on draft-ietf-behave-nat-mib-07

-Dave