Subject: [OPSAWG] Benjamin Kaduk's No Objection on draft-ietf-opsawg-nat-yang-16: (with COMMENT)

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 25 Sep 2018 11:30:42 -0700

Benjamin Kaduk has entered the following ballot position for
draft-ietf-opsawg-nat-yang-16: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-opsawg-nat-yang/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for the easy-to-read document!  I just have a few comments and potential nits
I noticed.

It was somewhat interesting to me that basically everything is config rw, including ports and
addresses that would normally be assigned internally by the NAT, but I don't see this as
problematic.

Section 2.1

                              Considerations about instructing explicit
   dynamic means (e.g., [RFC6887], [RFC6736], or [RFC8045]) are out of
   scope.  [...]

I'm having trouble parsing this; is it maybe "instructing by explicit
dynamic means" or "explicit dynamic mappings"?

Section 3

What's the relationship between hold-down-timeout and hold-down-max -- that
is, if the maximum number of ports in the pool gets hit, to the oldest
ports in the pool get ejected even if they haven't timed out, or what
happens?

I don't expect this to need to be in the document, but I'm curious what the
use case for the all-algs-enable leaf is.

I may be confused, but is the ordering relationship between low-threshold
and high-threshold correct?  From the description it would seem like we
need low < high, but I'm reading the text as requiring low >= high.
Also, the error-message for that "must" stanza talks about port numbers,
not percentage thresholds.

        container connection-limits {
          [...]
          list limit-per-protocol {
            [...]
            leaf limit {
              type uint32;
              description
                "Rate-limit the number of protocol-specific mappings
                 and sessions per instance.";

This is a maximum, not a rate-limit, I think?

Section A.6

   EAMs may be enabled jointly with statefull NAT64.  This example shows
   a NAT64 function that supports static mappings:

nit: "stateful"

---

From: <[email-masked]>
Date: Tue, 25 Sep 2018 21:27:08 +0000

Hi Benjamin, 

Thank you for the comments. 

Please see inline.

Cheers,
Med

> -----Message d'origine-----
> De : Benjamin Kaduk [mailto:[email-masked]]
> Envoyé : mardi 25 septembre 2018 20:31
> À : The IESG
> Cc : [email-masked]; Joe Clarke; [email-masked];
> [email-masked]; [email-masked]
> Objet : Benjamin Kaduk's No Objection on draft-ietf-opsawg-nat-yang-16: (with
> COMMENT)
> 

[Med] This is a good point. Actually, we are using rw because the same structure is also used for static mappings. That is, the external port and IP address are also provided.  

> dynamic means" or "explicit dynamic mappings"?

[Med] Changed to "Considerations about instructing by explicit dynamic means". Thanks. 

> ports in the pool get ejected even if they haven't timed out, or what

[Med] deallocated ports are added to the hold-down pool till a max is reached; ports are removed from that pool upon the expiry of the hold-down-timeout. New deallocated ports cannot be added if the pool reaches its max. 

> use case for the all-algs-enable leaf is.

[Med] This is to allow to enable all "default" ALGs that are widely supported (FTP, RSTP, in particular). This is an optimization as each of the ALGs can be enabled separately. 

> not percentage thresholds.

[Med] Good c	atch. You are completely right. Fixed. 

> This is a maximum, not a rate-limit, I think?

 [Med] Yes. Fixed.

>    a NAT64 function that supports static mappings:

[Med] Fixed. Thanks

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 25 Sep 2018 16:34:38 -0500

> Thank you for the comments. 

Also inline.

> [Med] This is a good point. Actually, we are using rw because the same structure is also used for static mappings. That is, the external port and IP address are also provided.  

I had even internalized that, just somehow didn't make the connection.
Thanks for setting me straight.

> [Med] deallocated ports are added to the hold-down pool till a max is reached; ports are removed from that pool upon the expiry of the hold-down-timeout. New deallocated ports cannot be added if th…

Okay, so if the hold-down pool is full and a mapping's expiration timer
expires, does that port immediately become free to use, or does the mapping
persist until there is space in the hold-down pool, or something else?

> [Med] This is to allow to enable all "default" ALGs that are widely supported (FTP, RSTP, in particular). This is an optimization as each of the ALGs can be enabled separately. 

Okay.  I guess I don't quite see how this implies the semantics that it
overrides the per-ALG settings, but it's documented well enough that I
don't object to it being this way.

Thanks!

-Benjamin

---

From: <[email-masked]>
Date: Tue, 25 Sep 2018 21:41:32 +0000

Re-, 

Please see inline. 

Cheers,
Med

> Envoyé : mardi 25 septembre 2018 23:35
> À : BOUCADAIR Mohamed IMT/OLN
> Cc : The IESG; [email-masked]; Joe Clarke; opsawg-
> [email-masked]; [email-masked]
> Objet : Re: Benjamin Kaduk's No Objection on draft-ietf-opsawg-nat-yang-16:
> (with COMMENT)
> 
> > > addresses that would normally be assigned internally by the NAT, but I
> don't
> > > see this as
> > > problematic.
> >
> > [Med] This is a good point. Actually, we are using rw because the same
> structure is also used for static mappings. That is, the external port and IP
> address are also provided.
> 
> > [Med] deallocated ports are added to the hold-down pool till a max is
> reached; ports are removed from that pool upon the expiry of the hold-down-
> timeout. New deallocated ports cannot be added if the pool reaches its max.
> 
> expires, does that port immediately become free to use

[Med] Yes.

, or does the mapping
> > [Med] This is to allow to enable all "default" ALGs that are widely
> supported (FTP, RSTP, in particular). This is an optimization as each of the
> ALGs can be enabled separately.
>

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 25 Sep 2018 16:44:33 -0500

> > expires, does that port immediately become free to use

Got it, thanks.

I wonder if the text other than "Maximum ports in the Hold down timer pool"
in the description for hold-down-max (which, incidentally, seems to just be
a differently formatted version of the description for hold-down-timeout)
could be removed, then.  I think that would have made me less likely to be
confused about which value takes precedence.

-Benjamin

---

From: <[email-masked]>
Date: Tue, 25 Sep 2018 21:48:32 +0000

Re-,

Removed the duplicate hold-down text.  

Thank you. 

Cheers,
Med

> Envoyé : mardi 25 septembre 2018 23:45
> > > > > Objet : Benjamin Kaduk's No Objection on draft-ietf-opsawg-nat-yang-
> 16:
> > > (with
> > > > > COMMENT)
> > > > >
> > > > > It was somewhat interesting to me that basically everything is config
> rw,
> > > > > including ports and
> > > > > What's the relationship between hold-down-timeout and hold-down-max -
> -
> > > that

---

From: <[email-masked]>
Date: Thu, 27 Sep 2018 07:15:15 +0000

Hi Benjamin, 

FWIW, I submitted a new version (-17) addressing your comments: https://tools.ietf.org/html/draft-ietf-opsawg-nat-yang-17 

Cheers,
Med

> De : [email-masked] [mailto:[email-masked]]
> Envoyé : mardi 25 septembre 2018 23:49
> À : Benjamin Kaduk
> Objet : RE: Benjamin Kaduk's No Objection on draft-ietf-opsawg-nat-yang-16:
> (with COMMENT)
> 
> Re-,
> 
> > > > Objet : Re: Benjamin Kaduk's No Objection on draft-ietf-opsawg-nat-
> yang-
> > 16:
> > > > (with COMMENT)
> > > >
> > > > > > -------------------------------------------------------------------
> --
> > -
> > > > > > COMMENT:
> > > > > > -------------------------------------------------------------------
> --
> > -
> > > > > >
> > > > > > Thanks for the easy-to-read document!  I just have a few comments
> and
> > > > > > potential nits
> > > > > > I noticed.
> > > > > >
> > > > > > addresses that would normally be assigned internally by the NAT,
> but
> > I
> > > > don't
> > > > > > see this as
> > > > > > problematic.
> > > > >
> > > > I had even internalized that, just somehow didn't make the connection