Definitions of Managed Objects for Network Address Translators (NAT)

For a detailed overview of the documents that describe the current Internet-Standard Management Framework, please refer to section 7 of RFC 3410 [RFC3410]. Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. MIB objects are generally accessed through the Simple Network Management Protocol (SNMP). Objects in the MIB are defined using the mechanisms defined in the Structure of Management Information (SMI). This memo specifies a MIB module that is compliant to the SMIv2, which is described in STD 58, , and .

Note to RFC Ed.: please replace RFC yyyy with actual RFC number throughout this document and remove this note. This memo defines a portion of the Management Information Base (MIB) for devices implementing NAT functions. This MIB module, NATV2-MIB, may be used for monitoring of such devices. NATV2-MIB supersedes NAT-MIB , which did not fit well with existing NAT implementations, and hence was not itself much implemented. provides a detailed analysis of the deficiencies of NAT-MIB. Relative to and based on the analysis just mentioned, the present document introduces the following changes: removed all writable configuration except that related to control of the generation of notifications and the setting of quotas on the use of NAT resources; minimized the read-only exposure of configuration to what is needed to provide context for the state and statistical information presented by the MIB module; removed the association between mapping and interfaces, retaining only the mapping aspect; replaced references to NAT types with references to NAT behaviors as specified in ; replaced a module-specific enumeration of protocols with the standard protocol numbers provided by the IANA Assigned Internet Protocol Numbers registry. This MIB module adds the following features not present in : additional writable protective limits on NAT state data; additional objects to report state, statistics, and notifications; support for the carrier grade NAT (CGN) application, including subscriber-awareness, support for an arbitrary number of address realms, and support for multiple NAT instances running on a single device; expanded support for address pools; revised indexing of port map entries to simplify traceback from externally observable packet parameters to the corresponding internal endpoint. These features are described in more detail below. The remainder of this document is organized as follows: provides a verbal description of the content and organization of the MIB module. provides the MIB module definition. discusses operational and management issues relating to the deployment of NATV2-MIB. One of these issues is NAT management when both NAT-MIB and NATV2-MIB are deployed. and provide a security discussion and a request to IANA for allocation of an object identifier for the module in the mib-2 tree, respectively. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in . This document uses the following terminology: The protocol following the outer IP header of a packet. This follows the terminology of , but as that document points out, "upper" is not necessarily a correct description of the protocol relationships (e.g., where IP is encapsulated in IP). The abbreviated term "protocol" will often be used where it is unambiguous. With respect to notifications, the logical recognition of the event that the notification is intended to report. The actual production of a notification message. Reporting can happen later than triggering, or may never happen for a given notification instance, because of the operation of notification rate controls. A network domain in which the network addresses are uniquely assigned to entities such that datagrams can be routed to them. (Definition taken from Section 2.1.) The abbreviated term "realm" will often be used.

This section provides a prose description of the contents and organization of the NATV2-MIB module.

The content provided by the NATV2-MIB module can be classed under four headings: configuration data, notifications, state information, and statistics.

As mentioned above, the intent in designing the NATV2-MIB module was to minimize the amount of configuration data presented to that needed to give a context for interpreting the other types of information provided. Detailed descriptions of the configuration data are included with the descriptions of the individual tables. In general, that data is limited to what is needed for indexing and cross-referencing between tables. The two exceptions are the objects describing NAT instance behavior in the NAT instance table, and the detailed enumeration of resources allocated to each address pool in the pool table and its extension. The NATV2-MIB module provides three sets of read-write objects, specifically related to other aspects of the module content. The first set controls the rate at which specific notifications are generated. The second set provides thresholds used to trigger the notifications. These objects are listed in . A third set of read-write objects sets limits on resource consumption per NAT instance and per subscriber. When these limits are reached, packets requiring further consumption of the given resource are dropped rather than translated. Statistics described in record the numbers of packets so dropped. Limits are provided for: total number of address map entries over the NAT instance. Limit is set by object natv2InstanceLimitAddressMapEntries in table natv2InstanceTable. Dropped packets are counted in natv2InstanceAddressMapEntryLimitDrops in that table. total number of port map entries over the NAT instance. Limit is set by object natv2InstanceLimitPortMapEntries in table natv2InstanceTable. Dropped packets are counted in natv2InstancePortMapEntryLimitDrops in that table. total number of held fragments (applicable only when the NAT instance can receive fragments out of order; see Section 11). Limit is set by object natv2InstanceLimitPendingFragments in table natv2InstanceTable. Dropped packets are counted by natv2InstanceFragmentDrops in the same table. total number of active subscribers (i.e., subscribers having at least one mapping table entry) over the NAT instance. Limit is set by object natv2InstanceLimitSubscriberActives in table natv2InstanceTable. Dropped packets are counted by natv2InstanceSubscriberActiveLimitDrops in the same table. number of port map entries for an individual subscriber. Limit is set by object natv2SubscriberLimitPortMapEntries in table natv2SubscriberTable. Dropped packets are counted by natv2SubscriberPortMapFailureDrops in the same table. Note that, unlike in the instance table, the per-subscriber count is lumped in with the count of packets dropped because of failures to allocate a port map entry for other reasons to save on storage.

NATV2-MIB provides five notifications, intended to provide warning of the need to provision or reallocate NAT resources. As indicated in the previous section, each notification is associated with two read-write objects: a control on the rate at which that notification is generated, and a threshold value used to trigger the notification in the first place. The default setting within the MIB module specification is that all notifications are disabled. The setting of threshold values is discussed in . The five notifications are as follows: Two notifications relate to the management of address pools. One indicates that usage equals or exceeds an upper threshold, and is therefore a warning that the pool may be over-utilized unless more addresses are assigned to it. The other notification indicates that usage equals or has fallen below a lower threshold, suggesting that some addresses allocated to that pool could be reallocated to other pools. Address pool usage is calculated as the percentage of the total number of ports allocated to the address pool that are already in use, for the most-mapped protocol at the time the notification is generated. The notifications identify that protocol and report the number of port map entries for that protocol in the given address pool at the moment the notification was triggered. Two notifications relate to the number of address and port map entries respectively, in total over the whole NAT instance. In both cases the threshold that triggers the notification is an upper threshold. The notifications return the number of mapping entries of the given type, plus a cumulative counter of the number of entries created in that mapping table at the moment the notification was triggered. The intent is that the notifications provide a warning that the total number of address or port map entries is approaching the configured limit. The final notification is generated on a per-subscriber basis when the number of port map entries for that subscriber crosses the associated threshold. The objects returned by this notification are similar to those returned for the instance-level mapping notifications. This notification is a warning that the number of port map entries for the subscriber is approaching the configured limit for that subscriber. Here is a detailed specification of the notifications. A given notification can be disabled by setting the threshold to 0 (default), with the exception noted below. Notification: natv2NotificationPoolUsageLow. Indicates that address pool usage for the most-mapped protocol equals or is less than the threshold value. natv2PoolNotifiedPortMapEntries as a percentage of total available ports in the pool. natv2PoolThresholdUsageLow in natv2PoolTable. To allow for a threshold of zero usage, disabling of the natv2NotificationPoolUsageLow is done by setting natv2PoolThresholdUsageLow to -1 rather than 0, in contrast to all of the other notifications. natv2PoolNotifiedPortMapEntries and natv2PoolNotifiedPortMapProtocol in natv2PoolTable; natv2PoolNotificationInterval in natv2PoolTable (default 20 seconds between notifications for a given address pool). Notification: natv2NotificationPoolUsageHigh. Indicates that address pool usage for the most-mapped protocol has risen to the threshold value or more. natv2PoolNotifiedPortMapEntries as a percentage of total available ports in the pool. natv2PoolThresholdUsageHigh in natv2PoolTable; natv2PoolNotifiedPortMapEntries, natv2PoolNotifiedPortMapProtocol in natv2PoolTable; natv2PoolNotificationInterval in natv2PoolTable (default 20 seconds between notifications for a given address pool). Notification: natv2NotificationInstanceAddressMapEntriesHigh. Indicates that the total number of entries in the address map table over the whole NAT instance equals or exceeds the threshold value. natv2InstanceAddressMapEntries in natv2InstanceTable; natv2InstanceThresholdAddressMapEntriesHigh in natv2InstanceTable; natv2InstanceAddressMapEntries, natv2InstanceAddressMapCreations in natv2InstanceTable; natv2InstanceNotificationInterval in natv2InstanceTable (default 10 seconds between notifications for a given NAT instance). Notification: natv2NotificationInstancePortMapEntriesHigh. Indicates that the total number of entries in the port map table over the whole NAT instance equals or exceeds the threshold value. natv2InstancePortMapEntries in natv2InstanceTable; natv2InstanceThresholdPortMapEntriesHigh in natv2InstanceTable; natv2InstancePortMapEntries, natv2InstancePortMapCreations in natv2InstanceTable; natv2InstanceNotificationInterval in natv2InstanceTable (default 10 seconds between notifications for a given NAT instance). Notification: natv2NotificationSubscriberPortMapEntriesHigh. Indicates that the total number of entries in the port map table for the given subscriber equals or exceeds the threshold value configured for that subscriber. natv2SubscriberPortMapEntries in natv2SubscriberTable; natv2SubscriberThresholdPortMapEntriesHigh in natv2SubscriberTable; natv2SubscriberPortMapEntries, natv2SubscriberPortMapCreations in natv2SubscriberTable; natv2SubscriberNotificationInterval in natv2SubscriberTable (default 60 seconds between notifications for a given subscriber).

State information provides a snapshot of the content and extent of the NAT mapping tables at a given moment of time. The address and port mapping tables are described in detail below. In addition to these tables, two state variables are provided: current number of entries in the address mapping table, and current number of entries in the port mapping table. With one exception, these are provided at four levels of granularity: per NAT instance, per protocol, per address pool, and per subscriber. Address map entries are not tracked per protocol, since address mapping is protocol-independent.

NATV2-MIB provides a number of counters, intended to help both with provisioning of the NAT and debugging of problems. As with the state data, these counters are provided at the four levels of NAT instance, protocol, address pool, and subscriber when they make sense. Each counter is cumulative beginning from a "last discontuity time" recorded by an object that is usually in the table containing the counter. The basic set of counters, as reflected in the NAT instance table, is as follows: number of packets processed and translated (in this case, in total for the NAT instance); cumulative number of address map entries created, including static mappings; cumulative number of port map entries created, including static mappings; cumulative number of packets dropped rather than translated because the packet would have triggered the creation of a new address mapping, but the configured limit on number of address map entries has already been reached. cumulative number of packets dropped rather than translated because the packet would have triggered the creation of a new port mapping, but the configured limit on number of port map entries has already been reached. cumulative number of packets dropped rather than translated because the packet would have triggered the creation of a new address and/or port mapping for a subscriber with no existing entries in either table, but the configured limit on number of active subscribers has already been reached. cumulative number of packets dropped because the packet would have triggered the creation of a new address mapping, but no address could be allocated in the external realm concerned because all addresses from the selected address pool (or the whole realm, if no address pool has been configured for that realm) have already been fully allocated. cumulative number of packets dropped because the packet would have triggered the creation of a new port mapping, but no port could be allocated for the protocol concerned. The precise conditions under which these packet drops occur depend on the pooling behavior configured or implemented in the NAT instance. See the DESCRIPTION clause for the natv2InstancePortMapFailureDrops object for a detailed description of the different cases. These cases were defined with care to ensure that address mapping failure could be distinguished from port mapping failure. cumulative number of packets dropped because the packet contains a fragment and the fragment behavior configured or implemented in the NAT instance indicates that the packet should be dropped. The main case is a NAT instance that meets REQ-14 of , hence can receive and process out-of-order fragments. In that case, dropping occurs only when the configured limit on pending fragments provided by NATV2-MIB has already been reached. The other cases are detailed in the DESCRIPTION clause of the natv2InstanceFragmentBehavior object. cumulative number of packets dropped because of unavailability of some other resource. The most likely case would be packets where the upper layer protocol is not one supported by the NAT instance. indicates the granularities at which these statistics are reported. Statistic NAT Instance Protocol Pool Subscriber Translations Yes Yes No Yes Address map entry creations Yes No Yes Yes Port map entry creations Yes Yes Yes Yes Address map limit drops Yes No No No Port map limit drops Yes No No Yes Active subscriber limit drops Yes No No No Address mapping failure drops Yes No Yes Yes Port mapping failure drops Yes Yes Yes Yes Fragment drops Yes No No No Other resource drops Yes No No No

shows how object identifiers are organized in the NATV2-MIB module. Under the general natv2MIB object identifier in the mib-2 tree, the objects are classed into four groups: identifies the five notifications described in ; identifies objects relating to the whole device, specifically, the subscriber table. identifies objects relating to individual NAT instances. These include the NAT instance table, the protocol table, the address pool table and its address range expansion, the address map table, and the port map table. identifies the group and compliance clauses, specified for the three application scenarios described in .

This section reviews the contents of the NATV2-MIB module. The table descriptions include references to subsections of where desirable to avoid repetition of that information.

The module defines four key textual conventions: ProtocolNumber, Natv2SubscriberIndex, Natv2InstanceIndex, and Natv2PoolIndex. ProtocolNumber is based on the IANA registry of protocol numbers, hence is potentially reusable by other MIB modules. Objects of type Natv2SubscriberIndex identify individual subscribers served by the the NAT device. The values of these identifiers are administered and, in intent, are permanently associated with their respective subscribers. Reuse of a value after a subscriber has been deleted is discouraged. The scope of the subscriber index was defined to be at device rather than NAT instance level to make it easier to shift subscribers between instances (e.g., for load balancing). Objects of type Natv2InstanceIndex identify specific NAT instances on the device. Again, these are administered values intended to be permanently associated with the NAT instances to which they have been assigned. Objects of type Natv2PoolIndex identify individual address pools in a given NAT instance. As with the subscriber and instance index objects, the pool identifiers are administered and intended to be permanently associated with their respective pools.

Notifications were described in .

Table natv2SubscriberTable is indexed by subscriber index. One conceptual row contains information relating to a specific subscriber: the subscriber's internal address or prefix for correlation with other management information; state and statistical information as described in and , the per- subscriber control objects described in , and natv2SubscriberDiscontinuityTime, which provides a timestamp of the latest time following which the statistics have accumulated without discontinuity. Turning back to the address information for a moment: this information includes the identity of the address realm in which the address is routable. That enables support of an arbitrary number of address realms on the same NAT instance. Address realm identifiers are administered values in the form of a limited-length SnmpAdminString. In the absence of configuration to the contrary, the default realm for all internal addresses as recorded in mapping entries is "internal". The term "address realm" is defined in Section 2.1 and reused in subsequent NAT-related documents. In the special case of DS-Lite , for unique matching of the subscriber data to other information in the MIB module, it is necessary that the address information should relate to the outer IPv6 header of packets going to or from the host, with the address realm being the one in which that IPv6 address is routable. The presentation of address information for other types of tunneled access to the NAT is out of scope.

Table natv2InstanceTable is indexed by an object of type Natv2InstanceIndex. A conceptual row of this table provides information relating to a particular NAT instance configured on the device. Configuration information provided by this table includes an instance name of type DisplayString that may have been configured for this instance, and a set of objects indicating respectively the port mapping, filtering, pooling, and fragment behaviors configured or implemented in the instance. These behaviors are all defined in . Their values affect the interpretation of some of the statistics provided in the instance table. Read-write objects listed in set the notification rate for instance-level notifications and set the thresholds that trigger them. Additional read-write objects described in set limits on the number of address and port mapping entries, number of pending fragments, and number of active subscribers for the instance. The state and statistical information provided by this table consists of the per-instance items described in and respectively. natv2InstanceDiscontinuityTime is a timestamp giving the time beyond which all of the statistical counters in natv2InstanceTable are guaranteed to have accumulated continuously.

The protocol table is indexed by the NAT instance number and an object of type ProtocolNumber as described in (i.e., an IANA-registered protocol number). The set of protocols supported by the NAT instance is implementation-dependent, but MUST include ICMP(1), TCP(6), UDP(17), and ICMPv6(58). Depending on the application, it SHOULD include IPv4 encapsulation(4), IPv6 encapsulation(41), IPSec AH(51), and SCTP(132). Support of PIM(103) is highly desirable. This table includes no configuration information. The state and statistical information provided by this table consists of the per-protocol items described in and respectively. natv2InstanceDiscontinuityTime in natv2InstanceTable is reused as the timestamp giving the time beyond which all of the statistical counters in natv2ProtocolTable are guaranteed to have accumulated continuously. The reasoning is that any event affecting the continuity of per-protocol statistics will affect the continuity of NAT instance statistics, and vice versa.

The address pool table is indexed by the NAT instance identifier for the instance on which it is provisioned, plus a pool index of type Natv2PoolIndex. Configuration information provided includes the address realm for which the pool provides addresses, the type of address (IPv4 or IPv6) supported by the realm, plus the port range it makes available for allocation. The same set of port numbers (or, in the ICMP case, identifier values), is made available for every protocol supported by the NAT instance. The port range is specified in terms of minimum and maximum port number. The state and statistical information provided by this table consists of the per-pool items described in and respectively, plus two additional state objects described below. natv2PoolTable provides the pool-specific object natv2PoolDiscontinuityTime to indicate the time since which the statistical counters have accumulated continuously. Read-write objects to set high and low thresholds for pool usage notifications and for governing notification rate were identified in . The default interval between notifications for a given address pool is set to 20 seconds. Implementation note: the thresholds are defined in terms of percentage of available port utilization. The number of available ports in a pool is equal to (max port - min port + 1) (from the natv2PoolTable configuration information) multiplied by the number of addresses provisioned in the pool (sum of number of addresses provided by each natv2PoolRangeTable conceptual row relating to that pool). At configuration time, the thresholds can be recalculated in terms of total number of port map entries corresponding to the configured percentage, so that runtime comparisons to the current number of port map entries require no further arithmetic operations. natv2PoolTable also provides two state objects that are returned with the notifications. natv2PoolNotifiedPortMapProtocol identifies the most-mapped protocol at the time the notification was triggered. natv2PoolNotifiedPortMapEntries provides the total number of port map entries for that protocol using addresses owned by this pool at that same time.

natv2PoolRangeTable provides configuration information only. It is an expansion of natv2PoolTable giving the address ranges with which a given address pool has been configured. As such, it is indexed by the combination of NAT instance index, address pool index, and a conceptual row index, where each conceptual row conveys a different address range. The address range is specified in terms of lowest address, highest address rather than the usual prefix notation to provide maximum flexibility.

The address map table provides a table of mappings from internal to external address at a given moment. It is indexed by the combination of NAT instance index, internal realm, internal address type (IPv4 or IPv6) in that realm, the internal address of the local host for which the map entry was created, and a conceptual row index to traverse all of the entries relating to the same internal address. In the special case of DS-Lite , the internal address and realm used in the index are those of the IPv6 outer header. The IPv4 source address for the inner header, for which has reserved addresses in the 192.0.0.0/29 range, is captured in two additional objects in the corresponding conceptual row: natv2AddressMapInternalMappedAddressType, and natv2AddressMapInternalMappedAddress. In cases other than DS-Lite access these objects have no meaning. (Other tunneled access is out of scope.) The additional information provided by natv2AddressMapTable consists of the external realm, address type in that realm, and mapped external address. Depending on implementation support, the table also provides the index of the address pool from which the external address was drawn and the index of the subscriber to which the map entry belongs.

The port map table provides a table of mappings by protocol from external port, address, and realm to internal port, address, and realm. As such, it is indexed by the combination of NAT instance index, protocol number, external realm identifier, address type in that realm, external address, and external port. The mapping from external realm, address, and port to internal realm, address, and port is unique, so no conceptual row index is needed. The indexing is designed to make it easy to trace individual sessions back to the host, based on the contents of packets observed in the external realm. Beyond the indexing, the information provided by the port map table consists of the internal realm, address type, address, and port number, and, depending on implementation support, the index of the subscriber to which the map entry belongs. As with the address map table, special provision is made for the case of DS-Lite . The realm and outgoing source address are those for the outer header, and the address type is IPv6. Additional objects natv2PortMapInternalMappedAddressType and natv2PortMapInternalMappedAddress capture the outgoing source address in the inner header, which will be in the well-known 192.0.0.0/29 range.

The conformance statements in NATV2-MIB provide for three application scenarios: basic NAT, NAT supporting address pools, and carrier grade NAT (CGN). A basic NAT MAY limit the number of NAT instances it supports to one, but MUST support indexing by NAT instance. Similarly, a basic NAT MAY limit the number of realms it supports to two. By definition, a basic NAT is not required to support the subscriber table, the address pool table, or the address pool address range table. Some individual objects in other tables are also not relevant to basic NAT. A NAT supporting address pools adds the address pool table and the address pool address range table to what it implements. Some individual objects in other tables also need to be implemented. A NAT supporting address pools MUST support more than two realms. Finally, a CGN MUST support the full contents of the MIB module. That includes the subscriber table, but also includes the special provision for DS-Lite access in the address and port map tables.

This MIB module IMPORTs objects from , , , , and .

." ::= { natv2MIBInstanceObjects 4 } natv2PoolRangeEntry OBJECT-TYPE SYNTAX Natv2PoolRangeEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "NAT pool address range." INDEX { natv2PoolRangeInstanceIndex, natv2PoolRangePoolIndex, natv2PoolRangeRowIndex } ::= { natv2PoolRangeTable 1 } Natv2PoolRangeEntry ::= SEQUENCE { natv2PoolRangeInstanceIndex Natv2InstanceIndex, natv2PoolRangePoolIndex Natv2PoolIndex, natv2PoolRangeRowIndex Unsigned32, natv2PoolRangeBegin InetAddress, natv2PoolRangeEnd InetAddress } natv2PoolRangeInstanceIndex OBJECT-TYPE SYNTAX Natv2InstanceIndex MAX-ACCESS not-accessible STATUS current DESCRIPTION "Index of the NAT instance on which the address pool and this address range are configured. See Natv2InstanceIndex." ::= { natv2PoolRangeEntry 1 } natv2PoolRangePoolIndex OBJECT-TYPE SYNTAX Natv2PoolIndex MAX-ACCESS not-accessible STATUS current DESCRIPTION "Index of the address pool to which this address range belongs. See Natv2PoolIndex." ::= { natv2PoolRangeEntry 2 } natv2PoolRangeRowIndex OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS not-accessible STATUS current DESCRIPTION "Row index for successive range entries for the same address pool." ::= { natv2PoolRangeEntry 3 } natv2PoolRangeBegin OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "Lowest address included in this range. The type of address (IPv4 or IPv6) is given by natv2PoolAddressType in natv2PoolTable." ::= { natv2PoolRangeEntry 4 } natv2PoolRangeEnd OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "Highest address included in this range. The type of address (IPv4 or IPv6) is given by natv2PoolAddressType in natv2PoolTable." ::= { natv2PoolRangeEntry 5 } -- indexed mapping tables -- Address Map Table. Mapped from internal to external address. natv2AddressMapTable OBJECT-TYPE SYNTAX SEQUENCE OF Natv2AddressMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Table of mappings from internal to external address. By definition, this is a snapshot of NAT instance state at a given moment. Indexed by NAT instance, internal realm, and internal address in that realm. Provides the mapped external address and, depending on implementation support, identifies the address pool from which the external address and port were taken and the index of the subscriber to which the mapping has been allocated. In the case of DS-Lite [RFC 6333], the indexing realm and address are those of the IPv6 encapsulation rather than the IPv4 inner packet." REFERENCE "RFC yyyy Section 3.3.8. DS-Lite: RFC 6333" ::= { natv2MIBInstanceObjects 5 } natv2AddressMapEntry OBJECT-TYPE SYNTAX Natv2AddressMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Mapping from internal to external address." INDEX { natv2AddressMapInstanceIndex, natv2AddressMapInternalRealm, natv2AddressMapInternalAddressType, natv2AddressMapInternalAddress, natv2AddressMapRowIndex } ::= { natv2AddressMapTable 1 } Natv2AddressMapEntry ::= SEQUENCE { natv2AddressMapInstanceIndex Natv2InstanceIndex, natv2AddressMapInternalRealm SnmpAdminString, natv2AddressMapInternalRealmAddressType InetAddressType, natv2AddressMapInternalRealmAddress InetAddress, natv2AddressMapRowIndex Unsigned32, natv2AddressMapInternalMappedAddressType InetAddressType, natv2AddressMapInternalMappedAddress InetAddress, natv2AddressMapExternalRealm SnmpAdminString, natv2AddressMapExternalAddressType InetAddressType, natv2AddressMapExternalAddress InetAddress, natv2AddressMapExternalPoolIndex Natv2PoolIndexOrZero, natv2AddressMapSubscriberIndex Natv2SubscriberIndexOrZero } natv2AddressMapInstanceIndex OBJECT-TYPE SYNTAX Natv2InstanceIndex MAX-ACCESS not-accessible STATUS current DESCRIPTION "Index of the NAT instance that generated this address map." ::= { natv2AddressMapEntry 1 } natv2AddressMapInternalRealm OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(0..32)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "Realm to which the internal address belongs. In most cases this is the realm defining the address space of the packet being translated. However, in the case of DS-Lite [RFC 6333], this realm defines the IPv6 outer header address space. It is the combination of that outer header and the inner IPv4 packet header that is remapped to the external address and realm. The corresponding IPv4 realm is restricted in scope to the tunnel, so there is no point in identifying it. The mapped IPv4 address will normally be the well-known value 192.0.0.2, or at least lie in the reserved 192.0.0.0/29 range. If natv2AddressMapSubscriberIndex in this table is a valid subscriber index (i.e., greater than zero), then the value of natv2AddressMapInternalRealm MUST be identical to the value of natv2SubscriberRealm associated with that index." REFERENCE "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and Section 6.6 on the need to have the IPv6 tunnel address in the NAT mapping tables." ::= { natv2AddressMapEntry 2 } natv2AddressMapInternalRealmAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-only STATUS current DESCRIPTION "Address type in the header of packets on the interior side of this mapping. Any value other than ipv4(1) or ipv6(2) would be unexpected. In the DS-Lite case, the address type is ipv6(2)." REFERENCE "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and Section 6.6 on the need to have the IPv6 tunnel source address in the NAT mapping tables." ::= { natv2AddressMapEntry 3 } natv2AddressMapInternalRealmAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "Source address of packets originating from the interior of the association provided by this mapping. In the case of DS-Lite [RFC 6333], this is the IPv6 tunnel source address. The mapping in this case is considered to be from the combination of the IPv6 tunnel source address natv2AddressMapInternalRealmAddress and the well-known IPv4 inner source address natv2AddressMapInternalMappedAddress to the external address." REFERENCE "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and Section 6.6 on the need to have the IPv6 tunnel address in the NAT mapping tables." ::= { natv2AddressMapEntry 4 } natv2AddressMapRowIndex OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS not-accessible STATUS current DESCRIPTION "Index of a conceptual row corresponding to a mapping of the given internal realm and address to a single external realm and address. Multiple rows will be present because of a promiscuous external address selection policy, policies associating the same internal address with different address pools, or because the same internal realm-address combination is communicating with multiple external address realms." ::= { natv2AddressMapEntry 5 } natv2AddressMapInternalMappedAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-only STATUS current DESCRIPTION "Internal address type actually translated by this mapping. Any value other than ipv4(1) or ipv6(2) would be unexpected. In the general case, this is the same as given by natv2AddressMapInternalRealmAddressType. In the tunneled case it is the address type used in the encapsulated packet header. In particular, in the DS-Lite case, the mapped address type is ipv4(1)." REFERENCE "DS-Lite: RFC 6333." ::= { natv2AddressMapEntry 6 } natv2AddressMapInternalMappedAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "Internal address actually translated by this mapping. In the general case, this is the same as natv2AddressMapInternalRealmAddress. In the case of DS-Lite [RFC 6333], this is the source address of the encapsulated IPv4 packet, normally lying the well-known range 192.0.0.0/29. The mapping in this case is considered to be from the combination of the IPv6 tunnel source address natv2AddressMapInternalRealmAddress and the well-known IPv4 inner source address natv2AddressMapInternalMappedAddress to the external address." REFERENCE "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and Section 6.6 on the need to have the IPv6 tunnel address in the NAT mapping tables." ::= { natv2AddressMapEntry 7 } natv2AddressMapExternalRealm OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(0..32)) MAX-ACCESS read-only STATUS current DESCRIPTION "External address realm to which this mapping maps the internal address. This can be the same as the internal realm in the case of a 'hairpin' connection, but otherwise will be different." ::= { natv2AddressMapEntry 8 } natv2AddressMapExternalAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-only STATUS current DESCRIPTION "Address type for the external realm. Any value other than ipv4(1) or ipv6(2) would be unexpected." ::= { natv2AddressMapEntry 9 } natv2AddressMapExternalAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "External address to which the internal address is mapped. In the DS-Lite case, the mapping is from the combination of the internal IPv6 tunnel source address as presented in this table and the well-known IPv4 source address of the encapsulated IPv4 packet." REFERENCE "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and Section 6.6 on the need to have the IPv6 tunnel address in the NAT mapping tables." ::= { natv2AddressMapEntry 10 } natv2AddressMapExternalPoolIndex OBJECT-TYPE SYNTAX Natv2PoolIndexOrZero MAX-ACCESS read-only STATUS current DESCRIPTION "Index of the address pool in the external realm from which the mapped external address given in natv2AddressMapExternalAddress was taken. Zero if the implementation does not support address pools but has chosen to support this object, or if no pool was configured for the given external realm." ::= { natv2AddressMapEntry 11 } natv2AddressMapSubscriberIndex OBJECT-TYPE SYNTAX Natv2SubscriberIndexOrZero MAX-ACCESS read-only STATUS current DESCRIPTION "Index of the subscriber to which this address mapping applies, or zero if no subscribers are configured on this NAT instance." ::= { natv2AddressMapEntry 12 } -- natv2PortMapTable natv2PortMapTable OBJECT-TYPE SYNTAX SEQUENCE OF Natv2PortMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Table of port map entries indexed by NAT instance, protocol, and external realm and address. A port map entry associates an internal upper layer protocol endpoint with an endpoint for the same protocol in the given external realm. By definition, this is a snapshot of NAT instance state at a given moment. The table provides the basic mapping information. In the case of DS-Lite [RFC 6333], the table provides the internal IPv6 tunnel source address in natv2PortMapInternalRealmAddress and the IPv4 source address of the encapsulated packet that is actually translated in natv2PortMapInternalMappedAddress. In the general (non-DS- Lite) case, those two objects will have the same value." REFERENCE "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and Section 6.6 on the need to have the IPv6 tunnel address in the NAT mapping tables." REFERENCE "RFC yyyy Section 3.3.9 ::= { natv2MIBInstanceObjects 6 } natv2PortMapEntry OBJECT-TYPE SYNTAX Natv2PortMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A single NAT mapping." INDEX { natv2PortMapInstanceIndex, natv2PortMapProtocol, natv2PortMapExternalRealm, natv2PortMapExternalAddressType, natv2PortMapExternalAddress, natv2PortMapExternalPort } ::= { natv2PortMapTable 1 } Natv2PortMapEntry ::= SEQUENCE { natv2PortMapInstanceIndex Natv2InstanceIndex, natv2PortMapProtocol ProtocolNumber, natv2PortMapExternalRealm SnmpAdminString, natv2PortMapExternalAddressType InetAddressType, natv2PortMapExternalAddress InetAddress, natv2PortMapExternalPort InetPortNumber, natv2PortMapInternalRealm SnmpAdminString, natv2PortMapInternalRealmAddressType InetAddressType, natv2PortMapInternalRealmAddress InetAddress, natv2PortMapInternalMappedAddressType InetAddressType, natv2PortMapInternalMappedAddress InetAddress, natv2PortMapInternalPort InetPortNumber, natv2PortMapExternalPool Natv2PoolIndexOrZero, natv2PortMapSubscriberIndex Natv2SubscriberIndexOrZero } natv2PortMapInstanceIndex OBJECT-TYPE SYNTAX Natv2InstanceIndex MAX-ACCESS not-accessible STATUS current DESCRIPTION "Index of the NAT instance that created this port map entry." ::= { natv2PortMapEntry 1 } natv2PortMapProtocol OBJECT-TYPE SYNTAX ProtocolNumber MAX-ACCESS not-accessible STATUS current DESCRIPTION "The map entry's upper layer protocol number." ::= { natv2PortMapEntry 2 } natv2PortMapExternalRealm OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(0..32)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The realm to which natv2PortMapExternalAddress belongs." ::= { natv2PortMapEntry 3 } natv2PortMapExternalAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS not-accessible STATUS current DESCRIPTION "Address type for the external realm. A value other than ipv4(1) or ipv6(2) would be unexpected." ::= { natv2PortMapEntry 4 } natv2PortMapExternalAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "The mapping's assigned external address. (This address is taken from the address pool identified by natv2PortMapExternalPoolIndex, if the implementation supports address pools and pools are configured for the given external realm.) This is the source address for translated outgoing packets." ::= { natv2PortMapEntry 5 } natv2PortMapExternalPort OBJECT-TYPE SYNTAX InetPortNumber MAX-ACCESS not-accessible STATUS current DESCRIPTION "The mapping's assigned external port number. This is the source port for translated outgoing packets. If the internal port number given by natv2PortMapInternalPort is zero this value MUST also be zero. Otherwise this MUST be a non-zero value." ::= { natv2PortMapEntry 6 } natv2PortMapInternalRealm OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(0..32)) MAX-ACCESS read-only STATUS current DESCRIPTION "The realm to which natv2PortMapInternalRealmAddress belongs. In the general case, this realm contains the address that is being translated. In the DS-Lite [RFC 6333] case, this realm defines the IPv6 address space from which the tunnel source address is taken. The realm of the encapsulated IPv4 address is restricted in scope to the tunnel, so there is no point in identifying it separately." REFERENCE "RFC 6333 DS-Lite." ::= { natv2PortMapEntry 7 } natv2PortMapInternalRealmAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-only STATUS current DESCRIPTION "Address type for addresses in the realm identified by natv2PortMapInternalRealm." ::= { natv2PortMapEntry 8 } natv2PortMapInternalRealmAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "Source address for packets received under this mapping on the internal side of the NAT instance. In the general case this address is the same as the address given in natv2PortMapInternalMappedAddress. In the DS-Lite case, natv2PortMapInternalRealmAddress is the IPv6 tunnel source address." REFERENCE "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and Section 6.6 on the need to have the IPv6 tunnel address in the NAT mapping tables." ::= { natv2PortMapEntry 9 } natv2PortMapInternalMappedAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-only STATUS current DESCRIPTION "Internal address type actually translated by this mapping. Any value other than ipv4(1) or ipv6(2) would be unexpected. In the general case, this is the same as given by natv2AddressMapInternalRealmAddressType. In the DS-Lite case, the address type is ipv4(1)." REFERENCE "DS-Lite: RFC 6333." ::= { natv2PortMapEntry 10 } natv2PortMapInternalMappedAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "Internal address actually translated by this mapping. In the general case, this is the same as natv2PortMapInternalRealmAddress. In the case of DS-Lite [RFC 6333], this is the source address of the encapsulated IPv4 packet, normally selected from the well-known range 192.0.0.0/29. The mapping in this case is considered to be from the external address to the combination of the IPv6 tunnel source address natv2PortMapInternalRealmAddress and the well-known IPv4 inner source address natv2PortMapInternalMappedAddress." REFERENCE "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and Section 6.6 on the need to have the IPv6 tunnel address in the NAT mapping tables." ::= { natv2PortMapEntry 11 } natv2PortMapInternalPort OBJECT-TYPE SYNTAX InetPortNumber MAX-ACCESS read-only STATUS current DESCRIPTION "The mapping's internal port number. If this is zero, ports are not translated (i.e., the NAT instance is a pure NAT rather than a NAPT)." ::= { natv2PortMapEntry 12 } natv2PortMapExternalPoolIndex OBJECT-TYPE SYNTAX Natv2PoolIndexOrZero MAX-ACCESS read-only STATUS current DESCRIPTION "Identifies the address pool from which the external address in this port map entry was taken. Zero if the implementation does not support address pools but has chosen to support this object, or if no pools are configured for the given external realm." natv2PortMapSubscriberIndex OBJECT-TYPE SYNTAX Natv2SubscriberIndexOrZero MAX-ACCESS read-only STATUS current DESCRIPTION "Subscriber using this map entry. Zero if the implementation does not support subscribers but has chosen to support this object." ::= { natv2PortMapEntry 13 } -- Conformance section. Specifies three cumulatively more extensive -- applications: basic NAT, pooled NAT, and carrier grade NAT natv2MIBConformance OBJECT IDENTIFIER ::= { natv2MIB 3 } natv2MIBCompliances OBJECT IDENTIFIER ::= { natv2MIBConformance 1 } natv2MIBGroups OBJECT IDENTIFIER ::= { natv2MIBConformance 2 } natv2MIBBasicCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "Describes the requirements for conformance to the basic NAT application of NATv2 MIB." MODULE -- this module MANDATORY-GROUPS { natv2BasicNotificationGroup, natv2BasicInstanceLevelGroup } GROUP natv2BasicNotificationGroup DESCRIPTION "The natv2BasicNotificationGroup is mandatory for all NAT applications." GROUP natv2BasicInstanceLevelGroup DESCRIPTION "The natv2BasicInstanceLevelGroup is mandatory for all NAT applications." ::= { natv2MIBCompliances 1 } natv2MIBPooledNATCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "Describes the requirements for conformance to the pooled NAT application of NATv2-MIB." MODULE -- this module MANDATORY-GROUPS { natv2BasicNotificationGroup, natv2BasicInstanceLevelGroup, natv2PooledNotificationGroup, natv2PooledInstanceLevelGroup } GROUP natv2BasicNotificationGroup DESCRIPTION "The natv2BasicNotificationGroup is mandatory for all NAT applications." GROUP natv2BasicInstanceLevelGroup DESCRIPTION "The natv2BasicInstanceLevelGroup is mandatory for all NAT applications." GROUP natv2PooledNotificationGroup DESCRIPTION "The natv2PooledNotificationGroup is mandatory for the pooled and CGN applications." GROUP natv2PooledInstanceLevelGroup DESCRIPTION "The natv2PooledInstanceLevelGroup is mandatory for the pooled and CGN applications." ::= { natv2MIBCompliances 2 } natv2MIBCGNCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "Describes the requirements for conformance to the carrier grade NAT application of NATv2-MIB." MODULE -- this module MANDATORY-GROUPS { natv2BasicNotificationGroup, natv2BasicInstanceLevelGroup, natv2PooledNotificationGroup, natv2PooledInstanceLevelGroup, natv2CGNNotificationGroup, natv2CGNDeviceLevelGroup, natv2CGNInstanceLevelGroup } GROUP natv2BasicNotificationGroup DESCRIPTION "The natv2BasicNotificationGroup is mandatory for all NAT applications." GROUP natv2BasicInstanceLevelGroup DESCRIPTION "The natv2BasicInstanceLevelGroup is mandatory for all NAT applications." GROUP natv2PooledNotificationGroup DESCRIPTION "The natv2PooledNotificationGroup is mandatory for the pooled and CGN applications." GROUP natv2PooledInstanceLevelGroup DESCRIPTION "The natv2PooledInstanceLevelGroup is mandatory for the pooled and CGN applications." GROUP natv2CGNNotificationGroup DESCRIPTION "The natv2CGNNotificationGroup is mandatory for the carrier grade NAT application." GROUP natv2CGNDeviceLevelGroup DESCRIPTION "The natv2CGNDeviceLevelGroup is mandatory for the carrier grade NAT application." GROUP natv2CGNInstanceLevelGroup DESCRIPTION "The natv2CGNInstanceLevelGroup is mandatory for the carrier grade NAT application." ::= { natv2MIBCompliances 3 } -- Groups natv2BasicNotificationGroup NOTIFICATION-GROUP NOTIFICATIONS { natv2NotificationInstanceAddressMapEntriesHigh, natv2NotificationInstancePortMapEntriesHigh } STATUS current DESCRIPTION "Notifications that MUST be supported by all NAT applications." ::= { natv2MIBGroups 1 } natv2BasicInstanceLevelGroup OBJECT-GROUP OBJECTS { -- from natv2InstanceTable natv2InstanceIndex, natv2InstanceAlias, natv2InstancePortMappingBehavior, natv2InstanceFilteringBehavior, natv2InstanceFragmentBehavior, natv2InstanceAddressMapEntries, natv2InstancePortMapEntries, natv2InstanceTranslations, natv2InstanceAddressMapCreations, natv2InstanceAddressMapEntryLimitDrops, natv2InstanceAddressMapFailureDrops, natv2InstancePortMapCreations, natv2InstancePortMapEntryLimitDrops, natv2InstancePortMapFailureDrops, natv2InstanceFragmentDrops, natv2InstanceOtherResourceFailureDrops, natv2InstanceDiscontinuityTime, natv2InstanceThresholdAddressMapEntriesHigh, natv2InstanceThresholdPortMapEntriesHigh, natv2InstanceNotificationInterval, natv2InstanceLimitAddressMapEntries, natv2InstanceLimitPortMapEntries, natv2InstanceLimitPendingFragments, -- from natv2ProtocolTable natv2ProtocolInstanceIndex, natv2ProtocolNumber, natv2ProtocolPortMapEntries, natv2ProtocolTranslations, natv2ProtocolPortMapCreations, natv2ProtocolPortMapFailureDrops, natv2ProtocolOtherResourceFailureDrops, -- from natv2AddressMapTable natv2AddressMapInstanceIndex, natv2AddressMapInternalRealm, natv2AddressMapInternalRealmAddressType, natv2AddressMapInternalRealmAddress, natv2AddressMapRowIndex, natv2AddressMapExternalRealm, natv2AddressMapExternalAddressType, natv2AddressMapExternalAddress, -- from natv2PortMapTable natv2PortMapInstanceIndex, natv2PortMapProtocol, natv2PortMapExternalRealm, natv2PortMapExternalAddressType, natv2PortMapExternalAddress, natv2PortMapExternalPort, natv2PortMapInternalRealm, natv2PortMapInternalRealmAddressType, natv2PortMapInternalRealmAddress, natv2PortMapInternalPort } STATUS current DESCRIPTION "Per-instance objects that MUST be supported by implementations of all NAT applications." ::= { natv2MIBGroups 2 } natv2PooledNotificationGroup NOTIFICATION-GROUP NOTIFICATIONS { natv2NotificationPoolUsageLow, natv2NotificationPoolUsageHigh } STATUS current DESCRIPTION "Notifications that MUST be supported by pooled and carrier-grade NAT applications." ::= { natv2MIBGroups 3 } natv2PooledInstanceLevelGroup OBJECT-GROUP OBJECTS { -- from natv2InstanceTable natv2InstancePoolingBehavior, -- from natv2PoolTable natv2PoolInstanceIndex, natv2PoolIndex, natv2PoolRealm, natv2PoolAddressType, natv2PoolMinimumPort, natv2PoolMaximumPort, natv2PoolAddressMapEntries natv2PoolPortMapEntries natv2PoolAddressMapCreations, natv2PoolPortMapCreations natv2PoolAddressMapFailureDrops, natv2PoolPortMapFailureDrops natv2PoolOtherResourceFailureDrops natv2PoolDiscontinuityTime, natv2PoolThresholdUsageLow, natv2PoolThresholdUsageHigh, natv2PoolNotifiedPortMapEntries, natv2PoolNotifiedPortMapProtocol, natv2PoolNotificationInterval, -- from natv2PoolRangeTable natv2PoolRangeInstanceIndex, natv2PoolRangePoolIndex, natv2PoolRangeRowIndex, natv2PoolRangeBegin, natv2PoolRangeEnd, -- from natv2AddressMapTable natv2AddressMapExternalPoolIndex, -- from natv2PortMapTable natv2PortMapExternalPoolIndex } STATUS current DESCRIPTION "Per-instance objects that MUST be supported by implementations of the pooled and carrier grade NAT applications." ::= { natv2MIBGroups 4 } natv2CGNNotificationGroup NOTIFICATION-GROUP NOTIFICATIONS { natv2NotificationSubscriberPortMappingEntriesHigh } STATUS current DESCRIPTION "Notification that MUST be supported by implementations of the carrier grade NAT application." ::= { natv2MIBGroups 5 } natv2CGNDeviceLevelGroup OBJECT-GROUP OBJECTS { -- from table natv2SubscriberTable natv2SubscriberIndex, natv2SubscriberRealm, natv2SubscriberInternalPrefixType, natv2SubscriberInternalPrefix, natv2SubscriberInternalPrefixLength, natv2SubscriberAddressMapEntries, natv2SubscriberPortMapEntries, natv2SubscriberTranslations, natv2SubscriberAddressMapCreations, natv2SubscriberPortMapCreations, natv2SubscriberAddressMapFailureDrops, natv2SubscriberPortMapFailureDrops, natv2SubscriberOtherResourceFailureDrops, natv2SubscriberDiscontinuityTime, natv2SubscriberLimitPortMapEntries, natv2SubscriberThresholdPortMapEntriesHigh, natv2SubscriberNotificationInterval } STATUS current DESCRIPTION "Device-level objects that MUST be supported by the carrier-grade NAT application." ::= { natv2MIBGroups 6 } natv2CGNInstanceLevelGroup OBJECT-GROUP OBJECTS { -- from natv2InstanceTable natv2InstanceSubscriberActiveLimitDrops, natv2InstanceLimitSubscriberActives, -- from natv2AddressMapTable natv2AddressMapSubscriberIndex, -- from natv2PortMapTable natv2PortMapSubscriberIndex } STATUS current DESCRIPTION "Per-instance objects that MUST be supported by the carrier grade NAT application." ::= { natv2MIBGroups 7 } END ]]>

This section covers two particular areas of operations and management: configuration requirements, and transition from or coexistence with the MIB module.

This MIB module assumes that the following information is configured on the NAT device by means outside the scope of the present document or is imposed by the implementation: the set of address realms to which the device connects; For the CGN application, per-subscriber information including subscriber index, address realm, assigned prefix or address, and (possibly) policies regarding address pool selection in the various possible address realms to which the subscriber may connect. In the particular case of DS-Lite access, as well as the assigned outer layer (IPv6) prefix or address, the subscriber information will include an inner (IPv4) source address, usually 192.0.0.2. the set of NAT instances running on the device, identified by NAT instance index and name; the port mapping, filtering, pooling, and fragment behavior for each NAT instance; the set of protocols supported by each NAT instance; for the pooled NAT and CGN applications, address pool information for each NAT instance, including for each pool the pool index, address realm, address type, minimum and maximum port number, the address ranges assigned to that pool, and policies for access to that pool's resources; static address and port map entries. As described in previous sections, this MIB module does provide read-write objects for control of notifications (see especially ) and limiting of resource consumption (). This document is written in advance of any practical experience with the setting of these values, and can thus provide only general principles for how to set them. By default, the MIB module definition disables notifications until they are explicitly enabled by the operator, using the associated threshold value to do so. To make use of the notifications, the operator may wish to take the following considerations into account. Except for the low address pool utilization notification, the notifications imply that some sort of administrative action is required to mitigate an impending shortage of a particular resource. The choice of value for the triggering threshold needs to take two factors into account: the volatility of usage of the given resource, and the amount of time the operator needs to mitigate the potential overload situation. That time could vary from almost immediate to several weeks required to order and install new hardware or software. To give a numeric example, if average utilization is going up 1% per week but can vary 10% around that average in any given hour, and it takes two weeks to carry through mitigating measures, the threshold should be set to 88% of the corresponding limit (two weeks' growth plus 10% volatility margin). If mitigating measures can be carried out immediately, this can rise to 90%. For this particular example that change is insignificant, but in other cases the difference may be large enough to matter in terms of reduced load on the management plane. The notification rate limit settings really depend on the operator's processes, but are a tradeoff between reliably reporting the notified condition and not having it overload the management plane. Reliability rises in importance with the importance of the resource involved. Thus the default notification intervals defined in this MIB module range from 10 seconds (high reliability) for the address and port map entry thresholds up to 60 seconds (lower reliability) for the per-subscriber port entry thresholds. Experience may suggest better values. The limits on number of instance-level address map and port map entries and held fragments relate directly to memory allocations for these tables. The relationship between number of map entries or number of held fragments and memory required will be implementation-specific. Hence it is up to the implementor to provide specific advice on the setting of these limits. The limit on simultaneous number of active subscribers is indirectly related to memory consumption for map entries, but also to processor usage by the NAT instance. The best strategy for setting this limit would seem to be to leave it disabled during an initial period while observing device processor utilization, then to implement a trial setting while observing the number of blocked packets affected by the new limit. The setting may vary by NAT instance if a suitable estimator of likely load (e.g., total number of hosts served by that instance) is available.

A manager may have to deal with a mixture of devices supporting the NAT-MIB module and the NATV2-MIB module defined in the present document. It is even possible that both modules are supported on the same device. The following discussion brings out the limits of comparability between the two MIB modules. A first point to note is that NAT-MIB is primarily focussed on configuration, while NATV2-MIB is primarily focussed on measurements. To summarize the model used by : The basic unit of NAT configuration is the interface. An interface connects to a single realm, either "private", or "public". In principle that means there could be multiple instances of one type of realm or the other, but the number is physically limited by the number of interfaces on the NAT device. Before the NAT can operate on a given interface, an "address map" has to be configured on it. The address map is equivalent to the pool tables in the present document. Since just one "address map" is configured per interface, this is the equivalent of a single address pool per interface. The address binding and port binding tables are roughly equivalent to the address map and port map tables in the present document in their content, but can be either uni- directional or bidirectional. The model shows the address binding and port binding as alternative precursors to session establishment, depending on whether the device does address translation only or address and port translation. In contrast, NATV2-MIB assumes a model where bidirectional port mappings are based on bidirectional address mappings that have conceptually been established beforehand. The equivalent to an session in NATV2-MIB would be a pair of port map entries. The added complexity in is due to the modelling of NAT service types as defined in (the symmetric NAT in particular) instead of the more granular set of behaviors described in . With regard to that last point, the mapping between service types and NAT behaviours is as follows: A full cone NAT exhibits endpoint-independent port mapping behavior and endpoint-independent filtering behavior. A restricted cone NAT exhibits endpoint-independent port mapping behavior, but address-dependent filtering behavior. A port restricted cone NAT exhibits endpoint-independent port mapping behavior, but address-and-port-dependent filtering behavior. A symmetric NAT exhibits address-and-port-dependent port mapping and filtering behaviors. Note that these NAT types are a subset of the types that could be configured according to the behavioral classification used in NATV2-MIB, but they include the two possibilities (full and restricted cone NAT) that satisfy requirements REQ-1 and REQ-8 of . Note further that other behaviors defined in are not considered in . Having established a context for discussion, we are now in a position to compare the outputs provided to management from the and NATV2-MIB modules. This comparison relates to the ability to compare results if testing with both MIBs implemented on the same device during a transition period. provides three counters: incoming translations, outgoing translations, and discarded packets, at the granularities of interface, address map, and protocol, and incoming and outgoing translations at the levels of individual address bind, address port bind, and session entries. Implementation at the protocol and address map levels is optional. NATV2-MIB provides a single total (both directions) translations counter at the instance, protocol within instance, and subscriber levels. Given the differences in granularity, it appears that the only comparable measurement of translations between the two MIB modules would be through aggregation of the interface counters to give a total number of translations for the NAT instance. NATV2-MIB has broken out the single discard counter into a number of different counters reflecting the cause of the discard in more detail, to help in trouble-shooting. Again, with the differing levels of granularity, the only comparable statistic would be through aggregation to a single value of total discards per NAT instance. Moving on to state variables, offers counts of number of "address map" (i.e., address pool) entries used (excluding static entries) at the address map level, and number of entries in the address bind and address and port bind tables respectively. Finally, provides a count of the number of sessions currently using each entry in the address and port bind table. None of these counts are directly comparable with the state values offered by NATV2-MIB, because of the exclusion of static entries at the address map level, and because of the differing models of the translation tables between and the NATV2=MIB.

A number of management objects defined in this MIB module have a MAX-ACCESS clause of read-write. Such objects may be considered sensitive or vulnerable in some network environments. The support for SET operations in a non-secure environment without proper protection can have a negative effect on network operations. These are the tables and objects and their sensitivity/vulnerability: An attacker setting a very low or very high limit can easily cause a denial-of-service situation. natv2InstanceLimitAddressMapEntries; natv2InstanceLimitPortMapEntries; natv2InstanceLimitPendingFragments; natv2InstanceLimitSubscriberActives; natv2SubscriberLimitPortMapEntries. An attacker setting an arbitrarily low threshold can cause many useless notifications to be generated (subject to the notification interval). Setting an arbitrarily high threshold can effectively disable notifications, which could be used to hide another attack. natv2InstanceThresholdAddressMapEntriesHigh; natv2InstanceThresholdPortMapEntriesHigh; natv2PoolThresholdUsageLow; natv2PoolThresholdUsageHigh; natv2SubscriberThresholdPortMapEntriesHigh. An attacker setting a low notification interval in combination with a low threshold value can cause many useless notifications to be generated. natv2InstanceNotificationInterval; natv2PoolNotificationInterval; natv2SubscriberNotificationInterval. Some of the readable objects in this MIB module (i.e., objects with a MAX-ACCESS other than not-accessible) may be considered sensitive or vulnerable in some network environments. It is thus important to control even GET and/or NOTIFY access to these objects and possibly to even encrypt the values of these objects when sending them over the network via SNMP. These are the tables and objects and their sensitivity/vulnerability: Various objects can reveal the identity of private hosts that are engaged in a session with external end nodes. A curious outsider could monitor these to assess the number of private hosts being supported by the NAT device. Further, a disgruntled former employee of an enterprise could use the information to break into specific private hosts by intercepting the existing sessions or originating new sessions into the host. entries in the natv2AddressMapTable; entries in the natv2PortMapTable. Other managed objects in this MIB may contain information that may be sensitive from a business perspective, in that they may represent NAT capabilities, business policies, and state information. natv2SubscriberLimitPortMapEntries; natv2InstancePortMappingBehavior; natv2InstanceFilteringBehavior; natv2InstancePoolingBehavior; natv2InstanceFragmentBehavior; natv2InstanceAddressMapEntries; natv2InstancePortMapEntries. There are no objects that are sensitive in their own right, such as passwords or monetary amounts. SNMP versions prior to SNMPv3 did not include adequate security. Even if the network itself is secure (for example by using IPsec), there is no control as to who on the secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB module. Implementations SHOULD provide the security features described by the SNMPv3 framework (see ), and implementations claiming compliance to the SNMPv3 standard MUST include full support for authentication and privacy via the User-based Security Model (USM) with the AES cipher algorithm . Implementations MAY also provide support for the Transport Security Model (TSM) in combination with a secure transport such as SSH or TLS/DTLS . Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security. It is then a customer/operator responsibility to ensure that the SNMP entity giving access to an instance of this MIB module is properly configured to give access to the objects only to those principals (users) that have legitimate rights to indeed GET or SET (change/create/delete) them.

IANA is requested to assign an object identifier to the natv2MIB module, with prefix iso.org.dod.internet.mgmt.mib-2 in the Network Management Parameters registry .