idnits 2.17.1
draft-perrault-behave-natv2-mib-01.txt:
Checking boilerplate required by RFC 5378 and the IETF Trust (see
https://trustee.ietf.org/license-info):
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt:
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/checklist :
----------------------------------------------------------------------------
== There are 1 instance of lines with non-RFC2606-compliant FQDNs in the
document.
== There are 7 instances of lines with non-RFC6890-compliant IPv4 addresses
in the document. If these are example addresses, they should be changed.
Miscellaneous warnings:
----------------------------------------------------------------------------
== The copyright year in the IETF Trust and authors Copyright Line does not
match the current year
== Line 2692 has weird spacing: '... of natv2...'
-- The document date (February 17, 2015) is 3355 days in the past. Is this
intentional?
Checking references for intended status: Proposed Standard
----------------------------------------------------------------------------
(See RFCs 3967 and 4897 for information about using normative references
to lower-maturity documents in RFCs)
== Missing Reference: 'RFC 4008' is mentioned on line 3621, but not defined
** Obsolete undefined reference: RFC 4008 (Obsoleted by RFC 7658)
== Missing Reference: 'RFC 6333' is mentioned on line 3198, but not defined
** Obsolete normative reference: RFC 3489 (Obsoleted by RFC 5389)
-- No information found for draft-perrault-behave-deprecate-nat-mib-v1 - is
the name correct?
-- Obsolete informational reference (is this intentional?): RFC 2460
(Obsoleted by RFC 8200)
-- Obsolete informational reference (is this intentional?): RFC 4008
(Obsoleted by RFC 7658)
Summary: 2 errors (**), 0 flaws (~~), 6 warnings (==), 4 comments (--).
Run idnits with the --verbose option for more detailed information about
the items above.
--------------------------------------------------------------------------------
2 Network Working Group S. Perreault
3 Internet-Draft Jive Communications
4 Intended status: Standards Track T. Tsou
5 Expires: August 21, 2015 Huawei Technologies
6 S. Sivakumar
7 Cisco Systems
8 T. Taylor
9 PT Taylor Consulting
10 February 17, 2015
12 Definitions of Managed Objects for Network Address Translators (NAT)
13 draft-perrault-behave-natv2-mib-01
15 Abstract
17 This memo defines a portion of the Management Information Base (MIB)
18 for devices implementing the Network Address Translator (NAT)
19 function. The new MIB module defined in this document, NATV2-MIB, is
20 intended to replace module NAT-MIB (RFC 4008). NATV2-MIB is not
21 backwards compatible with NAT-MIB, for reasons given in the text of
22 this document. A companion document deprecates all objects in NAT-
23 MIB. NATV2-MIB can be used for monitoring of NAT instances on a
24 device capable of NAT function. Compliance levels are defined for
25 three application scenarios: basic NAT, pooled NAT, and carrier-grade
26 NAT (CGN).
28 Status of This Memo
30 This Internet-Draft is submitted in full conformance with the
31 provisions of BCP 78 and BCP 79.
33 Internet-Drafts are working documents of the Internet Engineering
34 Task Force (IETF). Note that other groups may also distribute
35 working documents as Internet-Drafts. The list of current Internet-
36 Drafts is at http://datatracker.ietf.org/drafts/current/.
38 Internet-Drafts are draft documents valid for a maximum of six months
39 and may be updated, replaced, or obsoleted by other documents at any
40 time. It is inappropriate to use Internet-Drafts as reference
41 material or to cite them other than as "work in progress."
43 This Internet-Draft will expire on August 21, 2015.
45 Copyright Notice
47 Copyright (c) 2015 IETF Trust and the persons identified as the
48 document authors. All rights reserved.
50 This document is subject to BCP 78 and the IETF Trust's Legal
51 Provisions Relating to IETF Documents
52 (http://trustee.ietf.org/license-info) in effect on the date of
53 publication of this document. Please review these documents
54 carefully, as they describe your rights and restrictions with respect
55 to this document. Code Components extracted from this document must
56 include Simplified BSD License text as described in Section 4.e of
57 the Trust Legal Provisions and are provided without warranty as
58 described in the Simplified BSD License.
60 Table of Contents
62 1. The SNMP Management Framework . . . . . . . . . . . . . . . . 3
63 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
64 3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 5
65 3.1. Content Provided by the NATV2-MIB Module . . . . . . . . 5
66 3.1.1. Configuration Data . . . . . . . . . . . . . . . . . 5
67 3.1.2. Notifications . . . . . . . . . . . . . . . . . . . . 6
68 3.1.3. State Information . . . . . . . . . . . . . . . . . . 9
69 3.1.4. Statistics . . . . . . . . . . . . . . . . . . . . . 9
70 3.2. Outline of MIB Module Organization . . . . . . . . . . . 11
71 3.3. Detailed MIB Module Walk-Through . . . . . . . . . . . . 13
72 3.3.1. Textual Conventions . . . . . . . . . . . . . . . . . 13
73 3.3.2. Notifications . . . . . . . . . . . . . . . . . . . . 13
74 3.3.3. The Subscriber Table: natv2SubscriberTable . . . . . 13
75 3.3.4. The Instance Table: natv2InstanceTable . . . . . . . 14
76 3.3.5. The Protocol Table: natv2ProtocolTable . . . . . . . 15
77 3.3.6. The Address Pool Table: natv2PoolTable . . . . . . . 15
78 3.3.7. The Address Pool Address Range Table:
79 natv2PoolRangeTable . . . . . . . . . . . . . . . . . 16
80 3.3.8. The Address Map Table: natv2AddressMapTable . . . . . 16
81 3.3.9. The Port Map Table: natv2PortMapTable . . . . . . . . 17
82 3.4. Conformance: Three Application Scenarios . . . . . . . . 17
83 4. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 18
84 5. Operational and Management Considerations . . . . . . . . . . 74
85 5.1. Configuration Requirements . . . . . . . . . . . . . . . 74
86 5.2. Transition From and Coexistence With NAT-MIB [RFC 4008] 76
87 6. Security Considerations . . . . . . . . . . . . . . . . . . . 78
88 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 81
89 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 81
90 8.1. Normative References . . . . . . . . . . . . . . . . . . 81
91 8.2. Informative References . . . . . . . . . . . . . . . . . 82
92 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 83
94 1. The SNMP Management Framework
96 For a detailed overview of the documents that describe the current
97 Internet-Standard Management Framework, please refer to section 7 of
98 RFC 3410 [RFC3410].
100 Managed objects are accessed via a virtual information store, termed
101 the Management Information Base or MIB. MIB objects are generally
102 accessed through the Simple Network Management Protocol (SNMP).
103 Objects in the MIB are defined using the mechanisms defined in the
104 Structure of Management Information (SMI). This memo specifies a MIB
105 module that is compliant to the SMIv2, which is described in STD 58,
106 [RFC2578], [RFC2579] and [RFC2580].
108 2. Introduction
110 Note to RFC Ed.: please replace RFC yyyy with actual RFC number
111 throughout this document and remove this note.
113 This memo defines a portion of the Management Information Base (MIB)
114 for devices implementing NAT functions. This MIB module, NATV2-MIB,
115 may be used for monitoring of such devices. NATV2-MIB supersedes
116 NAT-MIB [RFC4008], which did not fit well with existing NAT
117 implementations, and hence was not itself much implemented.
118 [I-D.perrault-behave-deprecate-nat-mib-v1] provides a detailed
119 analysis of the deficiencies of NAT-MIB.
121 Relative to [RFC4008] and based on the analysis just mentioned, the
122 present document introduces the following changes:
124 o removed all writable configuration except that related to control
125 of the generation of notifications and the setting of quotas on
126 the use of NAT resources;
128 o minimized the read-only exposure of configuration to what is
129 needed to provide context for the state and statistical
130 information presented by the MIB module;
132 o removed the association between mapping and interfaces, retaining
133 only the mapping aspect;
135 o replaced references to NAT types with references to NAT behaviors
136 as specified in [RFC4787];
138 o replaced a module-specific enumeration of protocols with the
139 standard protocol numbers provided by the IANA Assigned Internet
140 Protocol Numbers registry.
142 This MIB module adds the following features not present in [RFC4008]:
144 o additional writable protective limits on NAT state data;
146 o additional objects to report state, statistics, and notifications;
148 o support for the carrier grade NAT (CGN) application, including
149 subscriber-awareness, support for an arbitrary number of address
150 realms, and support for multiple NAT instances running on a single
151 device;
153 o expanded support for address pools;
155 o revised indexing of port map entries to simplify traceback from
156 externally observable packet parameters to the corresponding
157 internal endpoint.
159 These features are described in more detail below.
161 The remainder of this document is organized as follows:
163 o Section 3 provides a verbal description of the content and
164 organization of the MIB module.
166 o Section 4 provides the MIB module definition.
168 o Section 5 discusses operational and management issues relating to
169 the deployment of NATV2-MIB. One of these issues is NAT
170 management when both NAT-MIB [RFC4008] and NATV2-MIB are deployed.
172 o Section 6 and Section 7 provide a security discussion and a
173 request to IANA for allocation of an object identifier for the
174 module in the mib-2 tree, respectively.
176 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
177 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
178 "OPTIONAL" in this document are to be interpreted as described in
179 [RFC2119].
181 This document uses the following terminology:
183 Upper layer protocol: The protocol following the outer IP header of
184 a packet. This follows the terminology of [RFC2460], but as that
185 document points out, "upper" is not necessarily a correct
186 description of the protocol relationships (e.g., where IP is
187 encapsulated in IP). The abbreviated term "protocol" will often
188 be used where it is unambiguous.
190 Trigger: With respect to notifications, the logical recognition of
191 the event that the notification is intended to report.
193 Report: The actual production of a notification message. Reporting
194 can happen later than triggering, or may never happen for a given
195 notification instance, because of the operation of notification
196 rate controls.
198 Address realm: A network domain in which the network addresses are
199 uniquely assigned to entities such that datagrams can be routed to
200 them. (Definition taken from [RFC2663] Section 2.1.) The
201 abbreviated term "realm" will often be used.
203 3. Overview
205 This section provides a prose description of the contents and
206 organization of the NATV2-MIB module.
208 3.1. Content Provided by the NATV2-MIB Module
210 The content provided by the NATV2-MIB module can be classed under
211 four headings: configuration data, notifications, state information,
212 and statistics.
214 3.1.1. Configuration Data
216 As mentioned above, the intent in designing the NATV2-MIB module was
217 to minimize the amount of configuration data presented to that needed
218 to give a context for interpreting the other types of information
219 provided. Detailed descriptions of the configuration data are
220 included with the descriptions of the individual tables. In general,
221 that data is limited to what is needed for indexing and cross-
222 referencing between tables. The two exceptions are the objects
223 describing NAT instance behavior in the NAT instance table, and the
224 detailed enumeration of resources allocated to each address pool in
225 the pool table and its extension.
227 The NATV2-MIB module provides three sets of read-write objects,
228 specifically related to other aspects of the module content. The
229 first set controls the rate at which specific notifications are
230 generated. The second set provides thresholds used to trigger the
231 notifications. These objects are listed in Section 3.1.2.
233 A third set of read-write objects sets limits on resource consumption
234 per NAT instance and per subscriber. When these limits are reached,
235 packets requiring further consumption of the given resource are
236 dropped rather than translated. Statistics described in
237 Section 3.1.4 record the numbers of packets so dropped. Limits are
238 provided for:
240 o total number of address map entries over the NAT instance. Limit
241 is set by object natv2InstanceLimitAddressMapEntries in table
242 natv2InstanceTable. Dropped packets are counted in
243 natv2InstanceAddressMapEntryLimitDrops in that table.
245 o total number of port map entries over the NAT instance. Limit is
246 set by object natv2InstanceLimitPortMapEntries in table
247 natv2InstanceTable. Dropped packets are counted in
248 natv2InstancePortMapEntryLimitDrops in that table.
250 o total number of held fragments (applicable only when the NAT
251 instance can receive fragments out of order; see [RFC4787]
252 Section 11). Limit is set by object
253 natv2InstanceLimitPendingFragments in table natv2InstanceTable.
254 Dropped packets are counted by natv2InstanceFragmentDrops in the
255 same table.
257 o total number of active subscribers (i.e., subscribers having at
258 least one mapping table entry) over the NAT instance. Limit is
259 set by object natv2InstanceLimitSubscriberActives in table
260 natv2InstanceTable. Dropped packets are counted by
261 natv2InstanceSubscriberActiveLimitDrops in the same table.
263 o number of port map entries for an individual subscriber. Limit is
264 set by object natv2SubscriberLimitPortMapEntries in table
265 natv2SubscriberTable. Dropped packets are counted by
266 natv2SubscriberPortMapFailureDrops in the same table. Note that,
267 unlike in the instance table, the per-subscriber count is lumped
268 in with the count of packets dropped because of failures to
269 allocate a port map entry for other reasons to save on storage.
271 3.1.2. Notifications
273 NATV2-MIB provides five notifications, intended to provide warning of
274 the need to provision or reallocate NAT resources. As indicated in
275 the previous section, each notification is associated with two read-
276 write objects: a control on the rate at which that notification is
277 generated, and a threshold value used to trigger the notification in
278 the first place. The default setting within the MIB module
279 specification is that all notifications are disabled. The setting of
280 threshold values is discussed in Section 5.
282 The five notifications are as follows:
284 o Two notifications relate to the management of address pools. One
285 indicates that usage equals or exceeds an upper threshold, and is
286 therefore a warning that the pool may be over-utilized unless more
287 addresses are assigned to it. The other notification indicates
288 that usage equals or has fallen below a lower threshold,
289 suggesting that some addresses allocated to that pool could be
290 reallocated to other pools. Address pool usage is calculated as
291 the percentage of the total number of ports allocated to the
292 address pool that are already in use, for the most-mapped protocol
293 at the time the notification is generated. The notifications
294 identify that protocol and report the number of port map entries
295 for that protocol in the given address pool at the moment the
296 notification was triggered.
298 o Two notifications relate to the number of address and port map
299 entries respectively, in total over the whole NAT instance. In
300 both cases the threshold that triggers the notification is an
301 upper threshold. The notifications return the number of mapping
302 entries of the given type, plus a cumulative counter of the number
303 of entries created in that mapping table at the moment the
304 notification was triggered. The intent is that the notifications
305 provide a warning that the total number of address or port map
306 entries is approaching the configured limit.
308 o The final notification is generated on a per-subscriber basis when
309 the number of port map entries for that subscriber crosses the
310 associated threshold. The objects returned by this notification
311 are similar to those returned for the instance-level mapping
312 notifications. This notification is a warning that the number of
313 port map entries for the subscriber is approaching the configured
314 limit for that subscriber.
316 Here is a detailed specification of the notifications. A given
317 notification can be disabled by setting the threshold to 0 (default),
318 with the exception noted below.
320 Notification: natv2NotificationPoolUsageLow. Indicates that address
321 pool usage for the most-mapped protocol equals or is less than the
322 threshold value.
324 Compared value: natv2PoolNotifiedPortMapEntries as a percentage of
325 total available ports in the pool.
327 Threshold: natv2PoolThresholdUsageLow in natv2PoolTable. To allow
328 for a threshold of zero usage, disabling of the
329 natv2NotificationPoolUsageLow is done by setting
330 natv2PoolThresholdUsageLow to -1 rather than 0, in contrast to all
331 of the other notifications.
333 Objects returned: natv2PoolNotifiedPortMapEntries and
334 natv2PoolNotifiedPortMapProtocol in natv2PoolTable;
336 Rate control: natv2PoolNotificationInterval in
337 natv2PoolTable (default 20 seconds between notifications for a
338 given address pool).
340 Notification: natv2NotificationPoolUsageHigh. Indicates that address
341 pool usage for the most-mapped protocol has risen to the threshold
342 value or more.
344 Compared value: natv2PoolNotifiedPortMapEntries as a percentage of
345 total available ports in the pool.
347 Threshold: natv2PoolThresholdUsageHigh in natv2PoolTable;
349 Objects returned: natv2PoolNotifiedPortMapEntries,
350 natv2PoolNotifiedPortMapProtocol in natv2PoolTable;
352 Rate control: natv2PoolNotificationInterval in
353 natv2PoolTable (default 20 seconds between notifications for a
354 given address pool).
356 Notification: natv2NotificationInstanceAddressMapEntriesHigh.
357 Indicates that the total number of entries in the address map table
358 over the whole NAT instance equals or exceeds the threshold value.
360 Compared value: natv2InstanceAddressMapEntries in
361 natv2InstanceTable;
363 Threshold: natv2InstanceThresholdAddressMapEntriesHigh in
364 natv2InstanceTable;
366 Objects returned: natv2InstanceAddressMapEntries,
367 natv2InstanceAddressMapCreations in natv2InstanceTable;
369 Rate control: natv2InstanceNotificationInterval in
370 natv2InstanceTable (default 10 seconds between notifications for a
371 given NAT instance).
373 Notification: natv2NotificationInstancePortMapEntriesHigh. Indicates
374 that the total number of entries in the port map table over the whole
375 NAT instance equals or exceeds the threshold value.
377 Compared value: natv2InstancePortMapEntries in natv2InstanceTable;
379 Threshold: natv2InstanceThresholdPortMapEntriesHigh in
380 natv2InstanceTable;
382 Objects returned: natv2InstancePortMapEntries,
383 natv2InstancePortMapCreations in natv2InstanceTable;
385 Rate control: natv2InstanceNotificationInterval in
386 natv2InstanceTable (default 10 seconds between notifications for a
387 given NAT instance).
389 Notification: natv2NotificationSubscriberPortMapEntriesHigh.
390 Indicates that the total number of entries in the port map table for
391 the given subscriber equals or exceeds the threshold value configured
392 for that subscriber.
394 Compared value: natv2SubscriberPortMapEntries in
395 natv2SubscriberTable;
397 Threshold: natv2SubscriberThresholdPortMapEntriesHigh in
398 natv2SubscriberTable;
400 Objects returned: natv2SubscriberPortMapEntries,
401 natv2SubscriberPortMapCreations in natv2SubscriberTable;
403 Rate control: natv2SubscriberNotificationInterval in
404 natv2SubscriberTable (default 60 seconds between notifications for
405 a given subscriber).
407 3.1.3. State Information
409 State information provides a snapshot of the content and extent of
410 the NAT mapping tables at a given moment of time. The address and
411 port mapping tables are described in detail below. In addition to
412 these tables, two state variables are provided: current number of
413 entries in the address mapping table, and current number of entries
414 in the port mapping table. With one exception, these are provided at
415 four levels of granularity: per NAT instance, per protocol, per
416 address pool, and per subscriber. Address map entries are not
417 tracked per protocol, since address mapping is protocol-independent.
419 3.1.4. Statistics
421 NATV2-MIB provides a number of counters, intended to help both with
422 provisioning of the NAT and debugging of problems. As with the state
423 data, these counters are provided at the four levels of NAT instance,
424 protocol, address pool, and subscriber when they make sense. Each
425 counter is cumulative beginning from a "last discontuity time"
426 recorded by an object that is usually in the table containing the
427 counter.
429 The basic set of counters, as reflected in the NAT instance table, is
430 as follows:
432 Translations: number of packets processed and translated (in this
433 case, in total for the NAT instance);
435 Address map entry creations: cumulative number of address map
436 entries created, including static mappings;
438 Port map entry creations: cumulative number of port map entries
439 created, including static mappings;
441 Address map limit drops: cumulative number of packets dropped rather
442 than translated because the packet would have triggered the
443 creation of a new address mapping, but the configured limit on
444 number of address map entries has already been reached.
446 Port map limit drops: cumulative number of packets dropped rather
447 than translated because the packet would have triggered the
448 creation of a new port mapping, but the configured limit on number
449 of port map entries has already been reached.
451 Active subscriber limit drops: cumulative number of packets dropped
452 rather than translated because the packet would have triggered the
453 creation of a new address and/or port mapping for a subscriber
454 with no existing entries in either table, but the configured limit
455 on number of active subscribers has already been reached.
457 Address mapping failure drops: cumulative number of packets dropped
458 because the packet would have triggered the creation of a new
459 address mapping, but no address could be allocated in the external
460 realm concerned because all addresses from the selected address
461 pool (or the whole realm, if no address pool has been configured
462 for that realm) have already been fully allocated.
464 Port mapping failure drops: cumulative number of packets dropped
465 because the packet would have triggered the creation of a new port
466 mapping, but no port could be allocated for the protocol
467 concerned. The precise conditions under which these packet drops
468 occur depend on the pooling behavior [RFC4787] configured or
469 implemented in the NAT instance. See the DESCRIPTION clause for
470 the natv2InstancePortMapFailureDrops object for a detailed
471 description of the different cases. These cases were defined with
472 care to ensure that address mapping failure could be distinguished
473 from port mapping failure.
475 Fragment drops: cumulative number of packets dropped because the
476 packet contains a fragment and the fragment behavior [RFC4787]
477 configured or implemented in the NAT instance indicates that the
478 packet should be dropped. The main case is a NAT instance that
479 meets REQ-14 of [RFC4787], hence can receive and process out-of-
480 order fragments. In that case, dropping occurs only when the
481 configured limit on pending fragments provided by NATV2-MIB has
482 already been reached. The other cases are detailed in the
483 DESCRIPTION clause of the natv2InstanceFragmentBehavior object.
485 Other resource drops: cumulative number of packets dropped because
486 of unavailability of some other resource. The most likely case
487 would be packets where the upper layer protocol is not one
488 supported by the NAT instance.
490 Table 1 indicates the granularities at which these statistics are
491 reported.
493 +-----------------------+------------+----------+------+------------+
494 | Statistic | NAT | Protocol | Pool | Subscriber |
495 | | Instance | | | |
496 +-----------------------+------------+----------+------+------------+
497 | Translations | Yes | Yes | No | Yes |
498 | Address map entry | Yes | No | Yes | Yes |
499 | creations | | | | |
500 | Port map entry | Yes | Yes | Yes | Yes |
501 | creations | | | | |
502 | Address map limit | Yes | No | No | No |
503 | drops | | | | |
504 | Port map limit drops | Yes | No | No | Yes |
505 | Active subscriber | Yes | No | No | No |
506 | limit drops | | | | |
507 | Address mapping | Yes | No | Yes | Yes |
508 | failure drops | | | | |
509 | Port mapping failure | Yes | Yes | Yes | Yes |
510 | drops | | | | |
511 | Fragment drops | Yes | No | No | No |
512 | Other resource drops | Yes | No | No | No |
513 +-----------------------+------------+----------+------+------------+
515 Table 1: Statistics Provided By Level of Granularity
517 3.2. Outline of MIB Module Organization
519 Figure 1 shows how object identifiers are organized in the NATV2-MIB
520 module. Under the general natv2MIB object identifier in the mib-2
521 tree, the objects are classed into four groups:
523 natv2MIBNotifications(0) identifies the five notifications described
524 in Section 3.1.2;
526 natv2MIBDeviceObjects(1) identifies objects relating to the whole
527 device, specifically, the subscriber table.
529 natv2MIBInstanceObjects(2) identifies objects relating to individual
530 NAT instances. These include the NAT instance table, the protocol
531 table, the address pool table and its address range expansion, the
532 address map table, and the port map table.
534 natv2MIBConformance(3) identifies the group and compliance clauses,
535 specified for the three application scenarios described in
536 Section 3.4.
538 natv2MIB
539 |
540 +-------------+-------------+-------------+
541 | | | |
542 | | |
543 0 | | |
544 natv2MIBNotifications | | |
545 | | |
546 | 1 | |
547 | natv2MIBDeviceObjects | |
548 Five | |
549 notifications | 2 |
550 | natv2MIBInstanceObjects |
551 | |
552 Subscriber | 3
553 table | natv2MIBConformance
554 | |
555 | |
556 Six per-NAT- |
557 instance tables |
558 |
559 +----------------------+-------
560 | |
561 | |
563 1 2
564 natv2MIBCompliances natv2MIBGroups
565 | |
566 | |
567 Basic Basic
568 Pooled Pooled
569 Carrier grade NAT Carrier grade NAT
571 Figure 1: Organization of Object Identifiers For NATV2-MIB
573 3.3. Detailed MIB Module Walk-Through
575 This section reviews the contents of the NATV2-MIB module. The table
576 descriptions include references to subsections of Section 3.1 where
577 desirable to avoid repetition of that information.
579 3.3.1. Textual Conventions
581 The module defines four key textual conventions: ProtocolNumber,
582 Natv2SubscriberIndex, Natv2InstanceIndex, and Natv2PoolIndex.
583 ProtocolNumber is based on the IANA registry of protocol numbers,
584 hence is potentially reusable by other MIB modules.
586 Objects of type Natv2SubscriberIndex identify individual subscribers
587 served by the the NAT device. The values of these identifiers are
588 administered and, in intent, are permanently associated with their
589 respective subscribers. Reuse of a value after a subscriber has been
590 deleted is discouraged. The scope of the subscriber index was
591 defined to be at device rather than NAT instance level to make it
592 easier to shift subscribers between instances (e.g., for load
593 balancing).
595 Objects of type Natv2InstanceIndex identify specific NAT instances on
596 the device. Again, these are administered values intended to be
597 permanently associated with the NAT instances to which they have been
598 assigned.
600 Objects of type Natv2PoolIndex identify individual address pools in a
601 given NAT instance. As with the subscriber and instance index
602 objects, the pool identifiers are administered and intended to be
603 permanently associated with their respective pools.
605 3.3.2. Notifications
607 Notifications were described in Section 3.1.2.
609 3.3.3. The Subscriber Table: natv2SubscriberTable
611 Table natv2SubscriberTable is indexed by subscriber index. One
612 conceptual row contains information relating to a specific
613 subscriber: the subscriber's internal address or prefix for
614 correlation with other management information; state and statistical
615 information as described in Section 3.1.3 and Section 3.1.4, the per-
616 subscriber control objects described in Section 3.1.1, and
617 natv2SubscriberDiscontinuityTime, which provides a timestamp of the
618 latest time following which the statistics have accumulated without
619 discontinuity.
621 Turning back to the address information for a moment: this
622 information includes the identity of the address realm in which the
623 address is routable. That enables support of an arbitrary number of
624 address realms on the same NAT instance. Address realm identifiers
625 are administered values in the form of a limited-length
626 SnmpAdminString. In the absence of configuration to the contrary,
627 the default realm for all internal addresses as recorded in mapping
628 entries is "internal".
630 The term "address realm" is defined in [RFC2663] Section 2.1 and
631 reused in subsequent NAT-related documents.
633 In the special case of DS-Lite [RFC6333], for unique matching of the
634 subscriber data to other information in the MIB module, it is
635 necessary that the address information should relate to the outer
636 IPv6 header of packets going to or from the host, with the address
637 realm being the one in which that IPv6 address is routable. The
638 presentation of address information for other types of tunneled
639 access to the NAT is out of scope.
641 3.3.4. The Instance Table: natv2InstanceTable
643 Table natv2InstanceTable is indexed by an object of type
644 Natv2InstanceIndex. A conceptual row of this table provides
645 information relating to a particular NAT instance configured on the
646 device.
648 Configuration information provided by this table includes an instance
649 name of type DisplayString that may have been configured for this
650 instance, and a set of objects indicating respectively the port
651 mapping, filtering, pooling, and fragment behaviors configured or
652 implemented in the instance. These behaviors are all defined in
653 [RFC4787]. Their values affect the interpretation of some of the
654 statistics provided in the instance table.
656 Read-write objects listed in Section 3.1.2 set the notification rate
657 for instance-level notifications and set the thresholds that trigger
658 them. Additional read-write objects described in Section 3.1.1 set
659 limits on the number of address and port mapping entries, number of
660 pending fragments, and number of active subscribers for the instance.
662 The state and statistical information provided by this table consists
663 of the per-instance items described in Section 3.1.3 and
664 Section 3.1.4 respectively. natv2InstanceDiscontinuityTime is a
665 timestamp giving the time beyond which all of the statistical
666 counters in natv2InstanceTable are guaranteed to have accumulated
667 continuously.
669 3.3.5. The Protocol Table: natv2ProtocolTable
671 The protocol table is indexed by the NAT instance number and an
672 object of type ProtocolNumber as described in Section 3.3.1 (i.e., an
673 IANA-registered protocol number). The set of protocols supported by
674 the NAT instance is implementation-dependent, but MUST include
675 ICMP(1), TCP(6), UDP(17), and ICMPv6(58). Depending on the
676 application, it SHOULD include IPv4 encapsulation(4), IPv6
677 encapsulation(41), IPSec AH(51), and SCTP(132). Support of PIM(103)
678 is highly desirable.
680 This table includes no configuration information. The state and
681 statistical information provided by this table consists of the per-
682 protocol items described in Section 3.1.3 and Section 3.1.4
683 respectively. natv2InstanceDiscontinuityTime in natv2InstanceTable is
684 reused as the timestamp giving the time beyond which all of the
685 statistical counters in natv2ProtocolTable are guaranteed to have
686 accumulated continuously. The reasoning is that any event affecting
687 the continuity of per-protocol statistics will affect the continuity
688 of NAT instance statistics, and vice versa.
690 3.3.6. The Address Pool Table: natv2PoolTable
692 The address pool table is indexed by the NAT instance identifier for
693 the instance on which it is provisioned, plus a pool index of type
694 Natv2PoolIndex. Configuration information provided includes the
695 address realm for which the pool provides addresses, the type of
696 address (IPv4 or IPv6) supported by the realm, plus the port range it
697 makes available for allocation. The same set of port numbers (or, in
698 the ICMP case, identifier values), is made available for every
699 protocol supported by the NAT instance. The port range is specified
700 in terms of minimum and maximum port number.
702 The state and statistical information provided by this table consists
703 of the per-pool items described in Section 3.1.3 and Section 3.1.4
704 respectively, plus two additional state objects described below.
705 natv2PoolTable provides the pool-specific object
706 natv2PoolDiscontinuityTime to indicate the time since which the
707 statistical counters have accumulated continuously.
709 Read-write objects to set high and low thresholds for pool usage
710 notifications and for governing notification rate were identified in
711 Section 3.1.2. The default interval between notifications for a
712 given address pool is set to 20 seconds.
714 Implementation note: the thresholds are defined in terms of
715 percentage of available port utilization. The number of available
716 ports in a pool is equal to (max port - min port + 1) (from the
717 natv2PoolTable configuration information) multiplied by the number
718 of addresses provisioned in the pool (sum of number of addresses
719 provided by each natv2PoolRangeTable conceptual row relating to
720 that pool). At configuration time, the thresholds can be
721 recalculated in terms of total number of port map entries
722 corresponding to the configured percentage, so that runtime
723 comparisons to the current number of port map entries require no
724 further arithmetic operations.
726 natv2PoolTable also provides two state objects that are returned with
727 the notifications. natv2PoolNotifiedPortMapProtocol identifies the
728 most-mapped protocol at the time the notification was triggered.
729 natv2PoolNotifiedPortMapEntries provides the total number of port map
730 entries for that protocol using addresses owned by this pool at that
731 same time.
733 3.3.7. The Address Pool Address Range Table: natv2PoolRangeTable
735 natv2PoolRangeTable provides configuration information only. It is
736 an expansion of natv2PoolTable giving the address ranges with which a
737 given address pool has been configured. As such, it is indexed by
738 the combination of NAT instance index, address pool index, and a
739 conceptual row index, where each conceptual row conveys a different
740 address range. The address range is specified in terms of lowest
741 address, highest address rather than the usual prefix notation to
742 provide maximum flexibility.
744 3.3.8. The Address Map Table: natv2AddressMapTable
746 The address map table provides a table of mappings from internal to
747 external address at a given moment. It is indexed by the combination
748 of NAT instance index, internal realm, internal address type (IPv4 or
749 IPv6) in that realm, the internal address of the local host for which
750 the map entry was created, and a conceptual row index to traverse all
751 of the entries relating to the same internal address.
753 In the special case of DS-Lite [RFC6333], the internal address and
754 realm used in the index are those of the IPv6 outer header. The IPv4
755 source address for the inner header, for which [RFC6333] has reserved
756 addresses in the 192.0.0.0/29 range, is captured in two additional
757 objects in the corresponding conceptual row:
758 natv2AddressMapInternalMappedAddressType, and
759 natv2AddressMapInternalMappedAddress. In cases other than DS-Lite
760 access these objects have no meaning. (Other tunneled access is out
761 of scope.)
763 The additional information provided by natv2AddressMapTable consists
764 of the external realm, address type in that realm, and mapped
765 external address. Depending on implementation support, the table
766 also provides the index of the address pool from which the external
767 address was drawn and the index of the subscriber to which the map
768 entry belongs.
770 3.3.9. The Port Map Table: natv2PortMapTable
772 The port map table provides a table of mappings by protocol from
773 external port, address, and realm to internal port, address, and
774 realm. As such, it is indexed by the combination of NAT instance
775 index, protocol number, external realm identifier, address type in
776 that realm, external address, and external port. The mapping from
777 external realm, address, and port to internal realm, address, and
778 port is unique, so no conceptual row index is needed. The indexing
779 is designed to make it easy to trace individual sessions back to the
780 host, based on the contents of packets observed in the external
781 realm.
783 Beyond the indexing, the information provided by the port map table
784 consists of the internal realm, address type, address, and port
785 number, and, depending on implementation support, the index of the
786 subscriber to which the map entry belongs.
788 As with the address map table, special provision is made for the case
789 of DS-Lite [RFC6333]. The realm and outgoing source address are
790 those for the outer header, and the address type is IPv6. Additional
791 objects natv2PortMapInternalMappedAddressType and
792 natv2PortMapInternalMappedAddress capture the outgoing source address
793 in the inner header, which will be in the well-known 192.0.0.0/29
794 range.
796 3.4. Conformance: Three Application Scenarios
798 The conformance statements in NATV2-MIB provide for three application
799 scenarios: basic NAT, NAT supporting address pools, and carrier grade
800 NAT (CGN).
802 A basic NAT MAY limit the number of NAT instances it supports to one,
803 but MUST support indexing by NAT instance. Similarly, a basic NAT
804 MAY limit the number of realms it supports to two. By definition, a
805 basic NAT is not required to support the subscriber table, the
806 address pool table, or the address pool address range table. Some
807 individual objects in other tables are also not relevant to basic
808 NAT.
810 A NAT supporting address pools adds the address pool table and the
811 address pool address range table to what it implements. Some
812 individual objects in other tables also need to be implemented. A
813 NAT supporting address pools MUST support more than two realms.
815 Finally, a CGN MUST support the full contents of the MIB module.
816 That includes the subscriber table, but also includes the special
817 provision for DS-Lite access in the address and port map tables.
819 4. Definitions
821 This MIB module IMPORTs objects from [RFC2578], [RFC2579], [RFC2580],
822 [RFC3411], and [RFC4001].
824 NATV2-MIB DEFINITIONS ::= BEGIN
826 IMPORTS
827 MODULE-IDENTITY,
828 OBJECT-TYPE,
829 Integer32,
830 Unsigned32,
831 Counter64,
832 mib-2,
833 NOTIFICATION-TYPE
834 FROM SNMPv2-SMI -- RFC 2578
835 TEXTUAL-CONVENTION,
836 DisplayString,
837 TruthValue,
838 TimeStamp
839 FROM SNMPv2-TC -- RFC 2579
840 MODULE-COMPLIANCE,
841 NOTIFICATION-GROUP,
842 OBJECT-GROUP
843 FROM SNMPv2-CONF -- RFC 2580
844 SnmpAdminString
845 FROM SNMP-FRAMEWORK-MIB -- RFC 3411
846 InetAddressType,
847 InetAddress,
848 InetAddressPrefixLength,
849 InetPortNumber
850 FROM INET-ADDRESS-MIB -- RFC 4001
852 natv2MIB MODULE-IDENTITY
853 LAST-UPDATED "20150205000Z"
854 -- RFC Ed.: set to publication date
855 ORGANIZATION
856 "IETF Behavior Engineering for Hindrance Avoidance
857 (BEHAVE) Working Group"
858 CONTACT-INFO
859 "Working Group Email: behave@ietf.org
860 Simon Perreault
861 Jive Communications
862 Quebec, QC
863 Canada
865 Email: sperreault@jive.com
867 Tina Tsou
868 Huawei Technologies
869 Bantian, Longgang
870 Shenzhen 518129
871 PR China
873 Email: tina.tsou.zouting@huawei.com
875 Senthil Sivakumar
876 Cisco Systems
877 7100-8 Kit Creek Road
878 Research Triangle Park, North Carolina 27709
879 USA
881 Phone: +1 919 392 5158
882 Email: ssenthil@cisco.com
884 Tom Taylor
885 PT Taylor Consulting
886 Ottawa
887 Canada
889 Email: tom.taylor.stds@gmail.com"
891 DESCRIPTION
892 "This MIB module defines the generic managed objects
893 for NAT.
895 Copyright (C) The Internet Society (2015). This
896 version of this MIB module is part of RFC yyyy; see
897 the RFC itself for full legal notices."
898 REVISION "201502050000Z"
899 -- RFC Ed.: set to publication date
900 DESCRIPTION
901 "Complete rewrite, published as RFC yyyy.
902 Replaces former version published as RFC 4008."
903 -- RFC Ed.: replace yyyy with actual RFC number and set date"
904 ::= { mib-2 TBD }
906 -- textual conventions
908 ProtocolNumber ::= TEXTUAL-CONVENTION
909 DISPLAY-HINT "d"
910 STATUS current
911 DESCRIPTION
912 "A protocol number, from the 'protocol-numbers' IANA
913 registry."
914 REFERENCE
915 "IANA Protocol Numbers,
916 http://www.iana.org/assignments/protocol-numbers/protocol-
917 numbers.xhtml#protocol-numbers-1"
918 SYNTAX Unsigned32 (0..255)
920 Natv2SubscriberIndex ::= TEXTUAL-CONVENTION
921 DISPLAY-HINT "d"
922 STATUS current
923 DESCRIPTION
924 "A unique value, greater than zero, for each subscriber
925 in the managed system. The value for each
926 subscriber MUST remain constant at least from one
927 update of the entity's natv2SubscriberDiscontinuityTime
928 object until the next update of that object. If a
929 subscriber is deleted, its assigned index value MUST NOT
930 be assigned to another subscriber at least until
931 reinitialization of the entity's management system."
932 SYNTAX Unsigned32 (1..4294967295)
934 Natv2SubscriberIndexOrZero ::= TEXTUAL-CONVENTION
935 DISPLAY-HINT "d"
936 STATUS current
937 DESCRIPTION
938 "This textual convention is an extension of the
939 Natv2SubscriberIndex convention. The latter defines a
940 greater than zero value used to identify a subscriber in
941 the managed system. This extension permits the additional
942 value of zero, which serves as a placeholder when no
943 subscriber is associated with the object."
944 SYNTAX Unsigned32 (0|1..4294967295)
946 Natv2InstanceIndex ::= TEXTUAL-CONVENTION
947 DISPLAY-HINT "d"
948 STATUS current
949 DESCRIPTION
950 "A unique value, greater than zero, for each NAT instance
951 in the managed system. It is RECOMMENDED that values are
952 assigned contiguously starting from 1. The value for each
953 NAT instance MUST remain constant at least from one
954 update of the entity's natv2InstanceDiscontinuityTime
955 object until the next update of that object. If a NAT
956 instance is deleted, its assigned index value MUST NOT
957 be assigned to another NAT instance at least until
958 reinitialization of the entity's management system."
959 SYNTAX Unsigned32 (1..4294967295)
961 Natv2PoolIndex ::= TEXTUAL-CONVENTION
962 DISPLAY-HINT "d"
963 STATUS current
964 DESCRIPTION
965 "A unique value over the containing NAT instance, greater than
966 zero, for each address pool supported by that NAT instance.
967 It is RECOMMENDED that values are assigned contiguously
968 starting from 1. The value for each address pool MUST remain
969 constant at least from one update of the entity's
970 natv2PoolDiscontinuityTime object until the next update of
971 that object. If an address pool is deleted, its assigned
972 index value MUST NOT be assigned to another address pool for
973 the same NAT instance at least until reinitialization of the
974 entity's management system."
975 SYNTAX Unsigned32 (1..4294967295)
977 Natv2PoolIndexOrZero ::= TEXTUAL-CONVENTION
978 DISPLAY-HINT "d"
979 STATUS current
980 DESCRIPTION
981 "This textual convention is an extension of the
982 Natv2PoolIndex convention. The latter defines a greater
983 than zero value used to identify address pools in the
984 managed system. This extension permits the additional
985 value of zero, which serves as a placeholder when the
986 implementation does not support address pools or no address
987 pool is configured in a given external realm."
988 SYNTAX Unsigned32 (0|1..4294967295)
990 -- notifications
992 natv2MIBNotifications OBJECT IDENTIFIER ::= { natv2MIB 0 }
994 natv2NotificationPoolUsageLow NOTIFICATION-TYPE
995 OBJECTS { natv2PoolNotifiedPortMapEntries,
996 natv2PoolNotifiedPortMapProtocol }
997 STATUS current
998 DESCRIPTION
999 "This notification is triggered when an address pool's usage
1000 becomes less than or equal to the value of the
1001 natv2PoolThresholdUsageLow object for that pool, unless the
1002 notification has been disabled by setting the value of the
1003 threshold to -1. It is reported subject to the rate
1004 limitation specified by natv2PortMapNotificationInterval.
1006 Address pool usage is calculated as the percentage of the
1007 total number of ports allocated to the address pool that are
1008 already in use, for the most-mapped protocol at the time
1009 the notification is triggered. The two returned objects are
1010 members of natv2PoolTable indexed by the NAT instance and
1011 pool indices for which the event is being reported. They
1012 give the number of port map entries using external addresses
1013 configured on the pool for the most-mapped protocol and
1014 identify that protocol at the time the notification was
1015 triggered."
1016 REFERENCE
1017 "RFC yyyy Section 3.1.2 and Section 3.3.6."
1018 ::= { natv2MIBNotifications 1 }
1020 natv2NotificationPoolUsageHigh NOTIFICATION-TYPE
1021 OBJECTS { natv2PoolNotifiedPortMapEntries,
1022 natv2PoolNotifiedPortMapProtocol }
1023 STATUS current
1024 DESCRIPTION
1025 "This notification is triggered when an address pool's usage
1026 becomes greater than or equal to the value of the
1027 natv2PoolThresholdUsageHigh object for that pool, unless
1028 the notification has been disabled by setting the value of
1029 the threshold to 0. It is reported subject to the rate
1030 limitation specified by natv2PortMapNotificationInterval.
1032 Address pool usage is calculated as the percentage of the
1033 total number of ports allocated to the address pool that are
1034 already in use, for the most-mapped protocol at the time the
1035 notification is triggered. The two returned objects are
1036 members of natv2PoolTable indexed by the NAT instance and
1037 pool indices for which the event is being reported. They
1038 give the number of port map entries using external addresses
1039 configured on the pool for the most-mapped protocol and
1040 identify that protocol at the time the notification was
1041 triggered."
1042 REFERENCE
1043 "RFC yyyy Section 3.1.2 and Section 3.3.6."
1044 ::= { natv2MIBNotifications 2 }
1046 natv2NotificationInstanceAddressMapEntriesHigh NOTIFICATION-TYPE
1047 OBJECTS { natv2InstanceAddressMapEntries,
1048 natv2InstanceAddressMapCreations }
1050 STATUS current
1051 DESCRIPTION
1052 "This notification is triggered when the value of
1053 natv2InstanceAddressMapEntries equals or exceeds the value
1054 of the natv2InstanceThresholdAddressMapEntriesHigh object
1055 for the NAT instance, unless disabled by setting that
1056 threshold to 0. Reporting is subject to the rate limitation
1057 given by natv2InstanceNotificationInterval.
1059 natv2InstanceAddressMapEntries and
1060 natv2InstanceAddressMapCreations are members of table
1061 natv2InstanceTable indexed by the identifier of the NAT
1062 instance for which the event is being reported. The values
1063 reported are those observed at the moment the notification
1064 was triggered."
1065 REFERENCE
1066 "RFC yyyy Section 3.1.2."
1067 ::= { natv2MIBNotifications 3 }
1069 natv2NotificationInstancePortMapEntriesHigh NOTIFICATION-TYPE
1070 OBJECTS { natv2InstancePortMapEntries,
1071 natv2InstancePortMapCreations }
1072 STATUS current
1073 DESCRIPTION
1074 "This notification is triggered when the value of
1075 natv2InstancePortMapEntries becomes greater than or equal to
1076 the value of natv2InstanceThresholdPortMapEntriesHigh,
1077 unless disabled by setting that threshold to 0. Reporting is
1078 subject to the rate limitation given by
1079 natv2InstanceNotificationInterval.
1081 natv2InstancePortMapEntries and
1082 natv2InstancePortMapCreations are members of table
1083 natv2InstanceTable indexed by the identifier of the NAT
1084 instance for which the event is being reported. The values
1085 reported are those observed at the moment the notification
1086 was triggered."
1087 ::= { natv2MIBNotifications 4 }
1089 natv2NotificationSubscriberPortMappingEntriesHigh
1090 NOTIFICATION-TYPE
1091 OBJECTS { natv2SubscriberPortMapEntries,
1092 natv2SubscriberPortMapCreations }
1093 STATUS current
1094 DESCRIPTION
1095 "This notification is triggered when the value of
1096 natv2SubscriberPortMapEntries for an individual subscriber
1097 becomes greater than or equal to the value of the
1098 natv2SubscriberThresholdPortMapEntriesHigh object for that
1099 subscriber, unless disabled by setting that threshold to 0.
1100 Reporting is subject to the rate limitation given by
1101 natv2SubscriberNotificationInterval.
1103 natv2SubscriberPortMapEntries and
1104 natv2SubscriberPortMapCreations are members of table
1105 natv2SubscriberTable indexed by the subscriber for
1106 which the event is being reported. The values
1107 reported are those observed at the moment the notification
1108 was triggered."
1109 ::= { natv2MIBNotifications 5 }
1111 -- Device-level objects
1113 natv2MIBDeviceObjects OBJECT IDENTIFIER ::= { natv2MIB 1 }
1115 -- subscriber table
1117 natv2SubscriberTable OBJECT-TYPE
1118 SYNTAX SEQUENCE OF Natv2SubscriberEntry
1119 MAX-ACCESS not-accessible
1120 STATUS current
1121 DESCRIPTION
1122 "Table of subscribers. As well as the subscriber index, it
1123 provides per-subscriber state and counter objects, a last
1124 discontinuity time object for the counters, and writable
1125 threshold value and limit on port consumption."
1126 REFERENCE
1127 "RFC yyyy Section 3.3.3."
1128 ::= { natv2MIBDeviceObjects 1 }
1130 natv2SubscriberEntry OBJECT-TYPE
1131 SYNTAX Natv2SubscriberEntry
1132 MAX-ACCESS not-accessible
1133 STATUS current
1134 DESCRIPTION
1135 "Each entry describes a single subscriber."
1136 INDEX { natv2SubscriberIndex }
1137 ::= { natv2SubscriberTable 1 }
1139 Natv2SubscriberEntry ::=
1140 SEQUENCE {
1141 natv2SubscriberIndex Natv2SubscriberIndex,
1142 natv2SubscriberRealm SnmpAdminString,
1143 natv2SubscriberInternalPrefixType InetAddressType,
1144 natv2SubscriberInternalPrefix InetAddress,
1145 natv2SubscriberInternalPrefixLength InetAddressPrefixLength,
1146 -- State
1147 natv2SubscriberAddressMapEntries Unsigned32,
1148 natv2SubscriberPortMapEntries Unsigned32,
1149 -- Counters and last discontinuity time
1150 natv2SubscriberTranslations Counter64,
1151 natv2SubscriberAddressMapCreations Counter64,
1152 natv2SubscriberPortMapCreations Counter64,
1153 natv2SubscriberAddressMapFailureDrops Counter64,
1154 natv2SubscriberPortMapFailureDrops Counter64,
1155 natv2SubscriberDiscontinuityTime TimeStamp,
1156 -- Read-write controls
1157 natv2SubscriberLimitPortMapEntries Unsigned32,
1158 -- Disable limit by setting to 0 (default)
1159 natv2SubscriberThresholdPortMapEntriesHigh Unsigned32,
1160 -- Disable notifications by setting threshold to 0 (default)
1161 natv2SubscriberNotificationInterval Unsigned32
1162 -- Default is 60 seconds
1163 }
1165 natv2SubscriberIndex OBJECT-TYPE
1166 SYNTAX Natv2SubscriberIndex
1167 MAX-ACCESS not-accessible
1168 STATUS current
1169 DESCRIPTION
1170 "A unique value, greater than zero, for each subscriber
1171 in the managed system. The value for each
1172 subscriber MUST remain constant at least from one
1173 update of the entity's natv2SubscriberDiscontinuityTime
1174 object until the next update of that object. If a
1175 subscriber is deleted, its assigned index value MUST NOT
1176 be assigned to another subscriber at least until
1177 reinitialization of the entity's management system."
1178 ::= { natv2SubscriberEntry 1 }
1180 -- Configuration for this subscriber: realm, internal address(es)
1182 natv2SubscriberInternalRealm OBJECT-TYPE
1183 SYNTAX SnmpAdminString (SIZE(0..32))
1184 MAX-ACCESS read-only
1185 STATUS current
1186 DESCRIPTION
1187 "The address realm to which this subscriber belongs. A realm
1188 defines an address space. All NATs support at least two
1189 realms.
1191 The default realm for subscribers is 'internal'.
1192 Administrators can set other values for individual
1193 subscribers when they are configured. The administrator MAY
1194 configure a new value of natv2SubscriberRealm at any time
1195 subsequent to initial configuration of the subscriber. If
1196 this happens, it MUST be treated as a point of discontinuity
1197 requiring an update of natv2SubscriberDiscontinuityTime.
1199 When the subscriber sends a packet to the NAT through a
1200 DS-Lite [RFC 6333] tunnel, this is the realm of the outer
1201 packet header source address. Other tunneled access is out
1202 of scope."
1203 REFERENCE
1204 "Address realm: RFC 2663. DS-Lite: RFC 6333."
1205 DEFVAL
1206 { "internal" }
1207 ::= { natv2SubscriberEntry 2 }
1209 natv2SubscriberInternalPrefixType OBJECT-TYPE
1210 SYNTAX InetAddressType
1211 MAX-ACCESS read-only
1212 STATUS current
1213 DESCRIPTION
1214 "Subscriber's internal prefix type. Any value other than
1215 ipv4(1) or ipv6(2) would be unexpected. In the case of
1216 DS-Lite access, this is the prefix type (IPv6(2)) used in
1217 the outer packet header."
1218 REFERENCE
1219 "DS-Lite: RFC 6333."
1220 ::= { natv2SubscriberEntry 3 }
1222 natv2SubscriberInternalPrefix OBJECT-TYPE
1223 SYNTAX InetAddress
1224 MAX-ACCESS read-only
1225 STATUS current
1226 DESCRIPTION
1227 "Prefix assigned to a subscriber's CPE. Source addresses of
1228 packets outgoing from the subscriber will be contained
1229 within this prefix. In the case of DS-Lite access,
1230 the source address taken from the prefix will be
1231 that of the outer header."
1232 REFERENCE
1233 "DS-Lite: RFC 6333."
1234 ::= { natv2SubscriberEntry 4 }
1236 natv2SubscriberInternalPrefixLength OBJECT-TYPE
1237 SYNTAX InetAddressPrefixLength
1238 MAX-ACCESS read-only
1239 STATUS current
1240 DESCRIPTION
1241 "Length of the prefix assigned to a subscriber's CPE, in
1242 bits. If a single address is assigned, this will be 32
1243 for IPv4 and 128 for IPv6."
1244 ::= { natv2SubscriberEntry 5 }
1246 -- State objects
1248 natv2SubscriberAddressMapEntries OBJECT-TYPE
1249 SYNTAX Unsigned32
1250 MAX-ACCESS read-only
1251 STATUS current
1252 DESCRIPTION
1253 "The current number of address map entries for the
1254 subscriber, including static mappings. An address map entry
1255 maps from a given internal address and realm to an external
1256 address in a particular external realm. This definition
1257 includes 'hairpin' mappings, where the external realm is the
1258 same as the internal one. Address map entries are also
1259 tracked per instance and per address pool within the
1260 instance."
1261 REFERENCE
1262 "RFC yyyy Section 3.3.8."
1263 ::= { natv2SubscriberEntry 6 }
1265 natv2SubscriberPortMapEntries OBJECT-TYPE
1266 SYNTAX Unsigned32
1267 MAX-ACCESS read-only
1268 STATUS current
1269 DESCRIPTION
1270 "The current number of port map entries in the port map table
1271 for the subscriber, including static mappings. A port map
1272 entry maps from a given external realm, address, and port
1273 for a given protocol to an internal realm, address, and
1274 port. This definition includes 'hairpin' mappings, where the
1275 external realm is the same as the internal one. Port map
1276 entries are also tracked per instance and per protocol and
1277 address pool within the instance."
1278 REFERENCE
1279 "RFC yyyy Section 3.3.9."
1280 ::= { natv2SubscriberEntry 7 }
1282 -- Counters and last discontinuity time
1284 natv2SubscriberTranslations OBJECT-TYPE
1285 SYNTAX Counter64
1286 MAX-ACCESS read-only
1287 STATUS current
1288 DESCRIPTION
1289 "The cumulative number of translated packets received from or
1290 sent to this subscriber. This value MUST be monotone
1291 increasing in the periods between updates of the entity's
1292 natv2SubscriberDiscontinuityTime. If a manager detects a
1293 change in the latter since the last time it sampled this
1294 counter, it SHOULD NOT make use of the difference between
1295 the latest value of the counter and any value retrieved
1296 before the new value of natv2SubscriberDiscontinuityTime."
1297 ::= { natv2SubscriberEntry 8 }
1299 natv2SubscriberAddressMapCreations OBJECT-TYPE
1300 SYNTAX Counter64
1301 MAX-ACCESS read-only
1302 STATUS current
1303 DESCRIPTION
1304 "The cumulative number of address map entries created for
1305 this subscriber, including static mappings. Address map
1306 entries are also tracked per instance and per protocol and
1307 address pool within the instance.
1309 This value MUST be monotone increasing in
1310 the periods between updates of the entity's
1311 natv2SubscriberDiscontinuityTime. If a manager detects a
1312 change in the latter since the last time it sampled this
1313 counter, it SHOULD NOT make use of the difference between
1314 the latest value of the counter and any value retrieved
1315 before the new value of natv2SubscriberDiscontinuityTime."
1316 ::= { natv2SubscriberEntry 9 }
1318 natv2SubscriberPortMapCreations OBJECT-TYPE
1319 SYNTAX Counter64
1320 MAX-ACCESS read-only
1321 STATUS current
1322 DESCRIPTION
1323 "The cumulative number of port map entries created for this
1324 subscriber, including static mappings. Port map entries are
1325 also tracked per instance and per protocol and address pool
1326 within the instance.
1328 This value MUST be monotone increasing in the periods
1329 between updates of the entity's
1330 natv2SubscriberDiscontinuityTime. If a manager detects a
1331 change in the latter since the last time it sampled this
1332 counter, it SHOULD NOT make use of the difference between
1333 the latest value of the counter and any value retrieved
1334 before the new value of natv2SubscriberDiscontinuityTime."
1335 ::= { natv2SubscriberEntry 10 }
1337 natv2SubscriberAddressMapFailureDrops OBJECT-TYPE
1338 SYNTAX Counter64
1339 MAX-ACCESS read-only
1340 STATUS current
1341 DESCRIPTION
1342 "The cumulative number of packets originated by this
1343 subscriber that were dropped because the packet would have
1344 triggered the creation of a new address map entry, but no
1345 address could be allocated in the selected external realm
1346 because all addresses from the selected address pool (or the
1347 whole realm, if no address pool has been configured for that
1348 realm) have already been fully allocated.
1350 This value MUST be monotone increasing in the periods
1351 between updates of the entity's
1352 natv2SubscriberDiscontinuityTime. If a manager detects a
1353 change in the latter since the last time it sampled this
1354 counter, it SHOULD NOT make use of the difference between
1355 the latest value of the counter and any value retrieved
1356 before the new value of natv2SubscriberDiscontinuityTime."
1357 ::= { natv2SubscriberEntry 11 }
1359 natv2SubscriberPortMapFailureDrops OBJECT-TYPE
1360 SYNTAX Counter64
1361 MAX-ACCESS read-only
1362 STATUS current
1363 DESCRIPTION
1364 "The cumulative number of packets dropped because the
1365 packet would have triggered the creation of a new
1366 port mapping, but no port could be allocated for the
1367 protocol concerned. The usual case for this will be
1368 for a NAT instance that supports address pooling and
1369 the 'paired' pooling behavior recommended by RFC 4787,
1370 where the internal endpoint has used up all of the
1371 ports allocated to it for the address it was mapped to
1372 in the selected address pool in the external realm
1373 concerned and cannot be given more ports because
1374 - policy or implementation prevents it from having a
1375 second address in the same pool, and
1376 - policy or unavailability prevents it from acquiring
1377 more ports at its originally assigned address.
1379 If the NAT instance supports address pooling but its
1380 pooling behavior is 'arbitrary' (meaning that
1381 the NAT instance can allocate a new port mapping for
1382 the given internal endpoint on any address in the
1383 selected address pool and is not bound to what it has
1384 already mapped for that endpoint), then this counter
1385 is incremented when all ports for the protocol concerned
1386 over the whole of the selected address pool are already
1387 in use.
1389 As a third case, if no address pools have been configured
1390 for the external realm concerned, then this counter is
1391 incremented because all ports for the protocol involved over
1392 the whole set of addresses available for that external realm
1393 are already in use.
1395 Finally, this counter is incremented if the packet would
1396 have triggered the creation of a new port mapping, but the
1397 current value of natv2SubscriberPortMapEntries equals or
1398 exceeds the value of natv2SubscriberLimitPortMapEntries
1399 for this subscriber (unless that limit is disabled).
1401 This value MUST be monotone increasing in the periods
1402 between updates of the entity's
1403 natv2SubscriberDiscontinuityTime. If a manager detects a
1404 change in the latter since the last time it sampled this
1405 counter, it SHOULD NOT make use of the difference between
1406 the latest value of the counter and any value retrieved
1407 before the new value of natv2SubscriberDiscontinuityTime."
1408 REFERENCE
1409 "Pooling behavior: RFC 4787, end of section 4.1."
1410 ::= { natv2SubscriberEntry 12 }
1412 natv2SubscriberDiscontinuityTime OBJECT-TYPE
1413 SYNTAX TimeStamp
1414 MAX-ACCESS read-only
1415 STATUS current
1416 DESCRIPTION
1417 "Snapshot of the value of the sysUpTime object at the
1418 beginning of the latest period of continuity of the
1419 statistical counters associated with this subscriber."
1420 ::= { natv2SubscriberEntry 14 }
1422 -- Per-subscriber limit and threshold on port mappings
1423 -- Disabled if set to zero
1424 natv2SubscriberLimitPortMapEntries OBJECT-TYPE
1425 SYNTAX Unsigned32
1426 MAX-ACCESS read-write
1427 STATUS current
1428 DESCRIPTION
1429 "Limit on total number of port mappings active for this
1430 subscriber (natv2SubscriberPortMapEntries). Once this limit
1431 is reached, packets that might have triggered new port
1432 mappings are dropped. The number of such packets dropped is
1433 counted in natv2InstancePortMapFailureDrops.
1435 Limit is disabled if set to zero (default)."
1436 DEFVAL
1437 { 0 }
1438 ::= { natv2SubscriberEntry 15 }
1440 natv2SubscriberThresholdPortMapEntriesHigh OBJECT-TYPE
1441 SYNTAX Unsigned32
1442 MAX-ACCESS read-write
1443 STATUS current
1444 DESCRIPTION
1445 "Notification threshold for total number of port mappings
1446 active for this subscriber. Whenever
1447 natv2SubscriberPortMapEntries is updated, if it equals or
1448 exceeds natv2SubscriberThresholdPortMapEntriesHigh, the
1449 notification
1450 natv2NotificationSubscriberPortMappingEntriesHigh is
1451 triggered, unless the notification is disabled by setting
1452 the threshold to 0. Reporting is subject to the minimum
1453 inter-notification interval given by
1454 natv2SubscriberNotificationInterval. If multiple
1455 notifications are triggered during one interval, the agent
1456 MUST report only the one containing the highest value of
1457 natv2SubscriberPortMapEntries and discard the others."
1458 DEFVAL
1459 { 0 }
1460 ::= { natv2SubscriberEntry 16 }
1462 natv2SubscriberNotificationInterval OBJECT-TYPE
1463 SYNTAX Unsigned32 (1..3600)
1464 UNITS
1465 "Seconds"
1466 MAX-ACCESS read-write
1467 STATUS current
1468 DESCRIPTION
1469 "Minimum number of seconds (default 60) between successive
1470 reporting of notifications for this subscriber. Controls the
1471 reporting of
1472 natv2NotificationSubscriberPortMappingEntriesHigh."
1473 DEFVAL
1474 { 60 }
1475 ::= { natv2SubscriberEntry 17 }
1477 -- Per-NAT-instance objects
1479 natv2MIBInstanceObjects OBJECT IDENTIFIER ::= { natv2MIB 2 }
1480 -- Instance table
1482 natv2InstanceTable OBJECT-TYPE
1483 SYNTAX SEQUENCE OF Natv2InstanceEntry
1484 MAX-ACCESS not-accessible
1485 STATUS current
1486 DESCRIPTION
1487 "Table of NAT instances. As well as state and counter
1488 objects, it provides the instance index, instance name, and
1489 the last discontinuity time object which is applicable to
1490 the counters. It also contains writable thresholds for
1491 reporting of notifications and limits on usage of resources
1492 at the level of the NAT instance.
1494 It is assumed that NAT instances can be created and deleted
1495 dynamically, but this MIB module does not provide the means
1496 to do so. For restrictions on assignment and maintenance of
1497 the NAT index instance see the description of
1498 natv2InstanceIndex in the table below. For the requirements
1499 on maintenance of the values of the counters in this table
1500 see the description of natv2InstanceDiscontinuityTime in
1501 this table.
1503 Each NAT instance has its own resources and behavior. The
1504 resources include memory as reflected in space for map
1505 entries, processing power as reflected in the rate of map
1506 creation and deletion, and mappable addresses in each realm
1507 that can play the role of an external realm for at least
1508 some mappings for that instance. The NAT instance table
1509 includes limits and notification thresholds that relate to
1510 memory usage for mapping at the level of the whole instance.
1511 The limit on number of subscribers with active mappings is a
1512 limit to some extent on processor usage.
1514 The mappable 'external' addresses may or may not be
1515 organized into address pools. For a definition of address
1516 pools see the description of natv2PoolTable. If the instance
1517 does support address pools, it also has a pooling behavior.
1518 Mapping, filtering, and pooling behavior are defined in the
1519 descriptions of the natv2InstancePortMappingBehavior,
1520 natv2InstanceFilteringBehavior, and
1521 natv2InstancePoolingBehavior objects in this table. The
1522 instance also has a fragmentation behavior, defined in the
1523 description of the natv2InstanceFragmentBehavior object."
1524 REFERENCE
1525 "RFC yyyy Section 3.3.4. NAT behaviors: RFC 4787
1526 (primary, UDP); RFC 5382 (TCP), RFC 5508 (ICMP), RFC5597
1527 (DCCP)."
1529 ::= { natv2MIBInstanceObjects 1 }
1531 natv2InstanceEntry OBJECT-TYPE
1532 SYNTAX Natv2InstanceEntry
1533 MAX-ACCESS not-accessible
1534 STATUS current
1535 DESCRIPTION
1536 "Objects related to a single NAT instance."
1537 INDEX { natv2InstanceIndex }
1538 ::= { natv2InstanceTable 1 }
1540 Natv2InstanceEntry ::=
1541 SEQUENCE {
1542 natv2InstanceIndex Natv2InstanceIndex,
1543 natv2InstanceAlias DisplayString,
1544 -- Configured behaviors
1545 natv2InstancePortMappingBehavior INTEGER,
1546 natv2InstanceFilteringBehavior INTEGER,
1547 natv2InstancePoolingBehavior INTEGER,
1548 natv2InstanceFragmentBehavior INTEGER,
1549 -- State
1550 natv2InstanceAddressMapEntries Unsigned32,
1551 natv2InstancePortMapEntries Unsigned32,
1552 -- Statistics and discontinuity time
1553 natv2InstanceTranslations Counter64,
1554 natv2InstanceAddressMapCreations Counter64,
1555 natv2InstancePortMapCreations Counter64,
1556 natv2InstanceAddressMapEntryLimitDrops Counter64,
1557 natv2InstancePortMapEntryLimitDrops Counter64,
1558 natv2InstanceSubscriberActiveLimitDrops Counter64,
1559 natv2InstanceAddressMapFailureDrops Counter64,
1560 natv2InstancePortMapFailureDrops Counter64,
1561 natv2InstanceFragmentDrops Counter64,
1562 natv2InstanceOtherResourceFailureDrops Counter64,
1563 natv2InstanceDiscontinuityTime TimeStamp,
1564 -- Notification thresholds, disabled if set to 0
1565 natv2InstanceThresholdAddressMapEntriesHigh Unsigned32,
1566 natv2InstanceThresholdPortMapEntriesHigh Unsigned32,
1567 natv2InstanceNotificationInterval Unsigned32,
1568 -- Limits, disabled if set to 0
1569 natv2InstanceLimitAddressMapEntries Unsigned32,
1570 natv2InstanceLimitPortMapEntries Unsigned32,
1571 natv2InstanceLimitPendingFragments Unsigned32,
1572 natv2InstanceLimitSubscriberActives Unsigned32
1573 }
1575 natv2InstanceIndex OBJECT-TYPE
1576 SYNTAX Natv2InstanceIndex
1577 MAX-ACCESS not-accessible
1578 STATUS current
1579 DESCRIPTION
1580 "NAT instance index. It is up to the implementation to
1581 determine which values correspond to in-service NAT
1582 instances. This object is used as an index for all tables
1583 defined below."
1584 ::= { natv2InstanceEntry 1 }
1586 natv2InstanceAlias OBJECT-TYPE
1587 SYNTAX DisplayString (SIZE (0..64))
1588 MAX-ACCESS read-only
1589 STATUS current
1590 DESCRIPTION
1591 "This object is an 'alias' name for the NAT instance as
1592 specified by a network manager, and provides a non-volatile
1593 'handle' for the instance.
1595 An example of the value which a network manager might store
1596 in this object for a NAT instance is the name/identifier of
1597 the interface that brings in internal traffic for this NAT
1598 instance or the name of the VRF for internal traffic."
1599 ::= { natv2InstanceEntry 2 }
1601 -- Configured behaviors
1603 natv2InstancePortMappingBehavior OBJECT-TYPE
1604 MAX-ACCESS read-only
1605 STATUS current
1606 DESCRIPTION
1607 "Port mapping behavior is the policy governing selection of
1608 external address and port in a given realm for a given
1609 five-tuple of source address and port, destination address
1610 and port, and protocol.
1612 endpointIndependent(0), the behavior REQUIRED by RFC 4787
1613 REQ-1, maps the source address and port to the same
1614 external address and port for all destination address and
1615 port combinations reached through the same external realm
1616 and using the given protocol.
1618 addressDependent(1) maps to the same external address and
1619 port for all destination ports at the same destination
1620 address reached through the same external realm and using
1621 the given protocol.
1623 addressAndPortDependent(2) maps to a separate external
1624 address and port combination for each different
1625 destination address and port combination reached through
1626 the same external realm."
1627 REFERENCE
1628 "RFC 4787 section 4.1."
1629 SYNTAX INTEGER {
1630 endpointIndependent (0),
1631 addressDependent (1),
1632 addressAndPortDependent (2)
1633 }
1634 ::= { natv2InstanceEntry 3 }
1636 natv2InstanceFilteringBehavior OBJECT-TYPE
1637 MAX-ACCESS read-only
1638 STATUS current
1639 DESCRIPTION
1640 "Filtering behavior is the policy governing acceptance or
1641 dropping of packets incoming from remote sources via a
1642 given external realm and destined to a specific three-tuple
1643 of external address, port, and protocol at the NAT instance
1644 that has been assigned in a port mapping.
1646 endpointIndependent(0) accepts for translation packets from
1647 all combinations of remote address and port destined to the
1648 mapped external address and port via the given external
1649 realm and using the given protocol.
1651 addressDependent(1) accepts for translation packets from all
1652 remote ports from the same remote source address destined to
1653 the mapped external address and port via the given external
1654 realm and using the given protocol.
1656 addressAndPortDependent(2) accepts for translation only
1657 those packets with the same remote source address, port, and
1658 protocol incoming from the same external realm as identified
1659 when the applicable port map entry was created.
1661 RFC 4787 REQ-8 recommends either endpointIndependent(0) or
1662 addressDependent(1) filtering behavior depending on whether
1663 application-friendliness or security takes priority."
1664 REFERENCE
1665 "RFC 4787 section 5."
1666 SYNTAX INTEGER {
1667 endpointIndependent (0),
1668 addressDependent (1),
1669 addressAndPortDependent (2)
1670 }
1671 ::= { natv2InstanceEntry 4 }
1673 natv2InstancePoolingBehavior OBJECT-TYPE
1674 MAX-ACCESS read-only
1675 STATUS current
1676 DESCRIPTION
1677 "Pooling behavior is the policy used to select the address
1678 for a new port mapping within a given address pool to which
1679 the internal address has already been mapped.
1681 arbitrary(0) pooling behavior means that the NAT instance
1682 may create the new port mapping using any address in the
1683 pool that has a free port for the protocol concerned.
1685 paired(1) pooling behavior, the behavior RECOMMENDED by RFC
1686 4787 REQ-2, means that once a given internal address has
1687 been mapped to a particular address in a particular pool,
1688 further mappings of the same internal address to that pool
1689 will reuse the previously assigned pool member address."
1690 REFERENCE
1691 "RFC 4787 near the end of section 4.1"
1692 SYNTAX INTEGER {
1693 arbitrary (0),
1694 paired (1)
1695 }
1696 ::= { natv2InstanceEntry 5 }
1698 natv2InstanceFragmentBehavior OBJECT-TYPE
1699 MAX-ACCESS read-only
1700 STATUS current
1701 DESCRIPTION
1702 "Fragment behavior is the NAT instance's capability to
1703 receive and translate fragments incoming from remote
1704 sources.
1706 fragmentNone(0) implies no capability to translate incoming
1707 fragments, so all received fragments are dropped. Each
1708 dropped fragment is counted in natv2InstanceFragmentDrops.
1710 fragmentInOrder(1) implies the ability to translate
1711 fragments only if they are received in order, so that in
1712 particular the header is in the first packet. If a fragment
1713 is received out of order, it is dropped and counted in
1714 natv2InstanceFragmentDrops.
1716 fragmentOutOfOrder(2), the capability REQUIRED by RFC 4787
1717 REQ-14, implies the capability to translate fragments even
1718 when they arrive out of order, subject to a protective
1719 limit natv2InstanceLimitPendingFragments on total number of
1720 fragments awaiting the first fragment of the chain. If the
1721 implementation supports this capability,
1722 natv2InstanceFragmentDrops is incremented only when a new
1723 fragment arrives but is dropped because the limit on pending
1724 fragments has already been reached."
1725 REFERENCE
1726 "RFC 4787 section 11."
1727 SYNTAX INTEGER {
1728 fragmentNone (0),
1729 fragmentInOrder (1),
1730 fragmentOutOfOrder (2)
1731 ::= { natv2InstanceEntry 6 }
1733 -- State
1735 natv2InstanceAddressMapEntries OBJECT-TYPE
1736 SYNTAX Unsigned32
1737 MAX-ACCESS read-only
1738 STATUS current
1739 DESCRIPTION
1740 "The current number of address map entries in total over the
1741 whole NAT instance, including static mappings. An address
1742 map entry maps from a given internal address and realm to an
1743 external address in a particular external realm. This
1744 definition includes 'hairpin' mappings, where the external
1745 realm is the same as the internal one. Address map entries
1746 are also tracked per subscriber and per address pool within
1747 the instance."
1748 REFERENCE
1749 "RFC yyyy Section 3.3.8. RFC 4787 section 6."
1750 ::= { natv2InstanceEntry 7 }
1752 natv2InstancePortMapEntries OBJECT-TYPE
1753 SYNTAX Unsigned32
1754 MAX-ACCESS read-only
1755 STATUS current
1756 DESCRIPTION
1757 "The current number of entries in the port map table in total
1758 over the whole NAT instance, including static mappings. A
1759 port map entry maps from a given external realm, address,
1760 and port for a given protocol to an internal realm, address,
1761 and port. This definition includes 'hairpin' mappings, where
1762 the external realm is the same as the internal one. Port map
1763 entries are also tracked per subscriber and per protocol and
1764 address pool within the instance."
1765 REFERENCE
1766 "RFC yyyy Section 3.3.9.
1767 Hairpinning: RFC 4787 Section 6."
1768 ::= { natv2InstanceEntry 8 }
1770 -- Statistics
1772 natv2InstanceTranslations OBJECT-TYPE
1773 SYNTAX Counter64
1774 MAX-ACCESS read-only
1775 STATUS current
1776 DESCRIPTION
1777 "The cumulative number of translated packets passing through
1778 this NAT instance. This value MUST be monotone increasing in
1779 the periods between updates of
1780 natv2InstanceDiscontinuityTime. If a manager detects a
1781 change in the latter since the last time it sampled this
1782 counter, it SHOULD NOT make use of the difference between
1783 the latest value of the counter and any value retrieved
1784 before the new value of natv2InstanceDiscontinuityTime."
1785 ::= { natv2InstanceEntry 9 }
1787 natv2InstanceAddressMapCreations OBJECT-TYPE
1788 SYNTAX Counter64
1789 MAX-ACCESS read-only
1790 STATUS current
1791 DESCRIPTION
1792 "The cumulative number of address map entries created by the
1793 NAT instance, including static mappings. Address map
1794 creations are also tracked per address pool within the
1795 instance and per subscriber.
1797 This value MUST be monotone increasing in
1798 the periods between updates of
1799 natv2InstanceDiscontinuityTime. If a manager detects a
1800 change in the latter since the last time it sampled this
1801 counter, it SHOULD NOT make use of the difference between
1802 the latest value of the counter and any value retrieved
1803 before the new value of natv2InstanceDiscontinuityTime."
1804 ::= { natv2InstanceEntry 10 }
1806 natv2InstancePortMapCreations OBJECT-TYPE
1807 SYNTAX Counter64
1808 MAX-ACCESS read-only
1809 STATUS current
1810 DESCRIPTION
1811 "The cumulative number of port map entries created by the
1812 NAT instance, including static mappings. Port map
1813 creations are also tracked per protocol and address pool
1814 within the instance and per subscriber.
1816 This value MUST be monotone increasing in
1817 the periods between updates of
1818 natv2InstanceDiscontinuityTime. If a manager detects a
1819 change in the latter since the last time it sampled this
1820 counter, it SHOULD NOT make use of the difference between
1821 the latest value of the counter and any value retrieved
1822 before the new value of natv2InstanceDiscontinuityTime."
1823 ::= { natv2InstanceEntry 11 }
1825 natv2InstanceAddressMapEntryLimitDrops OBJECT-TYPE
1826 SYNTAX Counter64
1827 MAX-ACCESS read-only
1828 STATUS current
1829 DESCRIPTION
1830 "The cumulative number of packets dropped rather than
1831 translated because the packet would have triggered
1832 the creation of a new address map entry but the limit
1833 on number of address map entries for the NAT instance
1834 given by natv2InstanceLimitAddressMapEntries has
1835 already been reached.
1837 This value MUST be monotone increasing in the periods
1838 between updates of the entity's
1839 natv2InstanceDiscontinuityTime. If a manager detects a
1840 change in the latter since the last time it sampled this
1841 counter, it SHOULD NOT make use of the difference between
1842 the latest value of the counter and any value retrieved
1843 before the new value of natv2InstanceDiscontinuityTime."
1844 ::= { natv2InstanceEntry 12 }
1846 natv2InstancePortMapEntryLimitDrops OBJECT-TYPE
1847 SYNTAX Counter64
1848 MAX-ACCESS read-only
1849 STATUS current
1850 DESCRIPTION
1851 "The cumulative number of packets dropped rather than
1852 translated because the packet would have triggered
1853 the creation of a new port map entry but the limit
1854 on number of port map entries for the NAT instance
1855 given by natv2InstanceLimitPortMapEntries has
1856 already been reached.
1858 This value MUST be monotone increasing in the periods
1859 between updates of the entity's
1860 natv2InstanceDiscontinuityTime. If a manager detects a
1861 change in the latter since the last time it sampled this
1862 counter, it SHOULD NOT make use of the difference between
1863 the latest value of the counter and any value retrieved
1864 before the new value of natv2InstanceDiscontinuityTime."
1865 ::= { natv2InstanceEntry 13 }
1867 natv2InstanceSubscriberActiveLimitDrops OBJECT-TYPE
1868 SYNTAX Counter64
1869 MAX-ACCESS read-only
1870 STATUS current
1871 DESCRIPTION
1872 "The cumulative number of packets dropped rather than
1873 translated because the packet would have triggered the
1874 creation of a new mapping for a subscriber with no other
1875 active mappings, but the limit on number of active
1876 subscribers for the NAT instance given by
1877 natv2InstanceLimitSubscriberActives has already been
1878 reached.
1880 This value MUST be monotone increasing in the periods
1881 between updates of the entity's
1882 natv2InstanceDiscontinuityTime. If a manager detects a
1883 change in the latter since the last time it sampled this
1884 counter, it SHOULD NOT make use of the difference between
1885 the latest value of the counter and any value retrieved
1886 before the new value of natv2InstanceDiscontinuityTime."
1887 ::= { natv2InstanceEntry 14 }
1889 natv2InstanceAddressMapFailureDrops OBJECT-TYPE
1890 SYNTAX Counter64
1891 MAX-ACCESS read-only
1892 STATUS current
1893 DESCRIPTION
1894 "The cumulative number of packets dropped because the packet
1895 would have triggered the creation of a new address map
1896 entry, but no address could be allocated in the selected
1897 external realm because all addresses from the selected
1898 address pool (or the whole realm, if no address pool has
1899 been configured for that realm) have already been fully
1900 allocated.
1902 This value MUST be monotone increasing in the periods
1903 between updates of the entity's
1904 natv2InstanceDiscontinuityTime. If a manager detects a
1905 change in the latter since the last time it sampled this
1906 counter, it SHOULD NOT make use of the difference between
1907 the latest value of the counter and any value retrieved
1908 before the new value of natv2InstanceDiscontinuityTime."
1909 ::= { natv2InstanceEntry 15 }
1911 natv2InstancePortMapFailureDrops OBJECT-TYPE
1912 SYNTAX Counter64
1913 MAX-ACCESS read-only
1914 STATUS current
1915 DESCRIPTION
1916 "The cumulative number of packets dropped because the
1917 packet would have triggered the creation of a new
1918 port map entry, but no port could be allocated for the
1919 protocol concerned. The usual case for this will be
1920 for a NAT instance that supports address pooling and
1921 the 'paired' pooling behavior recommended by RFC 4787,
1922 where the internal endpoint has used up all of the
1923 ports allocated to it for the address it was mapped to
1924 in the selected address pool in the external realm
1925 concerned and cannot be given more ports because
1926 - policy or implementation prevents it from having a
1927 second address in the same pool, and
1928 - policy or unavailability prevents it from acquiring
1929 more ports at its originally assigned address.
1931 If the NAT instance supports address pooling but its
1932 pooling behavior is 'arbitrary' (meaning that
1933 the NAT instance can allocate a new port mapping for
1934 the given internal endpoint on any address in the
1935 selected address pool and is not bound to what it has
1936 already mapped for that endpoint), then this counter
1937 is incremented when all ports for the protocol concerned
1938 over the whole of the selected address pool are already
1939 in use.
1941 Finally, if no address pools have been configured for the
1942 external realm concerned, then this counter is incremented
1943 because all ports for the protocol involved over the whole
1944 set of addresses available for that external realm are
1945 already in use.
1947 This value MUST be monotone increasing in the periods
1948 between updates of the entity's
1949 natv2InstanceDiscontinuityTime. If a manager detects a
1950 change in the latter since the last time it sampled this
1951 counter, it SHOULD NOT make use of the difference between
1952 the latest value of the counter and any value retrieved
1953 before the new value of natv2InstanceDiscontinuityTime."
1954 REFERENCE
1955 "Pooling behavior: RFC 4787, end of section 4.1."
1956 ::= { natv2InstanceEntry 16 }
1958 natv2InstanceFragmentDrops OBJECT-TYPE
1959 SYNTAX Counter64
1960 MAX-ACCESS read-only
1961 STATUS current
1962 DESCRIPTION
1963 "The cumulative number of fragments received by the NAT
1964 instance but dropped rather than translated. When the NAT
1965 instance supports the 'Receive Fragment Out of Order'
1966 capability as required by RFC 4787, this occurs because the
1967 fragment was received out of order and would be added to the
1968 queue of fragments awaiting the initial fragment of the
1969 chain, but the queue has already reached the limit set by
1970 natv2InstanceLimitsPendingFragments. Counting in other cases
1971 is specified in the description of
1972 natv2InstanceFragmentBehavior.
1974 This value MUST be monotone increasing in the periods
1975 between updates of the entity's
1976 natv2InstanceDiscontinuityTime. If a manager detects a
1977 change in the latter since the last time it sampled this
1978 counter, it SHOULD NOT make use of the difference between
1979 the latest value of the counter and any value retrieved
1980 before the new value of natv2InstanceDiscontinuityTime."
1981 REFERENCE
1982 "RFC 4787, section 11."
1983 ::= { natv2InstanceEntry 17 }
1985 natv2InstanceOtherResourceFailureDrops OBJECT-TYPE
1986 SYNTAX Counter64
1987 MAX-ACCESS read-only
1988 STATUS current
1989 DESCRIPTION
1990 "The cumulative number of packets dropped because of
1991 unavailability of a resource other than an address or port
1992 that would have been required to process it. The most likely
1993 case is where the upper layer protocol in the packet is not
1994 supported by the NAT instance.
1996 This value MUST be monotone increasing in the periods
1997 between updates of the entity's
1998 natv2InstanceDiscontinuityTime. If a manager detects a
1999 change in the latter since the last time it sampled this
2000 counter, it SHOULD NOT make use of the difference between
2001 the latest value of the counter and any value retrieved
2002 before the new value of natv2InstanceDiscontinuityTime."
2003 ::= { natv2InstanceEntry 18 }
2005 natv2InstanceDiscontinuityTime OBJECT-TYPE
2006 SYNTAX TimeStamp
2007 MAX-ACCESS read-only
2008 STATUS current
2009 DESCRIPTION
2010 "Snapshot of the value of the sysUpTime object at the
2011 beginning of the latest period of continuity of the
2012 statistical counters associated with this NAT instance."
2013 ::= { natv2InstanceEntry 19 }
2015 -- Notification thresholds, disabled by setting to zero
2017 natv2InstanceThresholdAddressMapEntriesHigh OBJECT-TYPE
2018 SYNTAX Unsigned32
2019 MAX-ACCESS read-write
2020 STATUS current
2021 DESCRIPTION
2022 "Notification threshold for total number of address map
2023 entries held by this NAT instance. Whenever
2024 natv2InstanceAddressMapEntries is updated, if it equals or
2025 exceeds natv2InstanceThresholdAddressMapEntriesHigh, then
2026 natv2NotificationInstanceAddressMapEntriesHigh may be
2027 triggered, unless the notification is disabled by setting
2028 the threshold to 0. Reporting is subject to the minimum
2029 inter-notification interval given by
2030 natv2InstanceNotificationInterval. If multiple notifications
2031 are triggered during one interval, the agent MUST report
2032 only the one containing the highest value of
2033 natv2InstanceAddressMapEntries and discard the others."
2034 DEFVAL
2035 { 0 }
2036 ::= { natv2InstanceEntry 20 }
2038 natv2InstanceThresholdPortMapEntriesHigh OBJECT-TYPE
2039 SYNTAX Unsigned32
2040 MAX-ACCESS read-write
2041 STATUS current
2042 DESCRIPTION
2043 "Notification threshold for total number of port map
2044 entries held by this NAT instance. Whenever
2045 natv2InstancePortMapEntries is updated, if it equals or
2046 exceeds natv2InstanceThresholdPortMapEntriesHigh, then
2047 natv2NotificationInstancePortMapEntriesHigh may be
2048 triggered, unless the notification is disabled by setting
2049 the threshold to 0. Reporting is subject to the minimum
2050 inter-notification interval given by
2051 natv2InstanceNotificationInterval. If multiple notifications
2052 are triggered during one interval, the agent MUST report
2053 only the one containing the highest value of
2054 natv2InstancePortMapEntries and discard the others."
2055 DEFVAL
2056 { 0 }
2057 ::= { natv2InstanceEntry 21 }
2059 natv2InstanceNotificationInterval OBJECT-TYPE
2060 SYNTAX Unsigned32 (1..3600)
2061 UNITS
2062 "Seconds"
2063 MAX-ACCESS read-write
2064 STATUS current
2065 DESCRIPTION
2066 "Minimum number of seconds (default 10) between successive
2067 notifications for this NAT instance. Controls the reporting
2068 of natv2NotificationInstanceAddressMapEntriesHigh and
2069 natv2NotificationInstancePortMapEntriesHigh."
2070 DEFVAL
2071 { 10 }
2072 ::= { natv2InstanceEntry 22 }
2074 -- Limits, disabled if set to 0
2076 natv2InstanceLimitAddressMapEntries OBJECT-TYPE
2077 SYNTAX Unsigned32
2078 MAX-ACCESS read-write
2079 STATUS current
2080 DESCRIPTION
2081 "Limit on total number of address map entries supported by
2082 the NAT instance. When natv2InstanceAddressMapEntries has
2083 reached this limit, subsequent packets that would normally
2084 trigger creation of a new address map entry will be dropped
2085 and counted in natv2InstanceAddressMapEntryLimitDrops.
2086 Warning of an approach to this limit can be achieved by
2087 setting natv2InstanceThresholdAddressMapEntriesHigh to a
2088 non-zero value, for example, 80% of the limit. The limit is
2089 disabled by setting its value to zero (default value).
2091 For further information please see the descriptions of
2092 natv2NotificationInstanceAddressMapEntriesHigh and
2093 natv2InstanceAddressMapEntries."
2094 DEFVAL
2095 { 0 }
2096 ::= { natv2InstanceEntry 23 }
2098 natv2InstanceLimitPortMapEntries OBJECT-TYPE
2099 SYNTAX Unsigned32
2100 MAX-ACCESS read-write
2101 STATUS current
2102 DESCRIPTION
2103 "Limit on total number of port map entries supported by the
2104 NAT instance. When natv2InstancePortMapEntries has reached
2105 this limit, subsequent packets that would normally trigger
2106 creation of a new port map entry will be dropped and counted
2107 in natv2InstancePortMapEntryLimitDrops. Warning of an
2108 approach to this limit can be achieved by setting
2109 natv2InstanceThresholdPortMapEntriesHigh to a non-zero
2110 value, for example, 80% of the limit. The limit is disabled
2111 by setting its value to zero (default value).
2113 For further information please see the descriptions of
2114 natv2NotificationInstancePortMapEntriesHigh and
2115 natv2InstancePortMapEntries."
2116 DEFVAL
2117 { 0 }
2118 ::= { natv2InstanceEntry 24 }
2120 natv2InstanceLimitPendingFragments OBJECT-TYPE
2121 SYNTAX Unsigned32
2122 MAX-ACCESS read-write
2123 STATUS current
2124 DESCRIPTION
2125 "Limit on number of out-of-order fragments received by the
2126 NAT instance from remote sources and held until head of
2127 chain appears. While the number of held fragments is at this
2128 limit, subsequent packets that contain fragments not
2129 relating to those already held will be dropped and counted
2130 in natv2InstancePendingFragmentLimitDrops. The limit is
2131 disabled by setting the value to zero (default value).
2133 Applicable only when the NAT instance supports 'Receive
2134 Fragments Out of Order' behavior, leave at default
2135 otherwise. See the description of
2136 natv2InstanceFragmentBehavior."
2137 REFERENCE
2138 "RFC 4787 Section 11"
2139 DEFVAL { 0 }
2140 ::= { natv2InstanceEntry 25 }
2142 natv2InstanceLimitSubscriberActives OBJECT-TYPE
2143 SYNTAX Unsigned32
2144 MAX-ACCESS read-write
2145 STATUS current
2146 DESCRIPTION
2147 "Limit on number of total number of active subscribers
2148 supported by the NAT instance. An active subscriber is
2149 defined as any subscriber with at least one map entry,
2150 including static mappings. While the number of active
2151 subscribers is at this limit, subsequent packets that would
2152 otherwise trigger first mappings for newly active
2153 subscribers will be dropped and counted in
2154 natv2InstanceSubscriberActiveLimitDrops. The limit is
2155 disabled by setting the value to zero (default value).
2156 DEFVAL { 0 }
2157 ::= { natv2InstanceEntry 26 }
2159 -- Table of counters per upper layer protocol identified by the
2160 -- packet header and supported by the NAT instance
2162 natv2ProtocolTable OBJECT-TYPE
2163 SYNTAX SEQUENCE OF Natv2ProtocolEntry
2164 MAX-ACCESS not-accessible
2165 STATUS current
2166 DESCRIPTION
2167 "Table of protocols with per-protocol counters. Conceptual
2168 rows of the table are indexed by the combination of the NAT
2169 instance number and the IANA-assigned upper layer protocol
2170 number as given by the ProtocolNumber TC and contained in
2171 the packet IP header. It is up to the agent implementation
2172 to determine and operate upon only those upper layer
2173 protocol numbers supported by the NAT instance."
2174 REFERENCE
2175 "RFC yyyy Section 3.3.5."
2176 ::= { natv2MIBInstanceObjects 2 }
2178 natv2ProtocolEntry OBJECT-TYPE
2179 SYNTAX Natv2ProtocolEntry
2180 MAX-ACCESS not-accessible
2181 STATUS current
2182 DESCRIPTION
2183 "Per-protocol counters."
2184 INDEX { natv2ProtocolInstanceIndex,
2185 natv2ProtocolNumber }
2186 ::= { natv2ProtocolTable 1 }
2188 Natv2ProtocolEntry ::=
2189 SEQUENCE {
2190 natv2ProtocolInstanceIndex Natv2InstanceIndex,
2191 natv2ProtocolNumber ProtocolNumber,
2192 -- State
2193 natv2ProtocolPortMapEntries Unsigned32,
2194 -- Statistics. Discontinuity object from instance table reused here.
2195 natv2ProtocolTranslations Counter64,
2196 natv2ProtocolPortMapCreations Counter64,
2197 natv2ProtocolPortMapFailureDrops Counter64
2198 }
2200 natv2ProtocolInstanceIndex OBJECT-TYPE
2201 SYNTAX Natv2InstanceIndex
2202 MAX-ACCESS not-accessible
2203 STATUS current
2204 DESCRIPTION
2205 "NAT instance index. It is up to the implementation to
2206 determine and operate upon only those values that
2207 correspond to in-service NAT instances."
2208 ::= { natv2ProtocolEntry 1 }
2210 natv2ProtocolNumber OBJECT-TYPE
2211 SYNTAX ProtocolNumber
2212 MAX-ACCESS not-accessible
2213 STATUS current
2214 DESCRIPTION
2215 "Counters in this conceptual row apply to packets indicating
2216 the upper layer protocol identified by this object's
2217 value. It is up to the implementation to determine and
2218 operate upon only those values that correspond to protocols
2219 supported by the NAT instance."
2220 REFERENCE
2221 "RFC yyyy Section 3.3.5.
2222 IANA Protocol Numbers, http://www.iana.org/assignments/
2223 protocol-numbers/protocol-numbers.xhtml#protocol-numbers-1"
2224 ::= { natv2ProtocolEntry 2 }
2226 -- State
2227 natv2ProtocolPortMapEntries OBJECT-TYPE
2228 SYNTAX Unsigned32
2229 MAX-ACCESS read-only
2230 STATUS current
2231 DESCRIPTION
2232 "The current number of entries in the port map table in total
2233 over the whole NAT instance for a given protocol, including
2234 static mappings. A port map entry maps from a given external
2235 realm, address, and port for a given protocol to an internal
2236 realm, address, and port. This definition includes 'hairpin'
2237 mappings, where the external realm is the same as the
2238 internal one. Port map entries are also tracked per
2239 subscriber, per instance, and per address pool within the
2240 instance."
2241 REFERENCE
2242 "RFC yyyy Section 3.3.5 and Section 3.3.9. Hairpinning:
2243 RFC 4787 Section 6."
2244 ::= { natv2ProtocolEntry 3 }
2246 -- Statistics
2247 natv2ProtocolTranslations OBJECT-TYPE
2248 SYNTAX Counter64
2249 MAX-ACCESS read-only
2250 STATUS current
2251 DESCRIPTION
2252 "The cumulative number of packets translated by the NAT
2253 instance in either direction for the given protocol.
2255 This value MUST be monotone increasing in the periods
2256 between updates of the NAT instance
2257 natv2InstanceDiscontinuityTime. If a manager detects a
2258 change in the latter since the last time it sampled this
2259 counter, it SHOULD NOT make use of the difference between
2260 the latest value of the counter and any value retrieved
2261 before the new value of natv2InstanceDiscontinuityTime."
2262 ::= { natv2ProtocolEntry 4 }
2264 natv2ProtocolPortMapCreations OBJECT-TYPE
2265 SYNTAX Counter64
2266 MAX-ACCESS read-only
2267 STATUS current
2268 DESCRIPTION
2269 "The cumulative number of port map entries created by the NAT
2270 instance for the given protocol.
2272 This value MUST be monotone increasing in the periods
2273 between updates of the NAT instance
2274 natv2InstanceDiscontinuityTime. If a manager detects a
2275 change in the latter since the last time it sampled this
2276 counter, it SHOULD NOT make use of the difference between
2277 the latest value of the counter and any value retrieved
2278 before the new value of natv2InstanceDiscontinuityTime."
2279 ::= { natv2ProtocolEntry 5 }
2281 natv2ProtocolPortMapFailureDrops OBJECT-TYPE
2282 SYNTAX Counter64
2283 MAX-ACCESS read-only
2284 STATUS current
2285 DESCRIPTION
2286 "The cumulative number of packets dropped because the packet
2287 would have triggered the creation of a new port map entry,
2288 but no port could be allocated for the protocol concerned.
2289 The usual case for this will be for a NAT instance that
2290 supports address pooling and the 'paired' pooling behavior
2291 recommended by RFC 4787, where the internal endpoint has
2292 used up all of the ports allocated to it for the address it
2293 was mapped to in the selected address pool in the external
2294 realm concerned and cannot be given more ports because
2295 - policy or implementation prevents it from having a
2296 second address in the same pool, and
2297 - policy or unavailability prevents it from acquiring
2298 more ports at its originally assigned address.
2300 If the NAT instance supports address pooling but its
2301 pooling behavior is 'arbitrary' (meaning that
2302 the NAT instance can allocate a new port mapping for
2303 the given internal endpoint on any address in the
2304 selected address pool and is not bound to what it has
2305 already mapped for that endpoint), then this counter
2306 is incremented when all ports for the protocol concerned
2307 over the whole of the selected address pool are already
2308 in use.
2310 Finally, if the NAT instance has no configured address
2311 pooling, then this counter is incremented because all
2312 ports for the protocol concerned over the whole of the
2313 NAT instance for the external realm concerned are already
2314 in use.
2316 This value MUST be monotone increasing in the periods
2317 between updates of the NAT instance
2318 natv2InstanceDiscontinuityTime. If a manager detects a
2319 change in the latter since the last time it sampled this
2320 counter, it SHOULD NOT make use of the difference between
2321 the latest value of the counter and any value retrieved
2322 before the new value of natv2InstanceDiscontinuityTime."
2323 REFERENCE
2324 "RFC 4787, end of section 4.1."
2325 ::= { natv2ProtocolEntry 6 }
2327 -- pools
2329 natv2PoolTable OBJECT-TYPE
2330 SYNTAX SEQUENCE OF Natv2PoolEntry
2331 MAX-ACCESS not-accessible
2332 STATUS current
2333 DESCRIPTION
2334 "Table of address pools, applicable only if these are
2335 supported by the NAT instance. An address pool is a set of
2336 addresses and ports in a particular realm, available for
2337 assignment to the 'external' portion of a mapping. Where more
2338 than one pool has been configured for the realm, policy
2339 determines which subscribers and/or services are mapped to
2340 which pool. natv2PoolTable provides basic information, state,
2341 statistics, and two notification thresholds for each pool.
2342 natv2PoolRangeTable is an expansion table for natv2PoolTable
2343 that identifies particular address ranges allocated to the
2344 pool."
2346 REFERENCE
2347 "RFC yyyy Section 3.3.6."
2348 ::= { natv2MIBInstanceObjects 3 }
2350 natv2PoolEntry OBJECT-TYPE
2351 SYNTAX Natv2PoolEntry
2352 MAX-ACCESS not-accessible
2353 STATUS current
2354 DESCRIPTION
2355 "Entry in the table of address pools."
2356 INDEX { natv2PoolInstanceIndex, natv2PoolIndex }
2357 ::= { natv2PoolTable 1 }
2359 Natv2PoolEntry ::=
2360 SEQUENCE {
2361 -- Index
2362 natv2PoolInstanceIndex Natv2InstanceIndex,
2363 natv2PoolIndex Natv2PoolIndex,
2364 -- Configuration
2365 natv2PoolRealm SnmpAdminString,
2366 natv2PoolAddressType InetAddressType,
2367 natv2PoolMinimumPort InetPortNumber,
2368 natv2PoolMaximumPort InetPortNumber,
2369 -- State
2370 natv2PoolAddressMapEntries Unsigned32,
2371 natv2PoolPortMapEntries Unsigned32,
2372 -- Statistics and discontinuity time
2373 natv2PoolAddressMapCreations Counter64,
2374 natv2PoolPortMapCreations Counter64,
2375 natv2PoolAddressMapFailureDrops Counter64,
2376 natv2PoolPortMapFailureDrops Counter64,
2377 natv2PoolDiscontinuityTime TimeStamp,
2378 -- Notification thresholds and objects returned by notifications
2379 natv2PoolThresholdUsageLow Integer32,
2380 natv2PoolThresholdUsageHigh Integer32,
2381 natv2PoolNotifiedPortMapEntries Unsigned32,
2382 natv2PoolNotifiedPortMapProtocol ProtocolNumber,
2383 natv2PoolNotificationInterval Unsigned32
2384 }
2386 natv2PoolInstanceIndex OBJECT-TYPE
2387 SYNTAX Natv2InstanceIndex
2388 MAX-ACCESS not-accessible
2389 STATUS current
2390 DESCRIPTION
2391 "NAT instance index. It is up to the agent implementation
2392 to determine and operate upon only those values that
2393 correspond to in-service NAT instances."
2395 ::= { natv2PoolEntry 1 }
2397 natv2PoolIndex OBJECT-TYPE
2398 SYNTAX Natv2PoolIndex
2399 MAX-ACCESS not-accessible
2400 STATUS current
2401 DESCRIPTION
2402 "Index of an address pool, unique for a given NAT instance.
2403 It is up to the agent implementation to determine and
2404 operate upon only those values that correspond to
2405 provisioned pools."
2406 ::= { natv2PoolEntry 2 }
2408 -- configuration
2409 natv2PoolRealm OBJECT-TYPE
2410 SYNTAX SnmpAdminString (SIZE (0..32))
2411 MAX-ACCESS read-only
2412 STATUS current
2413 DESCRIPTION
2414 "Address realm to which this pool's addresses belong."
2415 REFERENCE
2416 "Address realms are discussed in Section 3.3.3 of
2417 RFC yyyy. Primary reference is RFC 2663 Section 2.1."
2418 ::= { natv2PoolEntry 3 }
2420 natv2PoolAddressType OBJECT-TYPE
2421 SYNTAX InetAddressType
2422 MAX-ACCESS read-create
2423 STATUS current
2424 DESCRIPTION
2425 "Address type supplied by this address pool. This will be the
2426 same for all pools in a given realm (by definition of an
2427 address realm). Values other than ipv4(1) or ipv6(2) would
2428 be unexpected."
2429 REFERENCE
2430 "InetAddressType in RFC 4001."
2431 ::= { natv2PoolEntry 4 }
2433 natv2PoolMinimumPort OBJECT-TYPE
2434 SYNTAX InetPortNumber
2435 MAX-ACCESS read-create
2436 STATUS current
2437 DESCRIPTION
2438 "Minimum port number of the range that can be allocated in
2439 this pool. Applies to all protocols supported by the NAT
2440 instance."
2441 REFERENCE
2442 "InetPortNumber in RFC 4001."
2444 ::= { natv2PoolEntry 5 }
2446 natv2PoolMaximumPort OBJECT-TYPE
2447 SYNTAX InetPortNumber
2448 MAX-ACCESS read-create
2449 STATUS current
2450 DESCRIPTION
2451 "Maximum port number of the range that can be allocated in
2452 this pool. Applies to all protocols supported by the NAT
2453 instance."
2454 REFERENCE
2455 "InetPortNumber in RFC 4001."
2456 ::= { natv2PoolEntry 6 }
2458 -- State
2459 natv2PoolAddressMapEntries OBJECT-TYPE
2460 SYNTAX Unsigned32
2461 MAX-ACCESS read-only
2462 STATUS current
2463 "The current number of address map entries using external
2464 addresses drawn from this pool, including static mappings.
2465 This definition includes 'hairpin' mappings, where the
2466 external realm is the same as the internal one. Address map
2467 entries are also tracked per subscriber and per instance."
2468 REFERENCE
2469 "RFC yyyy Section 3.3.8. Hairpinning: RFC 4787 section 6."
2470 ::= { natv2PoolEntry 7 }
2472 natv2PoolPortMapEntries OBJECT-TYPE
2473 SYNTAX Unsigned32
2474 MAX-ACCESS read-only
2475 STATUS current
2476 DESCRIPTION
2477 "The current number of entries in the port map table using
2478 external addresses and ports drawn from this pool, including
2479 static mappings. This definition includes 'hairpin'
2480 mappings, where the external realm is the same as the
2481 internal one. Port map entries are also tracked per
2482 subscriber, per instance, and per protocol within the
2483 instance."
2484 REFERENCE
2485 "RFC yyyy Section 3.3.9. Hairpinning: RFC 4787 Section 6."
2486 ::= { natv2PoolEntry 8 }
2488 -- Statistics and discontinuity time
2489 natv2PoolAddressMapCreations OBJECT-TYPE
2490 SYNTAX Counter64
2491 MAX-ACCESS read-only
2492 STATUS current
2493 DESCRIPTION
2494 "The cumulative number of address map entries created in this
2495 pool, including static mappings. Address map entries are
2496 also tracked per instance and per subscriber.
2498 This value MUST be monotone increasing in
2499 the periods between updates of the entity's
2500 natv2PoolDiscontinuityTime. If a manager detects a
2501 change in the latter since the last time it sampled this
2502 counter, it SHOULD NOT make use of the difference between
2503 the latest value of the counter and any value retrieved
2504 before the new value of natv2PoolDiscontinuityTime."
2505 ::= { natv2PoolEntry 9 }
2507 natv2PoolPortMapCreations OBJECT-TYPE
2508 SYNTAX Counter64
2509 MAX-ACCESS read-only
2510 STATUS current
2511 DESCRIPTION
2512 "The cumulative number of port map entries created in this
2513 pool, including static mappings. Port map entries are also
2514 tracked per instance, per protocol, and per subscriber.
2516 This value MUST be monotone increasing in the periods
2517 between updates of the entity's
2518 natv2PoolDiscontinuityTime. If a manager detects a
2519 change in the latter since the last time it sampled this
2520 counter, it SHOULD NOT make use of the difference between
2521 the latest value of the counter and any value retrieved
2522 before the new value of natv2PoolDiscontinuityTime."
2523 ::= { natv2PoolEntry 10 }
2525 natv2PoolAddressMapFailureDrops OBJECT-TYPE
2526 SYNTAX Counter64
2527 MAX-ACCESS read-only
2528 STATUS current
2529 DESCRIPTION
2530 "The cumulative number of packets originated by the
2531 subscriber that were dropped because the packet would have
2532 triggered the creation of a new address map entry, but no
2533 address could be allocated from this address pool because
2534 all addresses in the pool have already been fully allocated.
2535 Counters of this event are also provided per instance, per
2536 protocol and per subscriber.
2538 This value MUST be monotone increasing in the periods
2539 between updates of the entity's
2540 natv2PoolDiscontinuityTime. If a manager detects a
2541 change in the latter since the last time it sampled this
2542 counter, it SHOULD NOT make use of the difference between
2543 the latest value of the counter and any value retrieved
2544 before the new value of natv2PoolDiscontinuityTime."
2545 ::= { natv2PoolEntry 11 }
2547 natv2PoolPortMapFailureDrops OBJECT-TYPE
2548 SYNTAX Counter64
2549 MAX-ACCESS read-only
2550 STATUS current
2551 DESCRIPTION
2552 "The cumulative number of packets dropped because the packet
2553 would have triggered the creation of a new port map entry,
2554 but no port could be allocated for the protocol concerned.
2555 The usual case for this will be for a NAT instance that
2556 supports the 'paired' pooling behavior recommended by RFC
2557 4787, where the internal endpoint has used up all of the
2558 ports allocated to it for the address it was mapped to in
2559 this pool and cannot be given more ports because
2560 - policy or implementation prevents it from having a
2561 second address in the same pool, and
2562 - policy or unavailability prevents it from acquiring
2563 more ports at its originally assigned address.
2565 If the NAT instance pooling behavior is 'arbitrary' (meaning
2566 that the NAT instance can allocate a new port mapping for
2567 the given internal endpoint on any address in the selected
2568 address pool and is not bound to what it has already mapped
2569 for that endpoint), then this counter is incremented when
2570 all ports for the protocol concerned over the whole of this
2571 address pool are already in use.
2573 This value MUST be monotone increasing in the periods
2574 between updates of the entity's
2575 natv2PoolDiscontinuityTime. If a manager detects a
2576 change in the latter since the last time it sampled this
2577 counter, it SHOULD NOT make use of the difference between
2578 the latest value of the counter and any value retrieved
2579 before the new value of natv2PoolDiscontinuityTime."
2580 REFERENCE
2581 "Pooling behavior: RFC 4787, end of section 4.1."
2582 ::= { natv2PoolEntry 12 }
2584 natv2PoolDiscontinuityTime OBJECT-TYPE
2585 SYNTAX TimeStamp
2586 MAX-ACCESS read-only
2587 STATUS current
2588 DESCRIPTION
2589 "Snapshot of the value of the sysUpTime object at the
2590 beginning of the latest period of continuity of the
2591 statistical counters associated with this address
2592 pool. This MUST be initialized when the address pool
2593 is configured and MUST be updated whenever the port
2594 or address ranges allocated to the pool change."
2595 ::= { natv2PoolEntry 14 }
2597 -- Notification thresholds and objects returned by notifications
2598 natv2PoolThresholdUsageLow OBJECT-TYPE
2599 SYNTAX Integer32 (-1|0..100)
2600 UNITS "Percent"
2601 MAX-ACCESS read-write
2602 STATUS current
2603 DESCRIPTION
2604 "Threshold for reporting low utilization of the address pool.
2605 Utilization at a given instant is calculated as the
2606 percentage of ports allocated in port map entries for the
2607 most-used protocol at that instant. If utilization is less
2608 than or equal to natv2PoolThresholdUsageLow, an instance of
2609 natv2NotificationPoolUsageLow may be triggered, unless
2610 disabled by setting it to -1. Note the difference from the
2611 disabling setting for other notifications. Reporting is
2612 subject to the per-pool notification interval given by
2613 natv2PoolNotificationInterval. If multiple notifications are
2614 triggered during one interval, the agent MUST report only
2615 the one with the lowest value of
2616 natv2PoolNotifiedPortMapEntries and discard the others.
2618 Implementation note: the percentage specified by this object
2619 can be converted to a number of port map entries at
2620 configuration time (after port and address ranges have been
2621 configured or reconfigured) and compared to the current
2622 value of natv2PoolNotifiedPortMapEntries."
2623 REFERENCE
2624 "RFC yyyy Section 3.1.2 and Section 3.3.6."
2625 DEFVAL { -1 }
2626 ::= { natv2PoolEntry 15 }
2628 natv2PoolThresholdUsageHigh OBJECT-TYPE
2629 SYNTAX Unsigned32 (0..100)
2630 UNITS "Percent"
2631 MAX-ACCESS read-write
2632 STATUS current
2633 DESCRIPTION
2634 "Threshold for reporting high utilization of the address
2635 pool. Utilization at a given instant is calculated as the
2636 percentage of ports allocated in port map entries for the
2637 most-used protocol at that instant. If utilization is
2638 greater than or equal to natv2PoolThresholdUsageHigh, an
2639 instance of natv2NotificationPoolUsageHigh may be triggered,
2640 unless disabled by setting it to 0.
2642 Reporting is subject to the per-pool notification interval
2643 given by natv2PoolNotificationInterval. If multiple
2644 notifications are triggered during one interval, the agent
2645 MUST report only the one with the highest value of
2646 natv2PoolNotifiedPortMapEntries and discard the others. In
2647 the rare case where both upper and lower thresholds
2648 are crossed in the same interval, the agent MUST report only
2649 the upper threshold notification.
2651 Implementation note: the percentage specified by this object
2652 can be converted to a number of port map entries at
2653 configuration time (after port and address ranges have been
2654 configured or reconfigured) and compared to the current
2655 value of natv2PoolNotifiedPortMapEntries."
2656 DEFVAL { 0 }
2657 ::= { natv2PoolEntry 16 }
2659 natv2PoolNotifiedPortMapEntries OBJECT-TYPE
2660 SYNTAX Unsigned32
2661 MAX-ACCESS accessible-for-notify
2662 STATUS current
2663 DESCRIPTION
2664 "Number of port map entries using addresses and ports from
2665 this address pool for the most-used protocol at a given
2666 instant. One of the objects returned by
2667 natv2NotificationPoolUsageLow and
2668 natv2NotificationPoolUsageHigh."
2669 ::= { natv2PoolEntry 17 }
2671 natv2PoolNotifiedPortMapProtocol OBJECT-TYPE
2672 SYNTAX ProtocolNumber
2673 MAX-ACCESS accessible-for-notify
2674 STATUS current
2675 DESCRIPTION
2676 "The most-used protocol (i.e., with the largest number of
2677 port map entries) mapped into this address pool at a given
2678 instant. One of the objects returned by
2679 natv2NotificationPoolUsageLow and
2680 natv2NotificationPoolUsageHigh."
2681 ::= { natv2PoolEntry 18 }
2683 natv2PoolNotificationInterval OBJECT-TYPE
2684 SYNTAX Unsigned32 (1..3600)
2685 UNITS
2686 "Seconds"
2687 MAX-ACCESS read-write
2688 STATUS current
2689 DESCRIPTION
2690 "Minimum number of seconds (default 20) between successive
2691 notifications for this address pool. Controls the generation
2692 of natv2NotificationPoolUsageLow and
2693 natv2NotificationPoolUsageHigh."
2694 DEFVAL
2695 { 20 }
2696 ::= { natv2PoolEntry 19 }
2698 natv2PoolRangeTable OBJECT-TYPE
2699 SYNTAX SEQUENCE OF Natv2PoolRangeEntry
2700 MAX-ACCESS not-accessible
2701 STATUS current
2702 DESCRIPTION
2703 "This table contains address ranges used by pool entries.
2704 It is an expansion of natv2PoolTable."
2705 REFERENCE
2706 "RFC yyyy ."
2707 ::= { natv2MIBInstanceObjects 4 }
2709 natv2PoolRangeEntry OBJECT-TYPE
2710 SYNTAX Natv2PoolRangeEntry
2711 MAX-ACCESS not-accessible
2712 STATUS current
2713 DESCRIPTION
2714 "NAT pool address range."
2715 INDEX {
2716 natv2PoolRangeInstanceIndex,
2717 natv2PoolRangePoolIndex,
2718 natv2PoolRangeRowIndex
2719 }
2720 ::= { natv2PoolRangeTable 1 }
2722 Natv2PoolRangeEntry ::=
2723 SEQUENCE {
2724 natv2PoolRangeInstanceIndex Natv2InstanceIndex,
2725 natv2PoolRangePoolIndex Natv2PoolIndex,
2726 natv2PoolRangeRowIndex Unsigned32,
2727 natv2PoolRangeBegin InetAddress,
2728 natv2PoolRangeEnd InetAddress
2729 }
2731 natv2PoolRangeInstanceIndex OBJECT-TYPE
2732 SYNTAX Natv2InstanceIndex
2733 MAX-ACCESS not-accessible
2734 STATUS current
2735 DESCRIPTION
2736 "Index of the NAT instance on which the address pool and this
2737 address range are configured. See Natv2InstanceIndex."
2738 ::= { natv2PoolRangeEntry 1 }
2740 natv2PoolRangePoolIndex OBJECT-TYPE
2741 SYNTAX Natv2PoolIndex
2742 MAX-ACCESS not-accessible
2743 STATUS current
2744 DESCRIPTION
2745 "Index of the address pool to which this address range
2746 belongs. See Natv2PoolIndex."
2747 ::= { natv2PoolRangeEntry 2 }
2749 natv2PoolRangeRowIndex OBJECT-TYPE
2750 SYNTAX Unsigned32
2751 MAX-ACCESS not-accessible
2752 STATUS current
2753 DESCRIPTION
2754 "Row index for successive range entries for the same
2755 address pool."
2756 ::= { natv2PoolRangeEntry 3 }
2758 natv2PoolRangeBegin OBJECT-TYPE
2759 SYNTAX InetAddress
2760 MAX-ACCESS read-only
2761 STATUS current
2762 DESCRIPTION
2763 "Lowest address included in this range. The type of address
2764 (IPv4 or IPv6) is given by natv2PoolAddressType
2765 in natv2PoolTable."
2766 ::= { natv2PoolRangeEntry 4 }
2768 natv2PoolRangeEnd OBJECT-TYPE
2769 SYNTAX InetAddress
2770 MAX-ACCESS read-only
2771 STATUS current
2772 DESCRIPTION
2773 "Highest address included in this range. The type of address
2774 (IPv4 or IPv6) is given by natv2PoolAddressType
2775 in natv2PoolTable."
2776 ::= { natv2PoolRangeEntry 5 }
2778 -- indexed mapping tables
2780 -- Address Map Table. Mapped from internal to external address.
2782 natv2AddressMapTable OBJECT-TYPE
2783 SYNTAX SEQUENCE OF Natv2AddressMapEntry
2784 MAX-ACCESS not-accessible
2785 STATUS current
2786 DESCRIPTION
2787 "Table of mappings from internal to external address. By
2788 definition, this is a snapshot of NAT instance state at a
2789 given moment. Indexed by NAT instance, internal realm, and
2790 internal address in that realm. Provides the mapped external
2791 address and, depending on implementation support, identifies
2792 the address pool from which the external address and port
2793 were taken and the index of the subscriber to which the
2794 mapping has been allocated.
2796 In the case of DS-Lite [RFC 6333], the indexing realm and
2797 address are those of the IPv6 encapsulation rather than the
2798 IPv4 inner packet."
2799 REFERENCE
2800 "RFC yyyy Section 3.3.8. DS-Lite: RFC 6333"
2801 ::= { natv2MIBInstanceObjects 5 }
2803 natv2AddressMapEntry OBJECT-TYPE
2804 SYNTAX Natv2AddressMapEntry
2805 MAX-ACCESS not-accessible
2806 STATUS current
2807 DESCRIPTION
2808 "Mapping from internal to external address."
2809 INDEX { natv2AddressMapInstanceIndex,
2810 natv2AddressMapInternalRealm,
2811 natv2AddressMapInternalAddressType,
2812 natv2AddressMapInternalAddress,
2813 natv2AddressMapRowIndex }
2814 ::= { natv2AddressMapTable 1 }
2816 Natv2AddressMapEntry ::=
2817 SEQUENCE {
2818 natv2AddressMapInstanceIndex Natv2InstanceIndex,
2819 natv2AddressMapInternalRealm SnmpAdminString,
2820 natv2AddressMapInternalRealmAddressType InetAddressType,
2821 natv2AddressMapInternalRealmAddress InetAddress,
2822 natv2AddressMapRowIndex Unsigned32,
2823 natv2AddressMapInternalMappedAddressType InetAddressType,
2824 natv2AddressMapInternalMappedAddress InetAddress,
2825 natv2AddressMapExternalRealm SnmpAdminString,
2826 natv2AddressMapExternalAddressType InetAddressType,
2827 natv2AddressMapExternalAddress InetAddress,
2828 natv2AddressMapExternalPoolIndex Natv2PoolIndexOrZero,
2829 natv2AddressMapSubscriberIndex Natv2SubscriberIndexOrZero
2830 }
2832 natv2AddressMapInstanceIndex OBJECT-TYPE
2833 SYNTAX Natv2InstanceIndex
2834 MAX-ACCESS not-accessible
2835 STATUS current
2836 DESCRIPTION
2837 "Index of the NAT instance that generated this address map."
2838 ::= { natv2AddressMapEntry 1 }
2840 natv2AddressMapInternalRealm OBJECT-TYPE
2841 SYNTAX SnmpAdminString (SIZE(0..32))
2842 MAX-ACCESS not-accessible
2843 STATUS current
2844 DESCRIPTION
2845 "Realm to which the internal address belongs. In most cases
2846 this is the realm defining the address space of the packet
2847 being translated. However, in the case of DS-Lite [RFC
2848 6333], this realm defines the IPv6 outer header address
2849 space. It is the combination of that outer header and
2850 the inner IPv4 packet header that is remapped to the
2851 external address and realm. The corresponding IPv4 realm is
2852 restricted in scope to the tunnel, so there is no point in
2853 identifying it. The mapped IPv4 address will normally be the
2854 well-known value 192.0.0.2, or at least lie in the reserved
2855 192.0.0.0/29 range.
2857 If natv2AddressMapSubscriberIndex in this table is a valid
2858 subscriber index (i.e., greater than zero), then the value
2859 of natv2AddressMapInternalRealm MUST be identical to the
2860 value of natv2SubscriberRealm associated with that index."
2861 REFERENCE
2862 "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and
2863 Section 6.6 on the need to have the IPv6 tunnel address in
2864 the NAT mapping tables."
2865 ::= { natv2AddressMapEntry 2 }
2867 natv2AddressMapInternalRealmAddressType OBJECT-TYPE
2868 SYNTAX InetAddressType
2869 MAX-ACCESS read-only
2870 STATUS current
2871 DESCRIPTION
2872 "Address type in the header of packets on the
2873 interior side of this mapping. Any value other than ipv4(1)
2874 or ipv6(2) would be unexpected.
2876 In the DS-Lite case, the address type is ipv6(2)."
2877 REFERENCE
2878 "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and
2879 Section 6.6 on the need to have the IPv6 tunnel source
2880 address in the NAT mapping tables."
2881 ::= { natv2AddressMapEntry 3 }
2883 natv2AddressMapInternalRealmAddress OBJECT-TYPE
2884 SYNTAX InetAddress
2885 MAX-ACCESS read-only
2886 STATUS current
2887 DESCRIPTION
2888 "Source address of packets originating from the interior
2889 of the association provided by this mapping.
2891 In the case of DS-Lite [RFC 6333], this is the IPv6 tunnel
2892 source address. The mapping in this case is considered to
2893 be from the combination of the IPv6 tunnel source address
2894 natv2AddressMapInternalRealmAddress and the well-known IPv4
2895 inner source address natv2AddressMapInternalMappedAddress to
2896 the external address."
2897 REFERENCE
2898 "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and
2899 Section 6.6 on the need to have the IPv6 tunnel address in
2900 the NAT mapping tables."
2901 ::= { natv2AddressMapEntry 4 }
2903 natv2AddressMapRowIndex OBJECT-TYPE
2904 SYNTAX Unsigned32
2905 MAX-ACCESS not-accessible
2906 STATUS current
2907 DESCRIPTION
2908 "Index of a conceptual row corresponding to a mapping of the
2909 given internal realm and address to a single external realm
2910 and address. Multiple rows will be present because of a
2911 promiscuous external address selection policy, policies
2912 associating the same internal address with different address
2913 pools, or because the same internal realm-address
2914 combination is communicating with multiple external address
2915 realms."
2916 ::= { natv2AddressMapEntry 5 }
2918 natv2AddressMapInternalMappedAddressType OBJECT-TYPE
2919 SYNTAX InetAddressType
2920 MAX-ACCESS read-only
2921 STATUS current
2922 DESCRIPTION
2923 "Internal address type actually translated by this mapping.
2924 Any value other than ipv4(1) or ipv6(2) would be unexpected.
2925 In the general case, this is the same as given by
2926 natv2AddressMapInternalRealmAddressType. In the
2927 tunneled case it is the address type used in the
2928 encapsulated packet header. In particular, in the DS-Lite
2929 case, the mapped address type is ipv4(1)."
2930 REFERENCE
2931 "DS-Lite: RFC 6333."
2932 ::= { natv2AddressMapEntry 6 }
2934 natv2AddressMapInternalMappedAddress OBJECT-TYPE
2935 SYNTAX InetAddress
2936 MAX-ACCESS read-only
2937 STATUS current
2938 DESCRIPTION
2939 "Internal address actually translated by this mapping. In the
2940 general case, this is the same as
2941 natv2AddressMapInternalRealmAddress. In the case of DS-Lite
2942 [RFC 6333], this is the source address of the encapsulated
2943 IPv4 packet, normally lying the well-known range
2944 192.0.0.0/29. The mapping in this case is considered to be
2945 from the combination of the IPv6 tunnel source address
2946 natv2AddressMapInternalRealmAddress and the well-known IPv4
2947 inner source address natv2AddressMapInternalMappedAddress to
2948 the external address."
2949 REFERENCE
2950 "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and
2951 Section 6.6 on the need to have the IPv6 tunnel address in
2952 the NAT mapping tables."
2953 ::= { natv2AddressMapEntry 7 }
2955 natv2AddressMapExternalRealm OBJECT-TYPE
2956 SYNTAX SnmpAdminString (SIZE(0..32))
2957 MAX-ACCESS read-only
2958 STATUS current
2959 DESCRIPTION
2960 "External address realm to which this mapping maps the
2961 internal address. This can be the same as the internal realm
2962 in the case of a 'hairpin' connection, but otherwise will be
2963 different."
2964 ::= { natv2AddressMapEntry 8 }
2966 natv2AddressMapExternalAddressType OBJECT-TYPE
2967 SYNTAX InetAddressType
2968 MAX-ACCESS read-only
2969 STATUS current
2970 DESCRIPTION
2971 "Address type for the external realm. Any value other than
2972 ipv4(1) or ipv6(2) would be unexpected."
2973 ::= { natv2AddressMapEntry 9 }
2975 natv2AddressMapExternalAddress OBJECT-TYPE
2976 SYNTAX InetAddress
2977 MAX-ACCESS read-only
2978 STATUS current
2979 DESCRIPTION
2980 "External address to which the internal address is mapped.
2982 In the DS-Lite case, the mapping is from the combination of
2983 the internal IPv6 tunnel source address as presented in this
2984 table and the well-known IPv4 source address of the
2985 encapsulated IPv4 packet."
2986 REFERENCE
2987 "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and
2988 Section 6.6 on the need to have the IPv6 tunnel address in
2989 the NAT mapping tables."
2990 ::= { natv2AddressMapEntry 10 }
2992 natv2AddressMapExternalPoolIndex OBJECT-TYPE
2993 SYNTAX Natv2PoolIndexOrZero
2994 MAX-ACCESS read-only
2995 STATUS current
2996 DESCRIPTION
2997 "Index of the address pool in the external realm from which
2998 the mapped external address given in
2999 natv2AddressMapExternalAddress was taken. Zero if the
3000 implementation does not support address pools but has chosen
3001 to support this object, or if no pool was configured for the
3002 given external realm."
3003 ::= { natv2AddressMapEntry 11 }
3005 natv2AddressMapSubscriberIndex OBJECT-TYPE
3006 SYNTAX Natv2SubscriberIndexOrZero
3007 MAX-ACCESS read-only
3008 STATUS current
3009 DESCRIPTION
3010 "Index of the subscriber to which this address mapping
3011 applies, or zero if no subscribers are configured on
3012 this NAT instance."
3013 ::= { natv2AddressMapEntry 12 }
3015 -- natv2PortMapTable
3016 natv2PortMapTable OBJECT-TYPE
3017 SYNTAX SEQUENCE OF Natv2PortMapEntry
3018 MAX-ACCESS not-accessible
3019 STATUS current
3020 DESCRIPTION
3021 "Table of port map entries indexed by NAT instance, protocol,
3022 and external realm and address. A port map entry associates
3023 an internal upper layer protocol endpoint with an endpoint
3024 for the same protocol in the given external realm. By
3025 definition, this is a snapshot of NAT instance state at a
3026 given moment. The table provides the basic mapping
3027 information.
3029 In the case of DS-Lite [RFC 6333], the table provides the
3030 internal IPv6 tunnel source address in
3031 natv2PortMapInternalRealmAddress and the IPv4 source address
3032 of the encapsulated packet that is actually translated in
3033 natv2PortMapInternalMappedAddress. In the general (non-DS-
3034 Lite) case, those two objects will have the same value."
3035 REFERENCE
3036 "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and
3037 Section 6.6 on the need to have the IPv6 tunnel address in
3038 the NAT mapping tables."
3039 REFERENCE
3040 "RFC yyyy Section 3.3.9
3041 ::= { natv2MIBInstanceObjects 6 }
3043 natv2PortMapEntry OBJECT-TYPE
3044 SYNTAX Natv2PortMapEntry
3045 MAX-ACCESS not-accessible
3046 STATUS current
3047 DESCRIPTION
3048 "A single NAT mapping."
3049 INDEX { natv2PortMapInstanceIndex,
3050 natv2PortMapProtocol,
3051 natv2PortMapExternalRealm,
3052 natv2PortMapExternalAddressType,
3053 natv2PortMapExternalAddress,
3054 natv2PortMapExternalPort }
3055 ::= { natv2PortMapTable 1 }
3057 Natv2PortMapEntry ::=
3058 SEQUENCE {
3059 natv2PortMapInstanceIndex Natv2InstanceIndex,
3060 natv2PortMapProtocol ProtocolNumber,
3061 natv2PortMapExternalRealm SnmpAdminString,
3062 natv2PortMapExternalAddressType InetAddressType,
3063 natv2PortMapExternalAddress InetAddress,
3064 natv2PortMapExternalPort InetPortNumber,
3065 natv2PortMapInternalRealm SnmpAdminString,
3066 natv2PortMapInternalRealmAddressType InetAddressType,
3067 natv2PortMapInternalRealmAddress InetAddress,
3068 natv2PortMapInternalMappedAddressType InetAddressType,
3069 natv2PortMapInternalMappedAddress InetAddress,
3070 natv2PortMapInternalPort InetPortNumber,
3071 natv2PortMapExternalPool Natv2PoolIndexOrZero,
3072 natv2PortMapSubscriberIndex Natv2SubscriberIndexOrZero
3073 }
3075 natv2PortMapInstanceIndex OBJECT-TYPE
3076 SYNTAX Natv2InstanceIndex
3077 MAX-ACCESS not-accessible
3078 STATUS current
3079 DESCRIPTION
3080 "Index of the NAT instance that created this port map entry."
3081 ::= { natv2PortMapEntry 1 }
3083 natv2PortMapProtocol OBJECT-TYPE
3084 SYNTAX ProtocolNumber
3085 MAX-ACCESS not-accessible
3086 STATUS current
3087 DESCRIPTION
3088 "The map entry's upper layer protocol number."
3089 ::= { natv2PortMapEntry 2 }
3091 natv2PortMapExternalRealm OBJECT-TYPE
3092 SYNTAX SnmpAdminString (SIZE(0..32))
3093 MAX-ACCESS not-accessible
3094 STATUS current
3095 DESCRIPTION
3096 "The realm to which natv2PortMapExternalAddress belongs."
3097 ::= { natv2PortMapEntry 3 }
3099 natv2PortMapExternalAddressType OBJECT-TYPE
3100 SYNTAX InetAddressType
3101 MAX-ACCESS not-accessible
3102 STATUS current
3103 DESCRIPTION
3104 "Address type for the external realm. A value other
3105 than ipv4(1) or ipv6(2) would be unexpected."
3106 ::= { natv2PortMapEntry 4 }
3108 natv2PortMapExternalAddress OBJECT-TYPE
3109 SYNTAX InetAddress
3110 MAX-ACCESS not-accessible
3111 STATUS current
3112 DESCRIPTION
3113 "The mapping's assigned external address. (This address is
3114 taken from the address pool identified by
3115 natv2PortMapExternalPoolIndex, if the implementation
3116 supports address pools and pools are configured for the
3117 given external realm.) This is the source address for
3118 translated outgoing packets."
3120 ::= { natv2PortMapEntry 5 }
3122 natv2PortMapExternalPort OBJECT-TYPE
3123 SYNTAX InetPortNumber
3124 MAX-ACCESS not-accessible
3125 STATUS current
3126 DESCRIPTION
3127 "The mapping's assigned external port number. This is the
3128 source port for translated outgoing packets. If the internal
3129 port number given by natv2PortMapInternalPort is zero this
3130 value MUST also be zero. Otherwise this MUST be a non-zero
3131 value."
3132 ::= { natv2PortMapEntry 6 }
3134 natv2PortMapInternalRealm OBJECT-TYPE
3135 SYNTAX SnmpAdminString (SIZE(0..32))
3136 MAX-ACCESS read-only
3137 STATUS current
3138 DESCRIPTION
3139 "The realm to which natv2PortMapInternalRealmAddress belongs.
3140 In the general case, this realm contains the address that is
3141 being translated. In the DS-Lite [RFC 6333] case, this realm
3142 defines the IPv6 address space from which the tunnel source
3143 address is taken. The realm of the encapsulated IPv4 address
3144 is restricted in scope to the tunnel, so there is no point
3145 in identifying it separately."
3146 REFERENCE
3147 "RFC 6333 DS-Lite."
3148 ::= { natv2PortMapEntry 7 }
3150 natv2PortMapInternalRealmAddressType OBJECT-TYPE
3151 SYNTAX InetAddressType
3152 MAX-ACCESS read-only
3153 STATUS current
3154 DESCRIPTION
3155 "Address type for addresses in the realm identified by
3156 natv2PortMapInternalRealm."
3157 ::= { natv2PortMapEntry 8 }
3159 natv2PortMapInternalRealmAddress OBJECT-TYPE
3160 SYNTAX InetAddress
3161 MAX-ACCESS read-only
3162 STATUS current
3163 DESCRIPTION
3164 "Source address for packets received under this mapping on
3165 the internal side of the NAT instance. In the general case
3166 this address is the same as the address given in
3167 natv2PortMapInternalMappedAddress. In the DS-Lite case,
3168 natv2PortMapInternalRealmAddress is the IPv6 tunnel source
3169 address."
3170 REFERENCE
3171 "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and
3172 Section 6.6 on the need to have the IPv6 tunnel address in
3173 the NAT mapping tables."
3174 ::= { natv2PortMapEntry 9 }
3176 natv2PortMapInternalMappedAddressType OBJECT-TYPE
3177 SYNTAX InetAddressType
3178 MAX-ACCESS read-only
3179 STATUS current
3180 DESCRIPTION
3181 "Internal address type actually translated by this mapping.
3182 Any value other than ipv4(1) or ipv6(2) would be unexpected.
3183 In the general case, this is the same as given by
3184 natv2AddressMapInternalRealmAddressType. In the DS-Lite
3185 case, the address type is ipv4(1)."
3186 REFERENCE
3187 "DS-Lite: RFC 6333."
3188 ::= { natv2PortMapEntry 10 }
3190 natv2PortMapInternalMappedAddress OBJECT-TYPE
3191 SYNTAX InetAddress
3192 MAX-ACCESS read-only
3193 STATUS current
3194 DESCRIPTION
3195 "Internal address actually translated by this mapping. In the
3196 general case, this is the same as
3197 natv2PortMapInternalRealmAddress. In the case of DS-Lite
3198 [RFC 6333], this is the source address of the encapsulated
3199 IPv4 packet, normally selected from the well-known range
3200 192.0.0.0/29. The mapping in this case is considered to be
3201 from the external address to the combination of the IPv6
3202 tunnel source address natv2PortMapInternalRealmAddress and
3203 the well-known IPv4 inner source address
3204 natv2PortMapInternalMappedAddress."
3205 REFERENCE
3206 "DS-Lite: RFC 6333, Section 5.7 for well-known addresses and
3207 Section 6.6 on the need to have the IPv6 tunnel address in
3208 the NAT mapping tables."
3209 ::= { natv2PortMapEntry 11 }
3211 natv2PortMapInternalPort OBJECT-TYPE
3212 SYNTAX InetPortNumber
3213 MAX-ACCESS read-only
3214 STATUS current
3215 DESCRIPTION
3216 "The mapping's internal port number. If this is zero, ports
3217 are not translated (i.e., the NAT instance is a pure NAT
3218 rather than a NAPT)."
3219 ::= { natv2PortMapEntry 12 }
3221 natv2PortMapExternalPoolIndex OBJECT-TYPE
3222 SYNTAX Natv2PoolIndexOrZero
3223 MAX-ACCESS read-only
3224 STATUS current
3225 DESCRIPTION
3226 "Identifies the address pool from which the external address
3227 in this port map entry was taken. Zero if the implementation
3228 does not support address pools but has chosen to support
3229 this object, or if no pools are configured for the given
3230 external realm."
3232 natv2PortMapSubscriberIndex OBJECT-TYPE
3233 SYNTAX Natv2SubscriberIndexOrZero
3234 MAX-ACCESS read-only
3235 STATUS current
3236 DESCRIPTION
3237 "Subscriber using this map entry. Zero if the implementation
3238 does not support subscribers but has chosen to support
3239 this object."
3240 ::= { natv2PortMapEntry 13 }
3242 -- Conformance section. Specifies three cumulatively more extensive
3243 -- applications: basic NAT, pooled NAT, and carrier grade NAT
3245 natv2MIBConformance OBJECT IDENTIFIER ::= { natv2MIB 3 }
3247 natv2MIBCompliances OBJECT IDENTIFIER ::= { natv2MIBConformance 1 }
3248 natv2MIBGroups OBJECT IDENTIFIER ::= { natv2MIBConformance 2 }
3250 natv2MIBBasicCompliance MODULE-COMPLIANCE
3251 STATUS current
3252 DESCRIPTION
3253 "Describes the requirements for conformance to the basic NAT
3254 application of NATv2 MIB."
3255 MODULE -- this module
3256 MANDATORY-GROUPS { natv2BasicNotificationGroup,
3257 natv2BasicInstanceLevelGroup
3258 }
3259 GROUP natv2BasicNotificationGroup
3260 DESCRIPTION
3261 "The natv2BasicNotificationGroup is mandatory for all
3262 NAT applications."
3263 GROUP natv2BasicInstanceLevelGroup
3264 DESCRIPTION
3265 "The natv2BasicInstanceLevelGroup is mandatory for all
3266 NAT applications."
3267 ::= { natv2MIBCompliances 1 }
3269 natv2MIBPooledNATCompliance MODULE-COMPLIANCE
3270 STATUS current
3271 DESCRIPTION
3272 "Describes the requirements for conformance to the pooled NAT
3273 application of NATv2-MIB."
3274 MODULE -- this module
3275 MANDATORY-GROUPS { natv2BasicNotificationGroup,
3276 natv2BasicInstanceLevelGroup,
3277 natv2PooledNotificationGroup,
3278 natv2PooledInstanceLevelGroup
3279 }
3280 GROUP natv2BasicNotificationGroup
3281 DESCRIPTION
3282 "The natv2BasicNotificationGroup is mandatory for all
3283 NAT applications."
3284 GROUP natv2BasicInstanceLevelGroup
3285 DESCRIPTION
3286 "The natv2BasicInstanceLevelGroup is mandatory for all
3287 NAT applications."
3288 GROUP natv2PooledNotificationGroup
3289 DESCRIPTION
3290 "The natv2PooledNotificationGroup is mandatory for
3291 the pooled and CGN applications."
3292 GROUP natv2PooledInstanceLevelGroup
3293 DESCRIPTION
3294 "The natv2PooledInstanceLevelGroup is mandatory for
3295 the pooled and CGN applications."
3296 ::= { natv2MIBCompliances 2 }
3298 natv2MIBCGNCompliance MODULE-COMPLIANCE
3299 STATUS current
3300 DESCRIPTION
3301 "Describes the requirements for conformance to the
3302 carrier grade NAT application of NATv2-MIB."
3303 MODULE -- this module
3304 MANDATORY-GROUPS { natv2BasicNotificationGroup,
3305 natv2BasicInstanceLevelGroup,
3306 natv2PooledNotificationGroup,
3307 natv2PooledInstanceLevelGroup,
3308 natv2CGNNotificationGroup,
3309 natv2CGNDeviceLevelGroup,
3310 natv2CGNInstanceLevelGroup
3311 }
3312 GROUP natv2BasicNotificationGroup
3313 DESCRIPTION
3314 "The natv2BasicNotificationGroup is mandatory for all
3315 NAT applications."
3316 GROUP natv2BasicInstanceLevelGroup
3317 DESCRIPTION
3318 "The natv2BasicInstanceLevelGroup is mandatory for all
3319 NAT applications."
3320 GROUP natv2PooledNotificationGroup
3321 DESCRIPTION
3322 "The natv2PooledNotificationGroup is mandatory for
3323 the pooled and CGN applications."
3324 GROUP natv2PooledInstanceLevelGroup
3325 DESCRIPTION
3326 "The natv2PooledInstanceLevelGroup is mandatory for
3327 the pooled and CGN applications."
3328 GROUP natv2CGNNotificationGroup
3329 DESCRIPTION
3330 "The natv2CGNNotificationGroup is mandatory
3331 for the carrier grade NAT application."
3332 GROUP natv2CGNDeviceLevelGroup
3333 DESCRIPTION
3334 "The natv2CGNDeviceLevelGroup is mandatory
3335 for the carrier grade NAT application."
3336 GROUP natv2CGNInstanceLevelGroup
3337 DESCRIPTION
3338 "The natv2CGNInstanceLevelGroup is mandatory
3339 for the carrier grade NAT application."
3340 ::= { natv2MIBCompliances 3 }
3342 -- Groups
3344 natv2BasicNotificationGroup NOTIFICATION-GROUP
3345 NOTIFICATIONS {
3346 natv2NotificationInstanceAddressMapEntriesHigh,
3347 natv2NotificationInstancePortMapEntriesHigh
3348 }
3349 STATUS current
3350 DESCRIPTION
3351 "Notifications that MUST be supported by all NAT
3352 applications."
3353 ::= { natv2MIBGroups 1 }
3355 natv2BasicInstanceLevelGroup OBJECT-GROUP
3356 OBJECTS {
3357 -- from natv2InstanceTable
3358 natv2InstanceIndex,
3359 natv2InstanceAlias,
3360 natv2InstancePortMappingBehavior,
3361 natv2InstanceFilteringBehavior,
3362 natv2InstanceFragmentBehavior,
3363 natv2InstanceAddressMapEntries,
3364 natv2InstancePortMapEntries,
3365 natv2InstanceTranslations,
3366 natv2InstanceAddressMapCreations,
3367 natv2InstanceAddressMapEntryLimitDrops,
3368 natv2InstanceAddressMapFailureDrops,
3369 natv2InstancePortMapCreations,
3370 natv2InstancePortMapEntryLimitDrops,
3371 natv2InstancePortMapFailureDrops,
3372 natv2InstanceFragmentDrops,
3373 natv2InstanceOtherResourceFailureDrops,
3374 natv2InstanceDiscontinuityTime,
3375 natv2InstanceThresholdAddressMapEntriesHigh,
3376 natv2InstanceThresholdPortMapEntriesHigh,
3377 natv2InstanceNotificationInterval,
3378 natv2InstanceLimitAddressMapEntries,
3379 natv2InstanceLimitPortMapEntries,
3380 natv2InstanceLimitPendingFragments,
3381 -- from natv2ProtocolTable
3382 natv2ProtocolInstanceIndex,
3383 natv2ProtocolNumber,
3384 natv2ProtocolPortMapEntries,
3385 natv2ProtocolTranslations,
3386 natv2ProtocolPortMapCreations,
3387 natv2ProtocolPortMapFailureDrops,
3388 natv2ProtocolOtherResourceFailureDrops,
3389 -- from natv2AddressMapTable
3390 natv2AddressMapInstanceIndex,
3391 natv2AddressMapInternalRealm,
3392 natv2AddressMapInternalRealmAddressType,
3393 natv2AddressMapInternalRealmAddress,
3394 natv2AddressMapRowIndex,
3395 natv2AddressMapExternalRealm,
3396 natv2AddressMapExternalAddressType,
3397 natv2AddressMapExternalAddress,
3398 -- from natv2PortMapTable
3399 natv2PortMapInstanceIndex,
3400 natv2PortMapProtocol,
3401 natv2PortMapExternalRealm,
3402 natv2PortMapExternalAddressType,
3403 natv2PortMapExternalAddress,
3404 natv2PortMapExternalPort,
3405 natv2PortMapInternalRealm,
3406 natv2PortMapInternalRealmAddressType,
3407 natv2PortMapInternalRealmAddress,
3408 natv2PortMapInternalPort
3409 }
3410 STATUS current
3411 DESCRIPTION
3412 "Per-instance objects that MUST be supported by
3413 implementations of all NAT applications."
3414 ::= { natv2MIBGroups 2 }
3416 natv2PooledNotificationGroup NOTIFICATION-GROUP
3417 NOTIFICATIONS {
3418 natv2NotificationPoolUsageLow,
3419 natv2NotificationPoolUsageHigh
3420 }
3421 STATUS current
3422 DESCRIPTION
3423 "Notifications that MUST be supported by pooled and
3424 carrier-grade NAT applications."
3425 ::= { natv2MIBGroups 3 }
3427 natv2PooledInstanceLevelGroup OBJECT-GROUP
3428 OBJECTS {
3429 -- from natv2InstanceTable
3430 natv2InstancePoolingBehavior,
3431 -- from natv2PoolTable
3432 natv2PoolInstanceIndex,
3433 natv2PoolIndex,
3434 natv2PoolRealm,
3435 natv2PoolAddressType,
3436 natv2PoolMinimumPort,
3437 natv2PoolMaximumPort,
3438 natv2PoolAddressMapEntries
3439 natv2PoolPortMapEntries
3440 natv2PoolAddressMapCreations,
3441 natv2PoolPortMapCreations
3442 natv2PoolAddressMapFailureDrops,
3443 natv2PoolPortMapFailureDrops
3444 natv2PoolOtherResourceFailureDrops
3445 natv2PoolDiscontinuityTime,
3446 natv2PoolThresholdUsageLow,
3447 natv2PoolThresholdUsageHigh,
3448 natv2PoolNotifiedPortMapEntries,
3449 natv2PoolNotifiedPortMapProtocol,
3450 natv2PoolNotificationInterval,
3451 -- from natv2PoolRangeTable
3452 natv2PoolRangeInstanceIndex,
3453 natv2PoolRangePoolIndex,
3454 natv2PoolRangeRowIndex,
3455 natv2PoolRangeBegin,
3456 natv2PoolRangeEnd,
3457 -- from natv2AddressMapTable
3458 natv2AddressMapExternalPoolIndex,
3459 -- from natv2PortMapTable
3460 natv2PortMapExternalPoolIndex
3461 }
3462 STATUS current
3463 DESCRIPTION
3464 "Per-instance objects that MUST be supported by
3465 implementations of the pooled and carrier grade
3466 NAT applications."
3467 ::= { natv2MIBGroups 4 }
3469 natv2CGNNotificationGroup NOTIFICATION-GROUP
3470 NOTIFICATIONS {
3471 natv2NotificationSubscriberPortMappingEntriesHigh
3472 }
3473 STATUS current
3474 DESCRIPTION
3475 "Notification that MUST be supported by implementations
3476 of the carrier grade NAT application."
3477 ::= { natv2MIBGroups 5 }
3479 natv2CGNDeviceLevelGroup OBJECT-GROUP
3480 OBJECTS {
3481 -- from table natv2SubscriberTable
3482 natv2SubscriberIndex,
3483 natv2SubscriberRealm,
3484 natv2SubscriberInternalPrefixType,
3485 natv2SubscriberInternalPrefix,
3486 natv2SubscriberInternalPrefixLength,
3487 natv2SubscriberAddressMapEntries,
3488 natv2SubscriberPortMapEntries,
3489 natv2SubscriberTranslations,
3490 natv2SubscriberAddressMapCreations,
3491 natv2SubscriberPortMapCreations,
3492 natv2SubscriberAddressMapFailureDrops,
3493 natv2SubscriberPortMapFailureDrops,
3494 natv2SubscriberOtherResourceFailureDrops,
3495 natv2SubscriberDiscontinuityTime,
3496 natv2SubscriberLimitPortMapEntries,
3497 natv2SubscriberThresholdPortMapEntriesHigh,
3498 natv2SubscriberNotificationInterval
3499 }
3500 STATUS current
3501 DESCRIPTION
3502 "Device-level objects that MUST be supported by the
3503 carrier-grade NAT application."
3504 ::= { natv2MIBGroups 6 }
3506 natv2CGNInstanceLevelGroup OBJECT-GROUP
3507 OBJECTS {
3508 -- from natv2InstanceTable
3509 natv2InstanceSubscriberActiveLimitDrops,
3510 natv2InstanceLimitSubscriberActives,
3511 -- from natv2AddressMapTable
3512 natv2AddressMapSubscriberIndex,
3513 -- from natv2PortMapTable
3514 natv2PortMapSubscriberIndex
3515 }
3516 STATUS current
3517 DESCRIPTION
3518 "Per-instance objects that MUST be supported by the
3519 carrier grade NAT application."
3520 ::= { natv2MIBGroups 7 }
3522 END
3524 5. Operational and Management Considerations
3526 This section covers two particular areas of operations and
3527 management: configuration requirements, and transition from or
3528 coexistence with the [RFC4008] MIB module.
3530 5.1. Configuration Requirements
3532 This MIB module assumes that the following information is configured
3533 on the NAT device by means outside the scope of the present document
3534 or is imposed by the implementation:
3536 o the set of address realms to which the device connects;
3538 o For the CGN application, per-subscriber information including
3539 subscriber index, address realm, assigned prefix or address, and
3540 (possibly) policies regarding address pool selection in the
3541 various possible address realms to which the subscriber may
3542 connect. In the particular case of DS-Lite [RFC6333] access, as
3543 well as the assigned outer layer (IPv6) prefix or address, the
3544 subscriber information will include an inner (IPv4) source
3545 address, usually 192.0.0.2.
3547 o the set of NAT instances running on the device, identified by NAT
3548 instance index and name;
3550 o the port mapping, filtering, pooling, and fragment behavior for
3551 each NAT instance;
3553 o the set of protocols supported by each NAT instance;
3555 o for the pooled NAT and CGN applications, address pool information
3556 for each NAT instance, including for each pool the pool index,
3557 address realm, address type, minimum and maximum port number, the
3558 address ranges assigned to that pool, and policies for access to
3559 that pool's resources;
3561 o static address and port map entries.
3563 As described in previous sections, this MIB module does provide read-
3564 write objects for control of notifications (see especially
3565 Section 3.1.2) and limiting of resource consumption (Section 3.1.1).
3566 This document is written in advance of any practical experience with
3567 the setting of these values, and can thus provide only general
3568 principles for how to set them.
3570 By default, the MIB module definition disables notifications until
3571 they are explicitly enabled by the operator, using the associated
3572 threshold value to do so. To make use of the notifications, the
3573 operator may wish to take the following considerations into account.
3575 Except for the low address pool utilization notification, the
3576 notifications imply that some sort of administrative action is
3577 required to mitigate an impending shortage of a particular resource.
3578 The choice of value for the triggering threshold needs to take two
3579 factors into account: the volatility of usage of the given resource,
3580 and the amount of time the operator needs to mitigate the potential
3581 overload situation. That time could vary from almost immediate to
3582 several weeks required to order and install new hardware or software.
3584 To give a numeric example, if average utilization is going up 1% per
3585 week but can vary 10% around that average in any given hour, and it
3586 takes two weeks to carry through mitigating measures, the threshold
3587 should be set to 88% of the corresponding limit (two weeks' growth
3588 plus 10% volatility margin). If mitigating measures can be carried
3589 out immediately, this can rise to 90%. For this particular example
3590 that change is insignificant, but in other cases the difference may
3591 be large enough to matter in terms of reduced load on the management
3592 plane.
3594 The notification rate limit settings really depend on the operator's
3595 processes, but are a tradeoff between reliably reporting the notified
3596 condition and not having it overload the management plane.
3597 Reliability rises in importance with the importance of the resource
3598 involved. Thus the default notification intervals defined in this
3599 MIB module range from 10 seconds (high reliability) for the address
3600 and port map entry thresholds up to 60 seconds (lower reliability)
3601 for the per-subscriber port entry thresholds. Experience may suggest
3602 better values.
3604 The limits on number of instance-level address map and port map
3605 entries and held fragments relate directly to memory allocations for
3606 these tables. The relationship between number of map entries or
3607 number of held fragments and memory required will be implementation-
3608 specific. Hence it is up to the implementor to provide specific
3609 advice on the setting of these limits.
3611 The limit on simultaneous number of active subscribers is indirectly
3612 related to memory consumption for map entries, but also to processor
3613 usage by the NAT instance. The best strategy for setting this limit
3614 would seem to be to leave it disabled during an initial period while
3615 observing device processor utilization, then to implement a trial
3616 setting while observing the number of blocked packets affected by the
3617 new limit. The setting may vary by NAT instance if a suitable
3618 estimator of likely load (e.g., total number of hosts served by that
3619 instance) is available.
3621 5.2. Transition From and Coexistence With NAT-MIB [RFC 4008]
3623 A manager may have to deal with a mixture of devices supporting the
3624 NAT-MIB module [RFC4008] and the NATV2-MIB module defined in the
3625 present document. It is even possible that both modules are
3626 supported on the same device. The following discussion brings out
3627 the limits of comparability between the two MIB modules. A first
3628 point to note is that NAT-MIB is primarily focussed on configuration,
3629 while NATV2-MIB is primarily focussed on measurements.
3631 To summarize the model used by [RFC4008]:
3633 o The basic unit of NAT configuration is the interface.
3635 o An interface connects to a single realm, either "private", or
3636 "public". In principle that means there could be multiple
3637 instances of one type of realm or the other, but the number is
3638 physically limited by the number of interfaces on the NAT device.
3640 o Before the NAT can operate on a given interface, an "address map"
3641 has to be configured on it. The [RFC4008] address map is
3642 equivalent to the pool tables in the present document. Since just
3643 one "address map" is configured per interface, this is the
3644 equivalent of a single address pool per interface.
3646 o The address binding and port binding tables are roughly equivalent
3647 to the address map and port map tables in the present document in
3648 their content, but can be either uni- directional or
3649 bidirectional. The [RFC4008] model shows the address binding and
3650 port binding as alternative precursors to session establishment,
3651 depending on whether the device does address translation only or
3652 address and port translation. In contrast, NATV2-MIB assumes a
3653 model where bidirectional port mappings are based on bidirectional
3654 address mappings that have conceptually been established
3655 beforehand.
3657 o The equivalent to an [RFC4008] session in NATV2-MIB would be a
3658 pair of port map entries. The added complexity in [RFC4008] is
3659 due to the modelling of NAT service types as defined in [RFC3489]
3660 (the symmetric NAT in particular) instead of the more granular set
3661 of behaviors described in [RFC4787].
3663 With regard to that last point, the mapping between [RFC3489] service
3664 types and [RFC4787] NAT behaviours is as follows:
3666 o A full cone NAT exhibits endpoint-independent port mapping
3667 behavior and endpoint-independent filtering behavior.
3669 o A restricted cone NAT exhibits endpoint-independent port mapping
3670 behavior, but address-dependent filtering behavior.
3672 o A port restricted cone NAT exhibits endpoint-independent port
3673 mapping behavior, but address-and-port-dependent filtering
3674 behavior.
3676 o A symmetric NAT exhibits address-and-port-dependent port mapping
3677 and filtering behaviors.
3679 Note that these NAT types are a subset of the types that could be
3680 configured according to the [RFC4787] behavioral classification used
3681 in NATV2-MIB, but they include the two possibilities (full and
3682 restricted cone NAT) that satisfy requirements REQ-1 and REQ-8 of
3684 [RFC4787]. Note further that other behaviors defined in [RFC4787]
3685 are not considered in [RFC4008].
3687 Having established a context for discussion, we are now in a position
3688 to compare the outputs provided to management from the [RFC4008] and
3689 NATV2-MIB modules. This comparison relates to the ability to compare
3690 results if testing with both MIBs implemented on the same device
3691 during a transition period.
3693 [RFC4008] provides three counters: incoming translations, outgoing
3694 translations, and discarded packets, at the granularities of
3695 interface, address map, and protocol, and incoming and outgoing
3696 translations at the levels of individual address bind, address port
3697 bind, and session entries. Implementation at the protocol and
3698 address map levels is optional. NATV2-MIB provides a single total
3699 (both directions) translations counter at the instance, protocol
3700 within instance, and subscriber levels. Given the differences in
3701 granularity, it appears that the only comparable measurement of
3702 translations between the two MIB modules would be through aggregation
3703 of the [RFC4008] interface counters to give a total number of
3704 translations for the NAT instance.
3706 NATV2-MIB has broken out the single discard counter into a number of
3707 different counters reflecting the cause of the discard in more
3708 detail, to help in trouble-shooting. Again, with the differing
3709 levels of granularity, the only comparable statistic would be through
3710 aggregation to a single value of total discards per NAT instance.
3712 Moving on to state variables, [RFC4008] offers counts of number of
3713 "address map" (i.e., address pool) entries used (excluding static
3714 entries) at the address map level, and number of entries in the
3715 address bind and address and port bind tables respectively. Finally,
3716 [RFC4008] provides a count of the number of sessions currently using
3717 each entry in the address and port bind table. None of these counts
3718 are directly comparable with the state values offered by NATV2-MIB,
3719 because of the exclusion of static entries at the address map level,
3720 and because of the differing models of the translation tables between
3721 [RFC4008] and the NATV2=MIB.
3723 6. Security Considerations
3725 A number of management objects defined in this MIB module have a MAX-
3726 ACCESS clause of read-write. Such objects may be considered
3727 sensitive or vulnerable in some network environments. The support
3728 for SET operations in a non-secure environment without proper
3729 protection can have a negative effect on network operations. These
3730 are the tables and objects and their sensitivity/vulnerability:
3732 Limits: An attacker setting a very low or very high limit can easily
3733 cause a denial-of-service situation.
3735 * natv2InstanceLimitAddressMapEntries;
3737 * natv2InstanceLimitPortMapEntries;
3739 * natv2InstanceLimitPendingFragments;
3741 * natv2InstanceLimitSubscriberActives;
3743 * natv2SubscriberLimitPortMapEntries.
3745 Notification thresholds: An attacker setting an arbitrarily low
3746 threshold can cause many useless notifications to be generated
3747 (subject to the notification interval). Setting an arbitrarily
3748 high threshold can effectively disable notifications, which could
3749 be used to hide another attack.
3751 * natv2InstanceThresholdAddressMapEntriesHigh;
3753 * natv2InstanceThresholdPortMapEntriesHigh;
3755 * natv2PoolThresholdUsageLow;
3757 * natv2PoolThresholdUsageHigh;
3759 * natv2SubscriberThresholdPortMapEntriesHigh.
3761 Notification intervals: An attacker setting a low notification
3762 interval in combination with a low threshold value can cause many
3763 useless notifications to be generated.
3765 * natv2InstanceNotificationInterval;
3767 * natv2PoolNotificationInterval;
3769 * natv2SubscriberNotificationInterval.
3771 Some of the readable objects in this MIB module (i.e., objects with a
3772 MAX-ACCESS other than not-accessible) may be considered sensitive or
3773 vulnerable in some network environments. It is thus important to
3774 control even GET and/or NOTIFY access to these objects and possibly
3775 to even encrypt the values of these objects when sending them over
3776 the network via SNMP. These are the tables and objects and their
3777 sensitivity/vulnerability:
3779 Objects that reveal host identities: Various objects can reveal the
3780 identity of private hosts that are engaged in a session with
3781 external end nodes. A curious outsider could monitor these to
3782 assess the number of private hosts being supported by the NAT
3783 device. Further, a disgruntled former employee of an enterprise
3784 could use the information to break into specific private hosts by
3785 intercepting the existing sessions or originating new sessions
3786 into the host.
3788 * entries in the natv2AddressMapTable;
3790 * entries in the natv2PortMapTable.
3792 Other objects that reveal NAT state: Other managed objects in this
3793 MIB may contain information that may be sensitive from a business
3794 perspective, in that they may represent NAT capabilities, business
3795 policies, and state information.
3797 * natv2SubscriberLimitPortMapEntries;
3799 * natv2InstancePortMappingBehavior;
3801 * natv2InstanceFilteringBehavior;
3803 * natv2InstancePoolingBehavior;
3805 * natv2InstanceFragmentBehavior;
3807 * natv2InstanceAddressMapEntries;
3809 * natv2InstancePortMapEntries.
3811 There are no objects that are sensitive in their own right, such as
3812 passwords or monetary amounts.
3814 SNMP versions prior to SNMPv3 did not include adequate security.
3815 Even if the network itself is secure (for example by using IPsec),
3816 there is no control as to who on the secure network is allowed to
3817 access and GET/SET (read/change/create/delete) the objects in this
3818 MIB module.
3820 Implementations SHOULD provide the security features described by the
3821 SNMPv3 framework (see [RFC3410]), and implementations claiming
3822 compliance to the SNMPv3 standard MUST include full support for
3823 authentication and privacy via the User-based Security Model (USM)
3824 [RFC3414] with the AES cipher algorithm [RFC3826]. Implementations
3825 MAY also provide support for the Transport Security Model (TSM)
3827 [RFC5591] in combination with a secure transport such as SSH
3828 [RFC5592] or TLS/DTLS [RFC6353].
3830 Further, deployment of SNMP versions prior to SNMPv3 is NOT
3831 RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to
3832 enable cryptographic security. It is then a customer/operator
3833 responsibility to ensure that the SNMP entity giving access to an
3834 instance of this MIB module is properly configured to give access to
3835 the objects only to those principals (users) that have legitimate
3836 rights to indeed GET or SET (change/create/delete) them.
3838 7. IANA Considerations
3840 IANA is requested to assign an object identifier to the natv2MIB
3841 module, with prefix iso.org.dod.internet.mgmt.mib-2 in the Network
3842 Management Parameters registry [SMI-NUMBERS].
3844 8. References
3846 8.1. Normative References
3848 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
3849 Requirement Levels", BCP 14, RFC 2119, March 1997.
3851 [RFC2578] McCloghrie, K., Ed., Perkins, D., Ed., and J.
3852 Schoenwaelder, Ed., "Structure of Management Information
3853 Version 2 (SMIv2)", STD 58, RFC 2578, April 1999.
3855 [RFC2579] McCloghrie, K., Ed., Perkins, D., Ed., and J.
3856 Schoenwaelder, Ed., "Textual Conventions for SMIv2", STD
3857 58, RFC 2579, April 1999.
3859 [RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
3860 "Conformance Statements for SMIv2", STD 58, RFC 2580,
3861 April 1999.
3863 [RFC3411] Harrington, D., Presuhn, R., and B. Wijnen, "An
3864 Architecture for Describing Simple Network Management
3865 Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
3866 December 2002.
3868 [RFC3414] Blumenthal, U. and B. Wijnen, "User-based Security Model
3869 (USM) for version 3 of the Simple Network Management
3870 Protocol (SNMPv3)", STD 62, RFC 3414, December 2002.
3872 [RFC3489] Rosenberg, J., Weinberger, J., Huitema, C., and R. Mahy,
3873 "STUN - Simple Traversal of User Datagram Protocol (UDP)
3874 Through Network Address Translators (NATs)", RFC 3489,
3875 March 2003.
3877 [RFC3826] Blumenthal, U., Maino, F., and K. McCloghrie, "The
3878 Advanced Encryption Standard (AES) Cipher Algorithm in the
3879 SNMP User-based Security Model", RFC 3826, June 2004.
3881 [RFC4001] Daniele, M., Haberman, B., Routhier, S., and J.
3882 Schoenwaelder, "Textual Conventions for Internet Network
3883 Addresses", RFC 4001, February 2005.
3885 [RFC4787] Audet, F. and C. Jennings, "Network Address Translation
3886 (NAT) Behavioral Requirements for Unicast UDP", BCP 127,
3887 RFC 4787, January 2007.
3889 [RFC5591] Harrington, D. and W. Hardaker, "Transport Security Model
3890 for the Simple Network Management Protocol (SNMP)", STD
3891 78, RFC 5591, June 2009.
3893 [RFC5592] Harrington, D., Salowey, J., and W. Hardaker, "Secure
3894 Shell Transport Model for the Simple Network Management
3895 Protocol (SNMP)", RFC 5592, June 2009.
3897 [RFC6353] Hardaker, W., "Transport Layer Security (TLS) Transport
3898 Model for the Simple Network Management Protocol (SNMP)",
3899 STD 78, RFC 6353, July 2011.
3901 8.2. Informative References
3903 [I-D.perrault-behave-deprecate-nat-mib-v1]
3904 Perrault, S., Tsou, T., Sivakumar, S., and T. Taylor,
3905 "Deprecation of MIB Module NAT-MIB (Managed Objects for
3906 Network Address Translators (NAT)) (Work in Progress)",
3907 October 2014.
3909 [RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6
3910 (IPv6) Specification", RFC 2460, December 1998.
3912 [RFC2663] Srisuresh, P. and M. Holdrege, "IP Network Address
3913 Translator (NAT) Terminology and Considerations", RFC
3914 2663, August 1999.
3916 [RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart,
3917 "Introduction and Applicability Statements for Internet-
3918 Standard Management Framework", RFC 3410, December 2002.
3920 [RFC4008] Rohit, R., Srisuresh, P., Raghunarayan, R., Pai, N., and
3921 C. Wang, "Definitions of Managed Objects for Network
3922 Address Translators (NAT)", RFC 4008, March 2005.
3924 [RFC6333] Durand, A., Droms, R., Woodyatt, J., and Y. Lee, "Dual-
3925 Stack Lite Broadband Deployments Following IPv4
3926 Exhaustion", RFC 6333, August 2011.
3928 [SMI-NUMBERS]
3929 "Network Management Parameters registry at IANA",
3930 .
3932 Authors' Addresses
3934 Simon Perreault
3935 Jive Communications
3936 Quebec, QC
3937 Canada
3939 Email: sperreault@jive.com
3941 Tina Tsou
3942 Huawei Technologies
3943 Bantian, Longgang District
3944 Shenzhen 518129
3945 PR China
3947 Email: tina.tsou.zouting@huawei.com
3949 Senthil Sivakumar
3950 Cisco Systems
3951 7100-8 Kit Creek Road
3952 Research Triangle Park, North Carolina 27709
3953 USA
3955 Phone: +1 919 392 5158
3956 Email: ssenthil@cisco.com
3958 Tom Taylor
3959 PT Taylor Consulting
3960 Ottawa
3961 Canada
3963 Email: tom.taylor.stds@gmail.com