1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
|
<pre>Internet Engineering Task Force (IETF) S. Sivakumar
Request for Comments: 8158 R. Penno
Category: Standards Track Cisco Systems
ISSN: 2070-1721 December 2017
<span class="h1">IP Flow Information Export (IPFIX) Information Elements</span>
<span class="h1">for Logging NAT Events</span>
Abstract
Network operators require NAT devices to log events like creation and
deletion of translations and information about the resources that the
NAT device is managing. In many cases, the logs are essential to
identify an attacker or a host that was used to launch malicious
attacks and for various other purposes of accounting. Since there is
no standard way of logging this information, different NAT devices
use proprietary formats; hence, it is difficult to expect consistent
behavior. This lack of standardization makes it difficult to write
the Collector applications that would receive this data and process
it to present useful information. This document describes the
formats for logging NAT events.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in <a href="./rfc7841#section-2">Section 2 of RFC 7841</a>.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
<a href="https://www.rfc-editor.org/info/rfc8158">https://www.rfc-editor.org/info/rfc8158</a>.
<span class="grey">Sivakumar & Penno Standards Track [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
Copyright Notice
Copyright (c) 2017 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and the IETF Trust's Legal
Provisions Relating to IETF Documents
(<a href="https://trustee.ietf.org/license-info">https://trustee.ietf.org/license-info</a>) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
<a href="#section-1">1</a>. Introduction . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-1.1">1.1</a>. Terminology . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-1.2">1.2</a>. Requirements Language . . . . . . . . . . . . . . . . . . <a href="#page-5">5</a>
<a href="#section-2">2</a>. Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-5">5</a>
<a href="#section-3">3</a>. Deployment . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-5">5</a>
<a href="#section-4">4</a>. Event-Based Logging . . . . . . . . . . . . . . . . . . . . . <a href="#page-6">6</a>
<a href="#section-4.1">4.1</a>. Logging Destination Information . . . . . . . . . . . . . <a href="#page-6">6</a>
<a href="#section-4.2">4.2</a>. Information Elements . . . . . . . . . . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-4.3">4.3</a>. Definition of NAT Events . . . . . . . . . . . . . . . . <a href="#page-11">11</a>
<a href="#section-4.4">4.4</a>. Quota Exceeded Event Types . . . . . . . . . . . . . . . <a href="#page-12">12</a>
<a href="#section-4.5">4.5</a>. Threshold Reached Event Types . . . . . . . . . . . . . . <a href="#page-13">13</a>
<a href="#section-4.6">4.6</a>. Templates for NAT Events . . . . . . . . . . . . . . . . <a href="#page-14">14</a>
<a href="#section-4.6.1">4.6.1</a>. NAT44 Session Create and Delete Events . . . . . . . <a href="#page-14">14</a>
<a href="#section-4.6.2">4.6.2</a>. NAT64 Session Create and Delete Events . . . . . . . <a href="#page-15">15</a>
<a href="#section-4.6.3">4.6.3</a>. NAT44 BIB Create and Delete Events . . . . . . . . . <a href="#page-16">16</a>
<a href="#section-4.6.4">4.6.4</a>. NAT64 BIB Create and Delete Events . . . . . . . . . <a href="#page-16">16</a>
<a href="#section-4.6.5">4.6.5</a>. Addresses Exhausted Event . . . . . . . . . . . . . . <a href="#page-17">17</a>
<a href="#section-4.6.6">4.6.6</a>. Ports Exhausted Event . . . . . . . . . . . . . . . . <a href="#page-17">17</a>
<a href="#section-4.6.7">4.6.7</a>. Quota Exceeded Events . . . . . . . . . . . . . . . . <a href="#page-18">18</a>
<a href="#section-4.6.7.1">4.6.7.1</a>. Maximum Session Entries Exceeded . . . . . . . . <a href="#page-18">18</a>
<a href="#section-4.6.7.2">4.6.7.2</a>. Maximum BIB Entries Exceeded . . . . . . . . . . <a href="#page-18">18</a>
<a href="#section-4.6.7.3">4.6.7.3</a>. Maximum Entries per User Exceeded . . . . . . . . <a href="#page-19">19</a>
<a href="#section-4.6.7.4">4.6.7.4</a>. Maximum Active Hosts or Subscribers Exceeded . . <a href="#page-19">19</a>
<a href="#section-4.6.7.5">4.6.7.5</a>. Maximum Fragments Pending Reassembly Exceeded . . <a href="#page-19">19</a>
<a href="#section-4.6.8">4.6.8</a>. Threshold Reached Events . . . . . . . . . . . . . . <a href="#page-20">20</a>
<a href="#section-4.6.8.1">4.6.8.1</a>. Address Pool High or Low Threshold Reached . . . <a href="#page-20">20</a>
4.6.8.2. Address and Port Mapping High Threshold Reached . 21
4.6.8.3. Address and Port Mapping per User High Threshold
Reached . . . . . . . . . . . . . . . . . . . . . <a href="#page-21">21</a>
<a href="#section-4.6.8.4">4.6.8.4</a>. Global Address Mapping High Threshold Reached . . <a href="#page-22">22</a>
<a href="#section-4.6.9">4.6.9</a>. Address Binding Create and Delete Events . . . . . . <a href="#page-22">22</a>
<span class="grey">Sivakumar & Penno Standards Track [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
<a href="#section-4.6.10">4.6.10</a>. Port Block Allocation and De-allocation . . . . . . . <a href="#page-22">22</a>
<a href="#section-5">5</a>. Management Considerations . . . . . . . . . . . . . . . . . . <a href="#page-23">23</a>
<a href="#section-5.1">5.1</a>. Ability to Collect Events from Multiple NAT Devices . . . <a href="#page-23">23</a>
<a href="#section-5.2">5.2</a>. Ability to Suppress Events . . . . . . . . . . . . . . . <a href="#page-24">24</a>
<a href="#section-6">6</a>. IANA Considerations . . . . . . . . . . . . . . . . . . . . . <a href="#page-24">24</a>
<a href="#section-6.1">6.1</a>. Information Elements . . . . . . . . . . . . . . . . . . <a href="#page-24">24</a>
<a href="#section-6.1.1">6.1.1</a>. natInstanceID . . . . . . . . . . . . . . . . . . . . <a href="#page-24">24</a>
<a href="#section-6.1.2">6.1.2</a>. internalAddressRealm . . . . . . . . . . . . . . . . <a href="#page-24">24</a>
<a href="#section-6.1.3">6.1.3</a>. externalAddressRealm . . . . . . . . . . . . . . . . <a href="#page-25">25</a>
<a href="#section-6.1.4">6.1.4</a>. natQuotaExceededEvent . . . . . . . . . . . . . . . . <a href="#page-25">25</a>
<a href="#section-6.1.5">6.1.5</a>. natThresholdEvent . . . . . . . . . . . . . . . . . . <a href="#page-26">26</a>
<a href="#section-6.1.6">6.1.6</a>. natEvent . . . . . . . . . . . . . . . . . . . . . . <a href="#page-27">27</a>
<a href="#section-6.1.7">6.1.7</a>. maxSessionEntries . . . . . . . . . . . . . . . . . . <a href="#page-27">27</a>
<a href="#section-6.1.8">6.1.8</a>. maxBIBEntries . . . . . . . . . . . . . . . . . . . . <a href="#page-28">28</a>
<a href="#section-6.1.9">6.1.9</a>. maxEntriesPerUser . . . . . . . . . . . . . . . . . . <a href="#page-28">28</a>
<a href="#section-6.1.10">6.1.10</a>. maxSubscribers . . . . . . . . . . . . . . . . . . . <a href="#page-28">28</a>
<a href="#section-6.1.11">6.1.11</a>. maxFragmentsPendingReassembly . . . . . . . . . . . . <a href="#page-29">29</a>
<a href="#section-6.1.12">6.1.12</a>. addressPoolHighThreshold . . . . . . . . . . . . . . <a href="#page-29">29</a>
<a href="#section-6.1.13">6.1.13</a>. addressPoolLowThreshold . . . . . . . . . . . . . . . <a href="#page-29">29</a>
<a href="#section-6.1.14">6.1.14</a>. addressPortMappingHighThreshold . . . . . . . . . . . <a href="#page-30">30</a>
<a href="#section-6.1.15">6.1.15</a>. addressPortMappingLowThreshold . . . . . . . . . . . <a href="#page-30">30</a>
<a href="#section-6.1.16">6.1.16</a>. addressPortMappingPerUserHighThreshold . . . . . . . <a href="#page-30">30</a>
<a href="#section-6.1.17">6.1.17</a>. globalAddressMappingHighThreshold . . . . . . . . . . <a href="#page-31">31</a>
<a href="#section-7">7</a>. Security Considerations . . . . . . . . . . . . . . . . . . . <a href="#page-31">31</a>
<a href="#section-8">8</a>. References . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-32">32</a>
<a href="#section-8.1">8.1</a>. Normative References . . . . . . . . . . . . . . . . . . <a href="#page-32">32</a>
<a href="#section-8.2">8.2</a>. Informative References . . . . . . . . . . . . . . . . . <a href="#page-33">33</a>
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-34">34</a>
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-34">34</a>
<span class="grey">Sivakumar & Penno Standards Track [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Introduction</span>
The IP Flow Information Export (IPFIX) Protocol [<a href="./rfc7011" title=""Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information"">RFC7011</a>] defines a
generic push mechanism for exporting information and events. The
IPFIX Information Model [<a href="#ref-IPFIX-IANA">IPFIX-IANA</a>] defines a set of standard
Information Elements (IEs) that can be carried by the IPFIX protocol.
This document details the IPFIX IEs that MUST be logged by a NAT
device that supports NAT logging using IPFIX and all the optional
fields. The fields specified in this document are gleaned from
[<a href="./rfc4787" title=""Network Address Translation (NAT) Behavioral Requirements for Unicast UDP"">RFC4787</a>] and [<a href="./rfc5382" title=""NAT Behavioral Requirements for TCP"">RFC5382</a>].
This document and [<a href="#ref-NAT-LOG" title=""Syslog Format for NAT Logging"">NAT-LOG</a>] are written in order to standardize the
events and parameters to be recorded using IPFIX [<a href="./rfc7011" title=""Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information"">RFC7011</a>] and SYSLOG
[<a href="./rfc5424" title=""The Syslog Protocol"">RFC5424</a>], respectively. This document uses IPFIX as the encoding
mechanism to describe the logging of NAT events. However, the
information that is logged should be the same irrespective of what
kind of encoding scheme is used. IPFIX is chosen because it is an
IETF standard that meets all the needs for a reliable logging
mechanism. IPFIX provides the flexibility to the logging device to
define the datasets that it is logging. The IEs specified for
logging must be the same irrespective of the encoding mechanism used.
<span class="h3"><a class="selflink" id="section-1.1" href="#section-1.1">1.1</a>. Terminology</span>
The term "NAT device" in this document refers to any NAT44 or NAT64
device. The term "Collector" refers to any device that receives
binary data from a NAT device and converts it into meaningful
information. This document uses the term "session" as defined in
[<a href="./rfc2663" title=""IP Network Address Translator (NAT) Terminology and Considerations"">RFC2663</a>], and the term "Binding Information Base" (BIB) as defined
in [<a href="./rfc6146" title=""Stateful NAT64: Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers"">RFC6146</a>]. The term "Information Element" or "IE" is defined in
[<a href="./rfc7011" title=""Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information"">RFC7011</a>]. The term "Carrier-Grade NAT" refers to a large-scale NAT
device as described in [<a href="./rfc6888" title=""Common Requirements for Carrier-Grade NATs (CGNs)"">RFC6888</a>]
The IPFIX IEs that are NAT specific are created with NAT terminology.
In order to avoid creating duplicates, IEs are reused if they convey
the same meaning. This document uses the term "timestamp" for the
IE, which defines the time when an event is logged; this is the same
as the IPFIX term "observationTimeMilliseconds" as described in
[<a href="#ref-IPFIX-IANA">IPFIX-IANA</a>]. Since observationTimeMilliseconds is not self-
explanatory for NAT implementors, the term "timeStamp" is used.
Event templates, which refer to IPFIX Template Records, as well as
log events, which refer to IPFIX Flow Records, are also used in this
document.
<span class="grey">Sivakumar & Penno Standards Track [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
<span class="h3"><a class="selflink" id="section-1.2" href="#section-1.2">1.2</a>. Requirements Language</span>
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
<a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a> [<a href="./rfc2119" title=""Key words for use in RFCs to Indicate Requirement Levels"">RFC2119</a>] [<a href="./rfc8174" title=""Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words"">RFC8174</a>] when, and only when, they appear in all
capitals, as shown here.
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. Scope</span>
This document provides the information model to be used for logging
the NAT events, including Carrier-Grade NAT (CGN) events. [<a href="./rfc7011" title=""Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information"">RFC7011</a>]
provides guidance on the choices of the transport protocols used for
IPFIX and their effects. This document does not provide guidance on
transport protocols like TCP, UDP, or Stream Control Transmission
Protocol (SCTP), which are to be used to log NAT events. The logs
SHOULD be reliably sent to the Collector to ensure that the log
events are not lost. The choice of the actual transport protocol is
beyond the scope of this document.
This document uses the allocated IPFIX IEs in the IANA "IPFIX
Information Elements" registry [<a href="#ref-IPFIX-IANA">IPFIX-IANA</a>] and registers some new
ones.
This document assumes that the NAT device will use the existing IPFIX
framework to send the log events to the Collector. This would mean
that the NAT device will specify the template that it is going to use
for each of the events. The templates can be of varying length, and
there could be multiple templates that a NAT device could use to log
the events.
The implementation details of the Collector application are beyond
the scope of this document.
The optimization of logging the NAT events is left to the
implementation and is beyond the scope of this document.
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. Deployment</span>
NAT logging based on IPFIX uses binary encoding; hence, it is very
efficient. IPFIX-based logging is recommended for environments where
a high volume of logging is required, for example, where per-flow
logging is needed or in case of Carrier-Grade NAT. However, IPFIX-
based logging requires a Collector that processes the binary data and
requires a network management application that converts this binary
data to a human-readable format.
<span class="grey">Sivakumar & Penno Standards Track [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
A Collector may receive NAT events from multiple CGN devices. The
Collector distinguishes between the devices using the source IP
address, source port, and Observation Domain ID in the IPFIX header.
The Collector can decide to store the information based on the
administrative policies that are in line with the operator and the
local jurisdiction. The retention policy is not dictated by the
Exporter and is left to the policies that are defined at the
Collector.
A Collector may have scale issues if it is overloaded by a large
number of simultaneous events. An appropriate throttling mechanism
may be used to handle the oversubscription.
The logs that are exported can be used for a variety of reasons. An
example use case is to do accounting based on when the users logged
on and off. The translation will be installed when the user logs on
and removed when the user logs off. These events create log records.
Another use case is to identify an attacker or a host in a provider
network. The network administrators can use these logs to identify
the usage patterns, the need for additional IP addresses, and etc.
The deployment of NAT logging is not limited to just these cases.
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. Event-Based Logging</span>
An event in a NAT device can be viewed as a state transition because
it relates to the management of NAT resources. The creation and
deletion of NAT sessions and bindings are examples of events, as they
result in resources (addresses and ports) being allocated or freed.
The events can happen through the processing of data packets flowing
through the NAT device, through an external entity installing
policies on the NAT router, or as a result of an asynchronous event
like a timer. The list of events is provided in Table 2. Each of
these events SHOULD be logged, unless this is administratively
prohibited. A NAT device MAY log these events to multiple Collectors
if redundancy is required. The network administrator will specify
the Collectors to which the log records are to be sent. It is
necessary to preserve the list of Collectors and its associated
information like the IPv4/IPv6 address, port, and protocol across
reboots so that the configuration information is not lost when the
device is restarted. The NAT device implementing the IPFIX logging
MUST follow the IPFIX specification in [<a href="./rfc7011" title=""Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information"">RFC7011</a>].
<span class="h3"><a class="selflink" id="section-4.1" href="#section-4.1">4.1</a>. Logging Destination Information</span>
Logging destination information in a NAT event is discussed in
[<a href="./rfc6302" title=""Logging Recommendations for Internet-Facing Servers"">RFC6302</a>] and [<a href="./rfc6888" title=""Common Requirements for Carrier-Grade NATs (CGNs)"">RFC6888</a>]. Logging destination information increases
the size of each record and increases the need for storage
considerably. It increases the number of log events generated
<span class="grey">Sivakumar & Penno Standards Track [Page 6]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-7" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
because when the same user connects to a different destination, it
results in a log record per destination address. Logging the source
and destination addresses results in loss of privacy. Logging of
destination addresses and ports, pre- or post-NAT, SHOULD NOT be done
[<a href="./rfc6888" title=""Common Requirements for Carrier-Grade NATs (CGNs)"">RFC6888</a>]. However, this document provides the necessary fields to
log the destination information in cases where they must be logged.
<span class="h3"><a class="selflink" id="section-4.2" href="#section-4.2">4.2</a>. Information Elements</span>
The templates could contain a subset of the IEs shown in Table 1,
depending upon the event being logged. For example, a NAT44 session
creation template record will contain:
{sourceIPv4Address, postNATSourceIPv4Address, destinationIPv4Address,
postNATDestinationIPv4Address, sourceTransportPort,
postNAPTSourceTransportPort, destinationTransportPort,
postNAPTDestinationTransportPort, internalAddressRealm, natEvent,
timeStamp}
An example of the actual event data record is shown below in a human-
readable form:
{192.0.2.1, 203.0.113.100, 192.0.2.104, 192.0.2.104, 14800, 1024, 80,
80, 0, 1, 09:20:10:789}
A single NAT device could be exporting multiple templates, and the
Collector MUST support receiving multiple templates from the same
source.
<span class="grey">Sivakumar & Penno Standards Track [Page 7]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-8" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
The following table includes all the IEs that a NAT device would need
to export the events. The formats of the IEs and the IPFIX IDs are
listed. Detailed descriptions of the fields natInstanceID,
internalAddressRealm, externalAddressRealm, natQuotaExceededEvent,
and natThresholdEvent are included in the IANA Considerations
section.
+-----------------------------------+--------+-------+--------------+
| Field Name | Size | IANA | Description |
| | (bits) | IPFIX | |
| | | ID | |
+-----------------------------------+--------+-------+--------------+
| timeStamp | 64 | 323 | System Time |
| | | | when the |
| | | | event |
| | | | occurred |
| | | | |
| natInstanceID | 32 | 463 | NAT Instance |
| | | | Identifier |
| | | | |
| vlanId | 16 | 58 | VLAN ID in |
| | | | case of |
| | | | overlapping |
| | | | networks |
| | | | |
| ingressVRFID | 32 | 234 | VRF ID in |
| | | | case of |
| | | | overlapping |
| | | | networks |
| | | | |
| sourceIPv4Address | 32 | 8 | Source IPv4 |
| | | | Address |
| | | | |
| postNATSourceIPv4Address | 32 | 225 | Translated |
| | | | Source IPv4 |
| | | | Address |
| | | | |
| protocolIdentifier | 8 | 4 | Transport |
| | | | protocol |
| | | | |
| sourceTransportPort | 16 | 7 | Source Port |
| | | | |
| postNAPTSourceTransportPort | 16 | 227 | Translated |
| | | | Source port |
| | | | |
| destinationIPv4Address | 32 | 12 | Destination |
| | | | IPv4 Address |
| | | | |
<span class="grey">Sivakumar & Penno Standards Track [Page 8]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-9" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
| postNATDestinationIPv4Address | 32 | 226 | Translated |
| | | | IPv4 |
| | | | destination |
| | | | address |
| | | | |
| destinationTransportPort | 16 | 11 | Destination |
| | | | port |
| | | | |
| postNAPTDestinationTransportPort | 16 | 228 | Translated |
| | | | Destination |
| | | | port |
| | | | |
| sourceIPv6Address | 128 | 27 | Source IPv6 |
| | | | address |
| | | | |
| destinationIPv6Address | 128 | 28 | Destination |
| | | | IPv6 address |
| | | | |
| postNATSourceIPv6Address | 128 | 281 | Translated |
| | | | source IPv6 |
| | | | address |
| | | | |
| postNATDestinationIPv6Address | 128 | 282 | Translated |
| | | | Destination |
| | | | IPv6 address |
| | | | |
| internalAddressRealm | (*) | 464 | Source |
| | | | Address |
| | | | Realm |
| | | | |
| externalAddressRealm | (*) | 465 | Destination |
| | | | Address |
| | | | Realm |
| | | | |
| natEvent | 8 | 230 | Type of |
| | | | Event |
| | | | |
| portRangeStart | 16 | 361 | Allocated |
| | | | port block |
| | | | start |
| | | | |
| portRangeEnd | 16 | 362 | Allocated |
| | | | Port block |
| | | | end |
| | | | |
| natPoolId | 32 | 283 | NAT pool |
| | | | Identifier |
| | | | |
<span class="grey">Sivakumar & Penno Standards Track [Page 9]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-10" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
| natQuotaExceededEvent | 32 | 466 | Limit event |
| | | | identifier |
| | | | |
| natThresholdEvent | 32 | 467 | Threshold |
| | | | event |
| | | | identifier |
| | | | |
| maxSessionEntries | 32 | 471 | Maximum |
| | | | session |
| | | | entries |
| | | | |
| maxBIBEntries | 32 | 472 | Maximum bind |
| | | | entries |
| | | | |
| maxEntriesPerUser | 32 | 473 | Maximum |
| | | | entries per- |
| | | | user |
| | | | |
| maxSubscribers | 32 | 474 | Maximum |
| | | | subscribers |
| | | | |
| maxFragmentsPendingReassembly | 32 | 475 | Maximum |
| | | | fragments |
| | | | for |
| | | | ressembly |
| | | | |
| addressPoolHighThreshold | 32 | 476 | High |
| | | | threshold |
| | | | for address |
| | | | pool |
| | | | |
| addressPoolLowThreshold | 32 | 477 | Low |
| | | | threshold |
| | | | for address |
| | | | pool |
| | | | |
| addressPortMappingHighThreshold | 32 | 478 | High |
| | | | threshold |
| | | | for |
| | | | address/port |
| | | | mapping |
| | | | |
| addressPortMappingLowThreshold | 32 | 479 | Low |
| | | | threshold |
| | | | for |
| | | | address/port |
| | | | mapping |
| | | | |
<span class="grey">Sivakumar & Penno Standards Track [Page 10]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-11" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
| addressPortMappingPerUserHighThre | 32 | 480 | High |
| shold | | | threshold |
| | | | for per-user |
| | | | address/port |
| | | | mapping |
| | | | |
| globalAddressMappingHighThreshold | 32 | 481 | High |
| | | | threshold |
| | | | for global |
| | | | address |
| | | | mapping |
+-----------------------------------+--------+-------+--------------+
Note: (*) indicates octetArray
Table 1: NAT IE List
<span class="h3"><a class="selflink" id="section-4.3" href="#section-4.3">4.3</a>. Definition of NAT Events</span>
The following is the complete list of NAT events and the proposed
event type values. The natEvent IE is defined in the "IPFIX
Information Elements" registry [<a href="#ref-IPFIX-IANA">IPFIX-IANA</a>];. The list can be
expanded in the future as necessary. The data record will have the
corresponding natEvent value to indicate the event that is being
logged.
Note that the first two events are marked "Historic" and are listed
here for the sole purpose of completeness. Any compliant
implementation SHOULD NOT use the events that are marked "Historic".
These values were defined prior to the existence of this document and
outside the IETF. These events are not standalone and require more
information to be conveyed to qualify the event. For example, the
NAT translation create event does not specify if it is NAT44 or
NAT64. As a result, the Behave working group decided to have an
explicit definition for each one of the unique events.
<span class="grey">Sivakumar & Penno Standards Track [Page 11]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-12" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
+-------+------------------------------------+
| Value | Event Name |
+-------+------------------------------------+
| 0 | Reserved |
| 1 | NAT translation create (Historic) |
| 2 | NAT translation delete (Historic) |
| 3 | NAT Addresses exhausted |
| 4 | NAT44 session create |
| 5 | NAT44 session delete |
| 6 | NAT64 session create |
| 7 | NAT64 session delete |
| 8 | NAT44 BIB create |
| 9 | NAT44 BIB delete |
| 10 | NAT64 BIB create |
| 11 | NAT64 BIB delete |
| 12 | NAT ports exhausted |
| 13 | Quota Exceeded |
| 14 | Address binding create |
| 15 | Address binding delete |
| 16 | Port block allocation |
| 17 | Port block de-allocation |
| 18 | Threshold Reached |
+-------+------------------------------------+
Table 2: NAT Event ID
<span class="h3"><a class="selflink" id="section-4.4" href="#section-4.4">4.4</a>. Quota Exceeded Event Types</span>
The Quota Exceeded event is a natEvent IE described in Table 2. The
Quota Exceeded events are generated when the hard limits set by the
administrator have been reached or exceeded. The following table
shows the sub-event types for the Quota Exceeded event. The events
that can be reported are the maximum session entries limit reached,
maximum BIB entries limit reached, maximum (session/BIB) entries per
user limit reached, maximum active hosts or subscribers limit
reached, and maximum Fragments pending reassembly limit reached.
<span class="grey">Sivakumar & Penno Standards Track [Page 12]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-13" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
+-------+---------------------------------------+
| Value | Quota Exceeded Event Name |
+-------+---------------------------------------+
| 0 | Reserved |
| 1 | Maximum session entries |
| 2 | Maximum BIB entries |
| 3 | Maximum entries per user |
| 4 | Maximum active hosts or subscribers |
| 5 | Maximum fragments pending reassembly |
+-------+---------------------------------------+
Table 3: Quota Exceeded Event
<span class="h3"><a class="selflink" id="section-4.5" href="#section-4.5">4.5</a>. Threshold Reached Event Types</span>
The following table shows the sub-event types for the Threshold
Reached event. The administrator can configure the thresholds, and
whenever the threshold is reached or exceeded, the corresponding
events are generated. The main difference between the Quota Exceeded
and Threshold Reached events is that, once the Quota Exceeded events
are hit, the packets are dropped or mappings will not be created,
whereas the Threshold Reached events will provide the operator a
chance to take action before the traffic disruptions can happen. A
NAT device can choose to implement one or the other, or both.
The address pool high threshold event will be reported when the
address pool reaches a high-water mark as defined by the operator.
This will serve as an indication that either the operator might have
to add more addresses to the pool or the subsequent users may be
denied NAT translation mappings.
The address pool low threshold event will be reported when the
address pool reaches a low-water mark as defined by the operator.
This will serve as an indication that the operator can reclaim some
of the global IPv4 addresses in the pool.
The address and port mapping high threshold event is generated when
the number of ports in the configured address pool has reached a
configured threshold.
The per-user address and port mapping high threshold is generated
when a single user utilizes more address and port mapping than a
configured threshold. We don't track the low threshold for per-user
address and port mappings because, as the ports are freed, the
address will become available. The address pool low threshold event
will then be triggered so that the global IPv4 address can be
reclaimed.
<span class="grey">Sivakumar & Penno Standards Track [Page 13]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-14" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
The global address mapping high threshold event is generated when the
maximum number of mappings per user is reached for a NAT device doing
paired-address pooling.
+-------+---------------------------------------------------------+
| Value | Threshold Exceeded Event Name |
+-------+---------------------------------------------------------+
| 0 | Reserved |
| 1 | Address pool high threshold event |
| 2 | Address pool low threshold event |
| 3 | Address and port mapping high threshold event |
| 4 | Address and port mapping per user high threshold event |
| 5 | Global address mapping high threshold event |
+-------+---------------------------------------------------------+
Table 4: Threshold Event
<span class="h3"><a class="selflink" id="section-4.6" href="#section-4.6">4.6</a>. Templates for NAT Events</span>
The following is the template of events that will be logged. The
events below are identified at the time of this writing, but the set
of events is extensible. A NAT device that implements a given NAT
event MUST support the mandatory IEs in the templates. Depending on
the implementation and configuration, various IEs that are not
mandatory can be included or ignored.
<span class="h4"><a class="selflink" id="section-4.6.1" href="#section-4.6.1">4.6.1</a>. NAT44 Session Create and Delete Events</span>
These events will be generated when a NAT44 session is created or
deleted. The template will be the same; the natEvent will indicate
whether it is a create or a delete event. The following is a
template of the event.
The destination address and port information is optional as required
by [<a href="./rfc6888" title=""Common Requirements for Carrier-Grade NATs (CGNs)"">RFC6888</a>]. However, when the destination information is
suppressed, the session log event contains the same information as
the BIB event. In such cases, the NAT device SHOULD NOT send both
BIB and session events.
<span class="grey">Sivakumar & Penno Standards Track [Page 14]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-15" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
+----------------------------------+-------------+-----------+
| Field Name | Size (bits) | Mandatory |
+----------------------------------+-------------+-----------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| sourceIPv4Address | 32 | Yes |
| postNATSourceIPv4Address | 32 | Yes |
| protocolIdentifier | 8 | Yes |
| sourceTransportPort | 16 | Yes |
| postNAPTSourceTransportPort | 16 | Yes |
| destinationIPv4Address | 32 | No |
| postNATDestinationIPv4Address | 32 | No |
| destinationTransportPort | 16 | No |
| postNAPTDestinationTransportPort | 16 | No |
| natInstanceID | 32 | No |
| vlanID/ingressVRFID | 16/32 | No |
| internalAddressRealm | octetArray | No |
| externalAddressRealm | octetArray | No |
+----------------------------------+-------------+-----------+
Table 5: NAT44 Session Delete/Create Template
<span class="h4"><a class="selflink" id="section-4.6.2" href="#section-4.6.2">4.6.2</a>. NAT64 Session Create and Delete Events</span>
These events will be generated when a NAT64 session is created or
deleted. The following is a template of the event.
+----------------------------------+-------------+-----------+
| Field Name | Size (bits) | Mandatory |
+----------------------------------+-------------+-----------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| sourceIPv6Address | 128 | Yes |
| postNATSourceIPv4Address | 32 | Yes |
| protocolIdentifier | 8 | Yes |
| sourceTransportPort | 16 | Yes |
| postNAPTSourceTransportPort | 16 | Yes |
| destinationIPv6Address | 128 | No |
| postNATDestinationIPv4Address | 32 | No |
| destinationTransportPort | 16 | No |
| postNAPTDestinationTransportPort | 16 | No |
| natInstanceID | 32 | No |
| vlanID/ingressVRFID | 16/32 | No |
| internalAddressRealm | octetArray | No |
| externalAddressRealm | octetArray | No |
+----------------------------------+-------------+-----------+
Table 6: NAT64 Session Create/Delete Event Template
<span class="grey">Sivakumar & Penno Standards Track [Page 15]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-16" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
<span class="h4"><a class="selflink" id="section-4.6.3" href="#section-4.6.3">4.6.3</a>. NAT44 BIB Create and Delete Events</span>
These events will be generated when a NAT44 Bind entry is created or
deleted. The following is a template of the event.
+-----------------------------+-------------+-----------+
| Field Name | Size (bits) | Mandatory |
+-----------------------------+-------------+-----------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| sourceIPv4Address | 32 | Yes |
| postNATSourceIPv4Address | 32 | Yes |
| protocolIdentifier | 8 | No |
| sourceTransportPort | 16 | No |
| postNAPTSourceTransportPort | 16 | No |
| natInstanceID | 32 | No |
| vlanID/ingressVRFID | 16/32 | No |
| internalAddressRealm | octetArray | No |
| externalAddressRealm | octetArray | No |
+-----------------------------+-------------+-----------+
Table 7: NAT44 BIB Create/Delete Event Template
<span class="h4"><a class="selflink" id="section-4.6.4" href="#section-4.6.4">4.6.4</a>. NAT64 BIB Create and Delete Events</span>
These events will be generated when a NAT64 Bind entry is created or
deleted. The following is a template of the event.
+-----------------------------+-------------+-----------+
| Field Name | Size (bits) | Mandatory |
+-----------------------------+-------------+-----------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| sourceIPv6Address | 128 | Yes |
| postNATSourceIPv4Address | 32 | Yes |
| protocolIdentifier | 8 | No |
| sourceTransportPort | 16 | No |
| postNAPTSourceTransportPort | 16 | No |
| natInstanceID | 32 | No |
| vlanID/ingressVRFID | 16/32 | No |
| internalAddressRealm | octetArray | No |
| externalAddressRealm | octetArray | No |
+-----------------------------+-------------+-----------+
Table 8: NAT64 BIB Create/Delete Event Template
<span class="grey">Sivakumar & Penno Standards Track [Page 16]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-17" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
<span class="h4"><a class="selflink" id="section-4.6.5" href="#section-4.6.5">4.6.5</a>. Addresses Exhausted Event</span>
This event will be generated when a NAT device runs out of global
IPv4 addresses in a given pool of addresses. Typically, this event
would mean that the NAT device won't be able to create any new
translations until some addresses/ports are freed. This event SHOULD
be rate-limited, as many packets hitting the device at the same time
will trigger a burst of addresses exhausted events.
The following is a template of the event.
+---------------+-------------+-----------+
| Field Name | Size (bits) | Mandatory |
+---------------+-------------+-----------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| natPoolID | 32 | Yes |
| natInstanceID | 32 | No |
+---------------+-------------+-----------+
Table 9: Addresses Exhausted Event Template
<span class="h4"><a class="selflink" id="section-4.6.6" href="#section-4.6.6">4.6.6</a>. Ports Exhausted Event</span>
This event will be generated when a NAT device runs out of ports for
a global IPv4 address. Port exhaustion shall be reported per
protocol (UDP, TCP, etc.). This event SHOULD be rate-limited, as
many packets hitting the device at the same time will trigger a burst
of port exhausted events.
The following is a template of the event.
+--------------------------+-------------+-----------+
| Field Name | Size (bits) | Mandatory |
+--------------------------+-------------+-----------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| postNATSourceIPv4Address | 32 | Yes |
| protocolIdentifier | 8 | Yes |
| natInstanceID | 32 | No |
+--------------------------+-------------+-----------+
Table 10: Ports Exhausted Event Template
<span class="grey">Sivakumar & Penno Standards Track [Page 17]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-18" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
<span class="h4"><a class="selflink" id="section-4.6.7" href="#section-4.6.7">4.6.7</a>. Quota Exceeded Events</span>
This event will be generated when a NAT device cannot allocate
resources as a result of an administratively defined policy. The
Quota Exceeded event templates are described below.
<span class="h5"><a class="selflink" id="section-4.6.7.1" href="#section-4.6.7.1">4.6.7.1</a>. Maximum Session Entries Exceeded</span>
The maximum session entries exceeded event is generated when the
administratively configured NAT session limit is reached. The
following is the template of the event.
+-----------------------+-------------+-----------+
| Field Name | Size (bits) | Mandatory |
+-----------------------+-------------+-----------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| natQuotaExceededEvent | 32 | Yes |
| maxSessionEntries | 32 | Yes |
| natInstanceID | 32 | No |
+-----------------------+-------------+-----------+
Table 11: Session Entries Exceeded Event Template
<span class="h5"><a class="selflink" id="section-4.6.7.2" href="#section-4.6.7.2">4.6.7.2</a>. Maximum BIB Entries Exceeded</span>
The maximum BIB entries exceeded event is generated when the
administratively configured BIB entry limit is reached. The
following is the template of the event.
+-----------------------+-------------+-----------+
| Field Name | Size (bits) | Mandatory |
+-----------------------+-------------+-----------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| natQuotaExceededEvent | 32 | Yes |
| maxBIBEntries | 32 | Yes |
| natInstanceID | 32 | No |
+-----------------------+-------------+-----------+
Table 12: BIB Entries Exceeded Event Template
<span class="grey">Sivakumar & Penno Standards Track [Page 18]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-19" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
<span class="h5"><a class="selflink" id="section-4.6.7.3" href="#section-4.6.7.3">4.6.7.3</a>. Maximum Entries per User Exceeded</span>
This event is generated when a single user reaches the
administratively configured NAT translation limit. The following is
the template of the event.
+-----------------------+-------------+---------------+
| Field Name | Size (bits) | Mandatory |
+-----------------------+-------------+---------------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| natQuotaExceededEvent | 32 | Yes |
| maxEntriesPerUser | 32 | Yes |
| sourceIPv4Address | 32 | Yes for NAT44 |
| sourceIPv6Address | 128 | Yes for NAT64 |
| natInstanceID | 32 | No |
| vlanID/ingressVRFID | 16/32 | No |
+-----------------------+-------------+---------------+
Table 13: Per-User Entries Exceeded Event Template
<span class="h5"><a class="selflink" id="section-4.6.7.4" href="#section-4.6.7.4">4.6.7.4</a>. Maximum Active Hosts or Subscribers Exceeded</span>
This event is generated when the number of allowed hosts or
subscribers reaches the administratively configured limit. The
following is the template of the event.
+-----------------------+-------------+-----------+
| Field Name | Size (bits) | Mandatory |
+-----------------------+-------------+-----------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| natQuotaExceededEvent | 32 | Yes |
| maxSubscribers | 32 | Yes |
| natInstanceID | 32 | No |
+-----------------------+-------------+-----------+
Table 14: Maximum Hosts/Subscribers Exceeded Event Template
<span class="h5"><a class="selflink" id="section-4.6.7.5" href="#section-4.6.7.5">4.6.7.5</a>. Maximum Fragments Pending Reassembly Exceeded</span>
This event is generated when the number of fragments pending
reassembly reaches the administratively configured limit. Note that
in the case of NAT64, when this condition is detected in the IPv6-to-
IPv4 direction, the IPv6 source address is mandatory in the template.
Similarly, when this condition is detected in IPv4-to-IPv6 direction,
the source IPv4 address is mandatory in the template below. The
following is the template of the event.
<span class="grey">Sivakumar & Penno Standards Track [Page 19]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-20" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
+-------------------------------+-------------+----------------+
| Field Name | Size (bits) | Mandatory |
+-------------------------------+-------------+----------------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| natQuotaExceededEvent | 32 | Yes |
| maxFragmentsPendingReassembly | 32 | Yes |
| sourceIPv4Address | 32 | Yes for NAT44 |
| sourceIPv6Address | 128 | Yes for NAT64 |
| natInstanceID | 32 | No |
| vlanID/ingressVRFID | 16/32 | No |
| internalAddressRealm | octetArray | No |
+-------------------------------+-------------+----------------+
Table 15: Maximum Fragments Pending Reassembly Exceeded Event
Template
<span class="h4"><a class="selflink" id="section-4.6.8" href="#section-4.6.8">4.6.8</a>. Threshold Reached Events</span>
This event will be generated when a NAT device reaches an operator-
configured threshold when allocating resources. The Threshold
Reached events are described in the section above. The following is
a template of the individual events.
<span class="h5"><a class="selflink" id="section-4.6.8.1" href="#section-4.6.8.1">4.6.8.1</a>. Address Pool High or Low Threshold Reached</span>
This event is generated when the high or low threshold is reached for
the address pool. The template is the same for both high and low
threshold events
+----------------------------------------------+--------+-----------+
| Field Name | Size | Mandatory |
| | (bits) | |
+----------------------------------------------+--------+-----------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| natThresholdEvent | 32 | Yes |
| natPoolID | 32 | Yes |
| addressPoolHighThreshold/ | 32 | Yes |
| addressPoolLowThreshold | | |
| natInstanceID | 32 | No |
+----------------------------------------------+--------+-----------+
Table 16: Address Pool High/Low Threshold Reached Event Template
<span class="grey">Sivakumar & Penno Standards Track [Page 20]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-21" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
<span class="h5"><a class="selflink" id="section-4.6.8.2" href="#section-4.6.8.2">4.6.8.2</a>. Address and Port Mapping High Threshold Reached</span>
This event is generated when the high threshold is reached for the
address pool and ports.
+----------------------------------------------+--------+-----------+
| Field Name | Size | Mandatory |
| | (bits) | |
+----------------------------------------------+--------+-----------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| natThresholdEvent | 32 | Yes |
| addressPortMappingHighThreshold/ | 32 | Yes |
| addressPortMappingLowThreshold | | |
| natInstanceID | 32 | No |
+----------------------------------------------+--------+-----------+
Table 17: Address Port High Threshold Reached Event Template
<span class="h5"><a class="selflink" id="section-4.6.8.3" href="#section-4.6.8.3">4.6.8.3</a>. Address and Port Mapping per User High Threshold Reached</span>
This event is generated when the high threshold is reached for the
per-user address pool and ports.
+----------------------------------------------+--------+-----------+
| Field Name | Size | Mandatory |
| | (bits) | |
+----------------------------------------------+--------+-----------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| natThresholdEvent | 32 | Yes |
| addressPortMappingHighThreshold/ | 32 | Yes |
| addressPortMappingLowThreshold | | |
| sourceIPv4Address | 32 | Yes for |
| | | NAT44 |
| sourceIPv6Address | 128 | Yes for |
| | | NAT64 |
| natInstanceID | 32 | No |
| vlanID/ingressVRFID | 16/32 | No |
+----------------------------------------------+--------+-----------+
Table 18: Address and Port Mapping per User High Threshold Reached
Event Template
<span class="grey">Sivakumar & Penno Standards Track [Page 21]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-22" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
<span class="h5"><a class="selflink" id="section-4.6.8.4" href="#section-4.6.8.4">4.6.8.4</a>. Global Address Mapping High Threshold Reached</span>
This event is generated when the high threshold is reached for the
per-user address pool and ports. This is generated only by NAT
devices that use a paired-address-pooling behavior.
+-----------------------------------+-------------+-----------+
| Field Name | Size (bits) | Mandatory |
+-----------------------------------+-------------+-----------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| natThresholdEvent | 32 | Yes |
| globalAddressMappingHighThreshold | 32 | Yes |
| natInstanceID | 32 | No |
| vlanID/ingressVRFID | 16/32 | No |
+-----------------------------------+-------------+-----------+
Table 19: Global Address Mapping High Threshold Reached Event
Template
<span class="h4"><a class="selflink" id="section-4.6.9" href="#section-4.6.9">4.6.9</a>. Address Binding Create and Delete Events</span>
These events will be generated when a NAT device binds a local
address with a global address and when the global address is freed.
A NAT device will generate the binding events when it receives the
first packet of the first flow from a host in the private realm.
+--------------------------+-------------+---------------+
| Field Name | Size (bits) | Mandatory |
+--------------------------+-------------+---------------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| sourceIPv4Address | 32 | Yes for NAT44 |
| sourceIPv6Address | 128 | Yes for NAT64 |
| postNATSourceIPv4Address | 32 | Yes |
| natInstanceID | 32 | No |
+--------------------------+-------------+---------------+
Table 20: NAT Address Binding Template
<span class="h4"><a class="selflink" id="section-4.6.10" href="#section-4.6.10">4.6.10</a>. Port Block Allocation and De-allocation</span>
This event will be generated when a NAT device allocates/de-allocates
ports in a bulk fashion, as opposed to allocating a port on a per-
flow basis.
<span class="grey">Sivakumar & Penno Standards Track [Page 22]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-23" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
portRangeStart represents the starting value of the range.
portRangeEnd represents the ending value of the range.
NAT devices would do this in order to reduce logs and to potentially
limit the number of connections a subscriber is allowed to use. In
the following Port Block allocation template, the portRangeStart and
portRangeEnd MUST be specified.
It is up to the implementation to choose to consolidate log records
in case two consecutive port ranges for the same user are allocated
or freed.
+--------------------------+-------------+---------------+
| Field Name | Size (bits) | Mandatory |
+--------------------------+-------------+---------------+
| timeStamp | 64 | Yes |
| natEvent | 8 | Yes |
| sourceIPv4Address | 32 | Yes for NAT44 |
| sourceIPv6Address | 128 | Yes for NAT64 |
| postNATSourceIPv4Address | 32 | Yes |
| portRangeStart | 16 | Yes |
| portRangeEnd | 16 | No |
| natInstanceID | 32 | No |
+--------------------------+-------------+---------------+
Table 21: NAT Port Block Allocation Event Template
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. Management Considerations</span>
This section considers requirements for management of the log system
to support logging of the events described above. It first covers
requirements applicable to log management in general. Any additional
standardization required to fulfill these requirements is out of
scope of the present document. Some management considerations are
covered in [<a href="#ref-NAT-LOG" title=""Syslog Format for NAT Logging"">NAT-LOG</a>]. This document covers the additional
considerations.
<span class="h3"><a class="selflink" id="section-5.1" href="#section-5.1">5.1</a>. Ability to Collect Events from Multiple NAT Devices</span>
An IPFIX Collector MUST be able to collect events from multiple NAT
devices and decipher events based on the Observation Domain ID in the
IPFIX header.
<span class="grey">Sivakumar & Penno Standards Track [Page 23]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-24" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
<span class="h3"><a class="selflink" id="section-5.2" href="#section-5.2">5.2</a>. Ability to Suppress Events</span>
The exhaustion events can be overwhelming during traffic bursts;
hence, they SHOULD be handled by the NAT devices to rate-limit them
before sending them to the Collectors. For example, when the port
exhaustion happens during bursty conditions, instead of sending a
port exhaustion event for every packet, the exhaustion events SHOULD
be rate-limited by the NAT device.
<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>. IANA Considerations</span>
<span class="h3"><a class="selflink" id="section-6.1" href="#section-6.1">6.1</a>. Information Elements</span>
IANA has registered the following IEs in the "IPFIX Information
Elements" registry at [<a href="#ref-IPFIX-IANA">IPFIX-IANA</a>].
<span class="h4"><a class="selflink" id="section-6.1.1" href="#section-6.1.1">6.1.1</a>. natInstanceID</span>
ElementID: 463
Name: natInstanceID
Description: This Information Element uniquely identifies an Instance
of the NAT that runs on a NAT middlebox function after the packet
passes the Observation Point. natInstanceID is defined in [<a href="./rfc7659" title=""Definitions of Managed Objects for Network Address Translators (NATs)"">RFC7659</a>].
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc791" title=""Internet Protocol"">RFC791</a>] for the definition of the IPv4 source address
field. See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>] for
the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.2" href="#section-6.1.2">6.1.2</a>. internalAddressRealm</span>
ElementID: 464
Name: internalAddressRealm
Description: This Information Element represents the internal address
realm where the packet is originated from or destined to. By
definition, a NAT mapping can be created from two address realms, one
from internal and one from external. Realms are implementation
dependent and can represent a Virtual Routing and Forwarding (VRF)
ID, a VLAN ID, or some unique identifier. Realms are optional and,
when left unspecified, would mean that the external and internal
realms are the same.
<span class="grey">Sivakumar & Penno Standards Track [Page 24]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-25" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
Abstract Data Type: octetArray
Data Type Semantics: identifier
Reference: See [<a href="./rfc791" title=""Internet Protocol"">RFC791</a>] for the definition of the IPv4 source address
field. See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>] for
the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.3" href="#section-6.1.3">6.1.3</a>. externalAddressRealm</span>
ElementID: 465
Name: externalAddressRealm
Description: This Information Element represents the external address
realm where the packet is originated from or destined to. The
detailed definition is in the internal address realm as specified
above.
Abstract Data Type: octetArray
Data Type Semantics: identifier
Reference: See [<a href="./rfc791" title=""Internet Protocol"">RFC791</a>] for the definition of the IPv4 source address
field. See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>] for
the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.4" href="#section-6.1.4">6.1.4</a>. natQuotaExceededEvent</span>
ElementID: 466
Name: natQuotaExceededEvent
Description: This Information Element identifies the type of a NAT
Quota Exceeded event. Values for this Information Element are listed
in the "NAT Quota Exceeded Event Type" registry, see [<a href="#ref-IPFIX-IANA">IPFIX-IANA</a>].
Initial values in the registry are defined by the table below. New
assignments of values will be administered by IANA and are subject to
Expert Review [<a href="./rfc8126" title="">RFC8126</a>]. Experts need to check definitions of new
values for completeness, accuracy, and redundancy.
<span class="grey">Sivakumar & Penno Standards Track [Page 25]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-26" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
+--------+---------------------------------------+
| Value | Quota Exceeded Event Name |
+--------+---------------------------------------+
| 0 | Reserved |
| 1 | Maximum session entries |
| 2 | Maximum BIB entries |
| 3 | Maximum entries per user |
| 4 | Maximum active hosts or subscribers |
| 5 | Maximum fragments pending reassembly |
+--------+---------------------------------------+
Note: This is the same as Table 3.
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc791" title=""Internet Protocol"">RFC791</a>] for the definition of the IPv4 source address
field. See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>] for
the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.5" href="#section-6.1.5">6.1.5</a>. natThresholdEvent</span>
ElementID: 467
Name: natThresholdEvent
Description: This Information Element identifies a type of a NAT
Threshold event. Values for this Information Element are listed in
the "NAT Threshold Event Type" registry, see [<a href="#ref-IPFIX-IANA">IPFIX-IANA</a>]. Initial
values in the registry are defined by the table below. New
assignments of values will be administered by IANA and are subject to
Expert Review [<a href="./rfc8126" title="">RFC8126</a>]. Experts need to check definitions of new
values for completeness, accuracy, and redundancy.
+--------+---------------------------------------------------------+
| Value | Threshold Exceeded Event Name |
+--------+---------------------------------------------------------+
| 0 | Reserved |
| 1 | Address pool high threshold event |
| 2 | Address pool low threshold event |
| 3 | Address and port mapping high threshold event |
| 4 | Address and port mapping per user high threshold event |
| 5 | Global address mapping high threshold event |
+--------+---------------------------------------------------------+
Note: This is the same as Table 4.
<span class="grey">Sivakumar & Penno Standards Track [Page 26]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-27" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc791" title=""Internet Protocol"">RFC791</a>] for the definition of the IPv4 source address
field. See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>] for
the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.6" href="#section-6.1.6">6.1.6</a>. natEvent</span>
The original definition of this Information Element specified only
three values: 1, 2, and 3. This definition has been replaced by a
registry, to which new values can be added. The semantics of the
three originally defined values remain unchanged. IANA maintains the
"NAT Event Type (Value 230)" registry for values of this Information
Element at [<a href="#ref-IPFIX-IANA">IPFIX-IANA</a>].
ElementID: 230
Name: natEvent
Description: This Information Element identifies a NAT event. This
IE identifies the type of a NAT event. Examples of NAT events
include, but are not limited to, NAT translation create, NAT
translation delete, Threshold Reached, or Threshold Exceeded, etc.
Values for this Information Element are listed in the "NAT Event
Type" registry, see [<a href="#ref-IPFIX-IANA">IPFIX-IANA</a>]. The NAT event values in the
registry are defined by Table 2 in <a href="#section-4.3">Section 4.3</a>. New assignments of
values will be administered by IANA and are subject to Expert Review
[<a href="./rfc8126" title="">RFC8126</a>]. Experts need to check definitions of new values for
completeness, accuracy, and redundancy.
Abstract Data Type: unsigned8
Data Type Semantics: identifier
Reference: See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>]
for the definition of middleboxes. See <a href="./rfc8158">RFC 8158</a> for the definitions
of values 4-16.
<span class="h4"><a class="selflink" id="section-6.1.7" href="#section-6.1.7">6.1.7</a>. maxSessionEntries</span>
ElementID: 471
Name: maxSessionEntries
Description: This element represents the maximum session entries that
can be created by the NAT device.
<span class="grey">Sivakumar & Penno Standards Track [Page 27]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-28" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>]
for the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.8" href="#section-6.1.8">6.1.8</a>. maxBIBEntries</span>
ElementID: 472
Name: maxBIBEntries
Description: This element represents the maximum BIB entries that can
be created by the NAT device.
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>]
for the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.9" href="#section-6.1.9">6.1.9</a>. maxEntriesPerUser</span>
ElementID: 473
Name: maxEntriesPerUser
Description: This element represents the maximum NAT entries that can
be created per user by the NAT device.
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>]
for the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.10" href="#section-6.1.10">6.1.10</a>. maxSubscribers</span>
ElementID: 474
Name: maxSubscribers
Description: This element represents the maximum subscribers or
maximum hosts that are allowed by the NAT device.
<span class="grey">Sivakumar & Penno Standards Track [Page 28]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-29" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>]
for the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.11" href="#section-6.1.11">6.1.11</a>. maxFragmentsPendingReassembly</span>
ElementID: 475
Name: maxFragmentsPendingReassembly
Description: This element represents the maximum fragments that the
NAT device can store for reassembling the packet.
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>]
for the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.12" href="#section-6.1.12">6.1.12</a>. addressPoolHighThreshold</span>
ElementID: 476
Name: addressPoolHighThreshold
Description: This element represents the high threshold value of the
number of public IP addresses in the address pool.
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>]
for the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.13" href="#section-6.1.13">6.1.13</a>. addressPoolLowThreshold</span>
ElementID: 477
Name: addressPoolLowThreshold
Description: This element represents the low threshold value of the
number of public IP addresses in the address pool.
<span class="grey">Sivakumar & Penno Standards Track [Page 29]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-30" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>]
for the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.14" href="#section-6.1.14">6.1.14</a>. addressPortMappingHighThreshold</span>
ElementID: 478
Name: addressPortMappingHighThreshold
Description: This element represents the high threshold value of the
number of address and port mappings.
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>]
for the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.15" href="#section-6.1.15">6.1.15</a>. addressPortMappingLowThreshold</span>
ElementID: 479
Name: addressPortMappingLowThreshold
Description: This element represents the low threshold value of the
number of address and port mappings.
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>]
for the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.16" href="#section-6.1.16">6.1.16</a>. addressPortMappingPerUserHighThreshold</span>
ElementID: 480
Name: addressPortMappingPerUserHighThreshold
Description: This element represents the high threshold value of the
number of address and port mappings that a single user is allowed to
create on a NAT device.
<span class="grey">Sivakumar & Penno Standards Track [Page 30]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-31" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>]
for the definition of middleboxes.
<span class="h4"><a class="selflink" id="section-6.1.17" href="#section-6.1.17">6.1.17</a>. globalAddressMappingHighThreshold</span>
ElementID: 481
Name: globalAddressMappingHighThreshold
Description: This element represents the high threshold value of the
number of address and port mappings that a single user is allowed to
create on a NAT device in a paired address pooling behavior.
Abstract Data Type: unsigned32
Data Type Semantics: identifier
Reference: See [<a href="./rfc3022" title=""Traditional IP Network Address Translator (Traditional NAT)"">RFC3022</a>] for the definition of NAT. See [<a href="./rfc3234" title=""Middleboxes: Taxonomy and Issues"">RFC3234</a>]
for the definition of middleboxes. See [<a href="./rfc4787" title=""Network Address Translation (NAT) Behavioral Requirements for Unicast UDP"">RFC4787</a>] for the definition
of paired address pooling behavior.
<span class="h2"><a class="selflink" id="section-7" href="#section-7">7</a>. Security Considerations</span>
The security considerations listed in detail for IPFIX in [<a href="./rfc7011" title=""Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information"">RFC7011</a>]
apply to this document as well. As described in [<a href="./rfc7011" title=""Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information"">RFC7011</a>], the
messages exchanged between the NAT device and the Collector MUST be
protected to provide confidentiality, integrity, and authenticity.
Without those characteristics, the messages are subject to various
kinds of attacks. These attacks are described in great detail in
[<a href="./rfc7011" title=""Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information"">RFC7011</a>].
This document re-emphasizes the use of Transport Layer Security (TLS)
or Datagram Transport Layer Security (DTLS) for exchanging the log
messages between the NAT device and the Collector. The log events
sent in cleartext can result in confidential data being exposed to
attackers, who could then spoof log events based on the information
in cleartext messages. Hence, the log events SHOULD NOT be sent in
cleartext.
The logging of NAT events can result in privacy concerns as a result
of exporting information such as the source address and port
information. The logging of destination information can also cause
privacy concerns, but it has been well documented in [<a href="./rfc6888" title=""Common Requirements for Carrier-Grade NATs (CGNs)"">RFC6888</a>]. A
NAT device can choose to operate in various logging modes if it wants
<span class="grey">Sivakumar & Penno Standards Track [Page 31]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-32" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
to avoid logging of private information. The Collector that receives
the information can also choose to mask the private information but
generate reports based on abstract data. It is outside the scope of
this document to address the implementation of logging modes for
privacy considerations.
<span class="h2"><a class="selflink" id="section-8" href="#section-8">8</a>. References</span>
<span class="h3"><a class="selflink" id="section-8.1" href="#section-8.1">8.1</a>. Normative References</span>
[<a id="ref-RFC2119">RFC2119</a>] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>,
DOI 10.17487/RFC2119, March 1997,
<<a href="https://www.rfc-editor.org/info/rfc2119">https://www.rfc-editor.org/info/rfc2119</a>>.
[<a id="ref-RFC4787">RFC4787</a>] Audet, F., Ed. and C. Jennings, "Network Address
Translation (NAT) Behavioral Requirements for Unicast
UDP", <a href="https://www.rfc-editor.org/bcp/bcp127">BCP 127</a>, <a href="./rfc4787">RFC 4787</a>, DOI 10.17487/RFC4787, January
2007, <<a href="https://www.rfc-editor.org/info/rfc4787">https://www.rfc-editor.org/info/rfc4787</a>>.
[<a id="ref-RFC5382">RFC5382</a>] Guha, S., Ed., Biswas, K., Ford, B., Sivakumar, S., and P.
Srisuresh, "NAT Behavioral Requirements for TCP", <a href="https://www.rfc-editor.org/bcp/bcp142">BCP 142</a>,
<a href="./rfc5382">RFC 5382</a>, DOI 10.17487/RFC5382, October 2008,
<<a href="https://www.rfc-editor.org/info/rfc5382">https://www.rfc-editor.org/info/rfc5382</a>>.
[<a id="ref-RFC6146">RFC6146</a>] Bagnulo, M., Matthews, P., and I. van Beijnum, "Stateful
NAT64: Network Address and Protocol Translation from IPv6
Clients to IPv4 Servers", <a href="./rfc6146">RFC 6146</a>, DOI 10.17487/RFC6146,
April 2011, <<a href="https://www.rfc-editor.org/info/rfc6146">https://www.rfc-editor.org/info/rfc6146</a>>.
[<a id="ref-RFC6302">RFC6302</a>] Durand, A., Gashinsky, I., Lee, D., and S. Sheppard,
"Logging Recommendations for Internet-Facing Servers",
<a href="https://www.rfc-editor.org/bcp/bcp162">BCP 162</a>, <a href="./rfc6302">RFC 6302</a>, DOI 10.17487/RFC6302, June 2011,
<<a href="https://www.rfc-editor.org/info/rfc6302">https://www.rfc-editor.org/info/rfc6302</a>>.
[<a id="ref-RFC6888">RFC6888</a>] Perreault, S., Ed., Yamagata, I., Miyakawa, S., Nakagawa,
A., and H. Ashida, "Common Requirements for Carrier-Grade
NATs (CGNs)", <a href="https://www.rfc-editor.org/bcp/bcp127">BCP 127</a>, <a href="./rfc6888">RFC 6888</a>, DOI 10.17487/RFC6888,
April 2013, <<a href="https://www.rfc-editor.org/info/rfc6888">https://www.rfc-editor.org/info/rfc6888</a>>.
[<a id="ref-RFC7011">RFC7011</a>] Claise, B., Ed., Trammell, B., Ed., and P. Aitken,
"Specification of the IP Flow Information Export (IPFIX)
Protocol for the Exchange of Flow Information", STD 77,
<a href="./rfc7011">RFC 7011</a>, DOI 10.17487/RFC7011, September 2013,
<<a href="https://www.rfc-editor.org/info/rfc7011">https://www.rfc-editor.org/info/rfc7011</a>>.
<span class="grey">Sivakumar & Penno Standards Track [Page 32]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-33" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
[<a id="ref-RFC7659">RFC7659</a>] Perreault, S., Tsou, T., Sivakumar, S., and T. Taylor,
"Definitions of Managed Objects for Network Address
Translators (NATs)", <a href="./rfc7659">RFC 7659</a>, DOI 10.17487/RFC7659,
October 2015, <<a href="https://www.rfc-editor.org/info/rfc7659">https://www.rfc-editor.org/info/rfc7659</a>>.
[<a id="ref-RFC8174">RFC8174</a>] Leiba, B., "Ambiguity of Uppercase vs Lowercase in <a href="./rfc2119">RFC</a>
<a href="./rfc2119">2119</a> Key Words", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc8174">RFC 8174</a>, DOI 10.17487/RFC8174,
May 2017, <<a href="https://www.rfc-editor.org/info/rfc8174">https://www.rfc-editor.org/info/rfc8174</a>>.
<span class="h3"><a class="selflink" id="section-8.2" href="#section-8.2">8.2</a>. Informative References</span>
[<a id="ref-IPFIX-IANA">IPFIX-IANA</a>]
IANA, "IPFIX Information Elements",
<<a href="http://www.iana.org/assignments/ipfix">http://www.iana.org/assignments/ipfix</a>>.
[<a id="ref-NAT-LOG">NAT-LOG</a>] Chen, Z., Zhou, C., Tsou, T., and T. Taylor, Ed., "Syslog
Format for NAT Logging", Work in Progress, <a href="./draft-ietf-behave-syslog-nat-logging-06">draft-ietf-</a>
<a href="./draft-ietf-behave-syslog-nat-logging-06">behave-syslog-nat-logging-06</a>, January 2014.
[<a id="ref-RFC791">RFC791</a>] Postel, J., "Internet Protocol", STD 5, <a href="./rfc791">RFC 791</a>,
DOI 10.17487/RFC0791, September 1981,
<<a href="https://www.rfc-editor.org/info/rfc791">https://www.rfc-editor.org/info/rfc791</a>>.
[<a id="ref-RFC2663">RFC2663</a>] Srisuresh, P. and M. Holdrege, "IP Network Address
Translator (NAT) Terminology and Considerations",
<a href="./rfc2663">RFC 2663</a>, DOI 10.17487/RFC2663, August 1999,
<<a href="https://www.rfc-editor.org/info/rfc2663">https://www.rfc-editor.org/info/rfc2663</a>>.
[<a id="ref-RFC3022">RFC3022</a>] Srisuresh, P. and K. Egevang, "Traditional IP Network
Address Translator (Traditional NAT)", <a href="./rfc3022">RFC 3022</a>,
DOI 10.17487/RFC3022, January 2001,
<<a href="https://www.rfc-editor.org/info/rfc3022">https://www.rfc-editor.org/info/rfc3022</a>>.
[<a id="ref-RFC3234">RFC3234</a>] Carpenter, B. and S. Brim, "Middleboxes: Taxonomy and
Issues", <a href="./rfc3234">RFC 3234</a>, DOI 10.17487/RFC3234, February 2002,
<<a href="https://www.rfc-editor.org/info/rfc3234">https://www.rfc-editor.org/info/rfc3234</a>>.
[<a id="ref-RFC5424">RFC5424</a>] Gerhards, R., "The Syslog Protocol", <a href="./rfc5424">RFC 5424</a>,
DOI 10.17487/RFC5424, March 2009,
<<a href="https://www.rfc-editor.org/info/rfc5424">https://www.rfc-editor.org/info/rfc5424</a>>.
[<a id="ref-RFC8126">RFC8126</a>] Cotton, M., Leiba, B., and T. Narten, "Guidelines for
Writing an IANA Considerations Section in RFCs", <a href="https://www.rfc-editor.org/bcp/bcp26">BCP 26</a>,
<a href="./rfc8126">RFC 8126</a>, DOI 10.17487/RFC8126, June 2017,
<<a href="https://www.rfc-editor.org/info/rfc8126">https://www.rfc-editor.org/info/rfc8126</a>>.
<span class="grey">Sivakumar & Penno Standards Track [Page 33]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-34" ></span>
<span class="grey"><a href="./rfc8158">RFC 8158</a> IPFIX IEs for NAT Logging December 2017</span>
Acknowledgements
Thanks to Dan Wing, Selvi Shanmugam, Mohamed Boucadir, Jacni Qin,
Ramji Vaithianathan, Simon Perreault, Jean-Francois Tremblay, Paul
Aitken, Julia Renouard, Spencer Dawkins, and Brian Trammell for their
review and comments.
Authors' Addresses
Senthil Sivakumar
Cisco Systems
7100-8 Kit Creek Road
Research Triangle Park, NC 27709
United States of America
Phone: +1 919 392 5158
Email: ssenthil@cisco.com
Reinaldo Penno
Cisco Systems
170 W Tasman Drive
San Jose, CA 95035
United States of America
Email: repenno@cisco.com
Sivakumar & Penno Standards Track [Page 34]
</pre>
|
