Additional Managed Objects for Network Address Translators (NAT)
draft-ietf-behave-nat-mib-01

Network Working Group                                       S. Perreault
Internet-Draft                                                  Viagenie
Intended status: Standards Track                                 T. Tsou
Expires: December 20, 2012                     Huawei Technologies (USA)
                                                            S. Sivakumar
                                                           Cisco Systems
                                                           June 18, 2012

    Additional Managed Objects for Network Address Translators (NAT)
                      draft-ietf-behave-nat-mib-01

Abstract

   This memo defines a portion of the Management Information Base (MIB)
   for devices implementing Network Address Translator (NAT) function.
   This MIB module may be used for monitoring of a device capable of NAT
   function.

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on December 20, 2012.

Copyright Notice

   Copyright (c) 2012 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of

Perreault, et al.       Expires December 20, 2012               [Page 1]
Internet-Draft                 NEW NAT MIB                     June 2012

   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
   2.  Overview . . . . . . . . . . . . . . . . . . . . . . . . . . .  3
   3.  Definitions  . . . . . . . . . . . . . . . . . . . . . . . . .  4
   4.  Security Considerations  . . . . . . . . . . . . . . . . . . . 26
   5.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 26
   6.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 26
     6.1.  Normative References . . . . . . . . . . . . . . . . . . . 26
     6.2.  Informative References . . . . . . . . . . . . . . . . . . 27
   Appendix A.  Change Log (to be removed by RFC Editor prior to
                publication)  . . . . . . . . . . . . . . . . . . . . 27
     A.1.  Changed in -01 . . . . . . . . . . . . . . . . . . . . . . 27
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 27

Perreault, et al.       Expires December 20, 2012               [Page 2]
Internet-Draft                 NEW NAT MIB                     June 2012

1.  Introduction

   [RFC4008] defines some objects for managing network address
   translators (NATs).  Current operational practice often requires
   additional objects, in particular for enterprise and Internet service
   provider (ISP) deployments.  This document defines those additional
   objects.

   This module is designed to be completely independent from [RFC4008].
   A NAT implementation could be managed using this module, the one from
   [RFC4008], or both.

2.  Overview

   New features in this module are as follows:

   Counters:  Many new counters are introduced.  Most of them are
      available in two variants: global and per-transport protocol.

   Limits:  A few limits on the quantity of state data stored by the NAT
      device.  Some of them can trigger notifications.

   Address+Port Pools:  Pools of external addresses and ports are often
      used in enterprise and ISP settings.  Pools are listed in a table,
      each with its range of addresses and ports.  It is possible to
      inspect each pool's usage, to set limits, and to receive
      notifications when thresholds are crossed.

   Address Mappings:  NATs that have an "IP address pooling" behavior of
      "Paired" [RFC4787] maintain a mapping from internal address to
      external address.  This module allows inspection of this mapping
      table.

   Mapping table indexed by external 3-tuple:  It is often necessary to
      determine the internal address that is mapped to a given external
      address and port.  This MIB provides this table with an index to
      accomplish this efficiently, without having to iterate over all
      mappings.

   Per-subscriber counters, limits, and notifications:  Carrier-Grade
      NATs operate with a notion of "subscriber", to which are
      associated a set of counters, limits, and notifications.  The
      subscriber identifier may not necessarily be an internal address,
      as in the case of DS-Lite, where the identifier is the IPv6
      address of the tunnel endpoint and the internal addresses are the
      same for each subscriber.

Perreault, et al.       Expires December 20, 2012               [Page 3]
Internet-Draft                 NEW NAT MIB                     June 2012

3.  Definitions

   This MIB module IMPORTs objects from [RFC2578], [RFC2579], and
   [RFC4001].

NEW-NAT-MIB DEFINITIONS ::= BEGIN

IMPORTS
    MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, Counter64, Gauge32,
    Integer32, Unsigned32, mib-2
        FROM SNMPv2-SMI

    OBJECT-GROUP, NOTIFICATION-GROUP, MODULE-COMPLIANCE
        FROM SNMPv2-CONF

    TEXTUAL-CONVENTION
        FROM SNMPv2-TC

    InetAddressType, InetAddress, InetAddressPrefixLength,
    InetPortNumber
        FROM INET-ADDRESS-MIB;

newNatMIB MODULE-IDENTITY
    LAST-UPDATED "200001010000Z"
    ORGANIZATION "TBD"
    CONTACT-INFO "TBD"
    DESCRIPTION
        "This MIB module defines generic managed objects for NAT."

    REVISION "200001010000Z"
    DESCRIPTION
        "Dummy version. RFC Editor must replace this."

    ::= { mib-2 9999 }

-- table of contents

newNatNotifications     OBJECT IDENTIFIER ::= { newNatMIB 0 }
newNatObjects           OBJECT IDENTIFIER ::= { newNatMIB 1 }
    newNatCounters      OBJECT IDENTIFIER ::= { newNatObjects 1 }
    newNatLimits        OBJECT IDENTIFIER ::= { newNatObjects 2 }
    newNatPoolObjects   OBJECT IDENTIFIER ::= { newNatObjects 3 }
    newNatMapObjects    OBJECT IDENTIFIER ::= { newNatObjects 4 }
    newNatSubscribers   OBJECT IDENTIFIER ::= { newNatObjects 5 }
newNatConformance       OBJECT IDENTIFIER ::= { newNatMIB 2 }
    newNatGroups        OBJECT IDENTIFIER ::= { newNatConformance 1 }
    newNatCompliance    OBJECT IDENTIFIER ::= { newNatConformance 2 }

Perreault, et al.       Expires December 20, 2012               [Page 4]
Internet-Draft                 NEW NAT MIB                     June 2012

-- textual conventions

ProtocolNumber ::= TEXTUAL-CONVENTION
    DISPLAY-HINT "d"
    STATUS current
    DESCRIPTION
        "A transport protocol number, from the 'protocol-numbers' IANA
         registry."
    SYNTAX Unsigned32 (0..255)

NatPoolIndex ::= TEXTUAL-CONVENTION
    DISPLAY-HINT "d"
    STATUS current
    DESCRIPTION
        "A unique ID that is assigned to each pool."
    SYNTAX Unsigned32 (1..4294967295)

-- notifications

newNatNotifPoolWatermarkLow NOTIFICATION-TYPE
    OBJECTS { newNatPoolIndex }
    STATUS current
    DESCRIPTION
        "This notification is generated when the specified pool's number
         of free addresses becomes lower than or equal to the specified
         threshold. The threshold is specified by the
         newNatPoolWatermarkLow object"
    ::= { newNatNotifications 1 }

newNatNotifPoolWatermarkHigh NOTIFICATION-TYPE
    OBJECTS { newNatPoolIndex }
    STATUS current
    DESCRIPTION
        "This notification is generated when the specified pool's number
         of free addresses becomes greater than or equal to the
         specified threshold. The threshold is specified by the
         newNatPoolWatermarkHigh object"
    ::= { newNatNotifications 2 }

newNatNotifMappings NOTIFICATION-TYPE
    OBJECTS { newNatCntMappings }
    STATUS current
    DESCRIPTION
        "This notification is generated when newNatCntMappings exceeds
         the value of newNatMappingsNotifyThreshold."
    ::= { newNatNotifications 3 }

Perreault, et al.       Expires December 20, 2012               [Page 5]
Internet-Draft                 NEW NAT MIB                     June 2012

newNatNotifAddrMappings NOTIFICATION-TYPE
    OBJECTS { newNatCntAddressMappings }
    STATUS current
    DESCRIPTION
        "This notification is generated when newNatCntAddressMappings
         exceeds the value of newNatAddrMapNotifyThreshold."
    ::= { newNatNotifications 4 }

newNatNotifSubscriberMappings NOTIFICATION-TYPE
    OBJECTS { newNatSubscriberCntMappings }
    STATUS current
    DESCRIPTION
        "This notification is generated when newNatSubscriberCntMappings
         exceeds the value of newNatSubscriberMapNotifyThresh, unless
         newNatSubscriberMapNotifyThresh is zero.."
    ::= { newNatNotifications 5 }

-- counters

newNatCntTranslates OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets to which NAT has been applied."
    ::= { newNatCounters 1 }

newNatCntOOP OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets to which NAT could not be applied because
         no external port was available, excluding quota limitations."
    ::= { newNatCounters 2 }

newNatCntResource OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets to which NAT could not be applied because
         of resource constraints (excluding out-of-ports condition)."
    ::= { newNatCounters 3 }

newNatCntStateMismatch OBJECT-TYPE
    SYNTAX Counter64

Perreault, et al.       Expires December 20, 2012               [Page 6]
Internet-Draft                 NEW NAT MIB                     June 2012

    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets to which NAT could not be applied because
         of mapping state mismatch. For example, a TCP packet that
         matches an existing mapping but is dropped because its flags
         are incompatible with the current state of the mapping would
         cause this counter to be incremented."
    ::= { newNatCounters 4 }

newNatCntQuota OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets to which NAT could not be applied because
         of quota limitations. Quotas include absolute limits as well as
         limits on rate of allocation."
    ::= { newNatCounters 5 }

newNatCntMappings OBJECT-TYPE
    SYNTAX Gauge32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of currently active mappings.

         Equal to newNatCntMapRemovals - newNatCntMapCreations."
    ::= { newNatCounters 6 }

newNatCntMapCreations OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of mapping creations. This includes static mappings."
    ::= { newNatCounters 7 }

newNatCntMapRemovals OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of mapping removals. This includes static mappings."
    ::= { newNatCounters 8 }

newNatCntAddressMappings OBJECT-TYPE
    SYNTAX Gauge32

Perreault, et al.       Expires December 20, 2012               [Page 7]
Internet-Draft                 NEW NAT MIB                     June 2012

    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of active address mappings.

         Equal to newNatCntAddrMapRemovals - newNatCntAddrMapCreations."
    ::= { newNatCounters 9 }

newNatCntAddrMapCreations OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of address mapping creations. This includes static
         mappings."
    ::= { newNatCounters 10 }

newNatCntAddrMapRemovals OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of address mapping removals. This includes static
         mappings."
    ::= { newNatCounters 11 }

newNatCntProtocolTable OBJECT-TYPE
    SYNTAX SEQUENCE OF NewNatCntProtocolEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Table of protocols with per-protocol counters."
    ::= { newNatCounters 128 }

newNatCntProtocolEntry OBJECT-TYPE
    SYNTAX NewNatCntProtocolEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Per-protocol counters."
    INDEX { newNatCntProtocolNumber }
    ::= { newNatCntProtocolTable 1 }

NewNatCntProtocolEntry ::=
    SEQUENCE {
        newNatCntProtocolNumber         ProtocolNumber,
        newNatCntProtocolTranslates     Counter64,
        newNatCntProtocolOOP            Counter64,

Perreault, et al.       Expires December 20, 2012               [Page 8]
Internet-Draft                 NEW NAT MIB                     June 2012

        newNatCntProtocolResource       Counter64,
        newNatCntProtocolStateMismatch  Counter64,
        newNatCntProtocolQuota          Counter64,
        newNatCntProtocolMappings       Gauge32,
        newNatCntProtocolMapCreations   Counter64,
        newNatCntProtocolMapRemovals    Counter64
    }

newNatCntProtocolNumber OBJECT-TYPE
    SYNTAX ProtocolNumber
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Counters in this conceptual row apply to packets using the
         transport protocol identified by this object's value."
    ::= { newNatCntProtocolEntry 1 }

newNatCntProtocolTranslates OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets to which NAT has been applied."
    ::= { newNatCntProtocolEntry 2 }

newNatCntProtocolOOP OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets to which NAT could not be applied because
         no external port was available."
    ::= { newNatCntProtocolEntry 3 }

newNatCntProtocolResource OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets to which NAT could not be applied because
         of resource constraints (excluding out-of-ports condition)."
    ::= { newNatCntProtocolEntry 4 }

newNatCntProtocolStateMismatch OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION

Perreault, et al.       Expires December 20, 2012               [Page 9]
Internet-Draft                 NEW NAT MIB                     June 2012

        "The number of packets to which NAT could not be applied because
         of state table mismatch. For example, a TCP packet that matches
         an existing mapping but is dropped because its flags are
         incompatible with the current state of the mapping would cause
         this counter to be incremented."
    ::= { newNatCntProtocolEntry 5 }

newNatCntProtocolQuota OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets to which NAT could not be applied because
         of exceeded quotas. Quotas include absolute limits as well as
         limits on rate of allocation."
    ::= { newNatCntProtocolEntry 6 }

newNatCntProtocolMappings OBJECT-TYPE
    SYNTAX Gauge32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of active mappings.

         Equal to newNatCntMapRemovals - newNatCntMapCreations."
    ::= { newNatCntProtocolEntry 7 }

newNatCntProtocolMapCreations OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of mapping creations. This includes static mappings."
    ::= { newNatCntProtocolEntry 8 }

newNatCntProtocolMapRemovals OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of mapping removals. This includes statis mappings."
    ::= { newNatCntProtocolEntry 9 }

-- limits

newNatLimitMappings OBJECT-TYPE
    SYNTAX Unsigned32

Perreault, et al.       Expires December 20, 2012              [Page 10]
Internet-Draft                 NEW NAT MIB                     June 2012

    MAX-ACCESS read-write
    STATUS current
    DESCRIPTION
        "Global limit on the total number of mappings. Zero means
         unlimited."
    ::= { newNatLimits 1 }
-- TODO: How does that work with bulk port allocation?

newNatMappingsNotifyThreshold OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-write
    STATUS current
    DESCRIPTION
        "See newNatNotifMappings."
    ::= { newNatLimits 2 }

newNatLimitAddressMappings OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-write
    STATUS current
    DESCRIPTION
        "Global limit on the total number of internal-to-external
         address mappings.  Zero means unlimited.

         This limit is only applicable to NATs that have an 'IP address
         pooling' behavior of 'Paired' [RFC4787]."
    ::= { newNatLimits 3 }

newNatAddrMapNotifyThreshold OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-write
    STATUS current
    DESCRIPTION
        "See newNatNotifAddrMappings."
    ::= { newNatLimits 4 }

newNatLimitFragments OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-write
    STATUS current
    DESCRIPTION
        "Global limit on the total number of fragments pending
         reassembly.  Zero means unlimited.

         This limit is only applicable to NATs having 'Receive
         Fragments Out of Order' behavior [RFC4787]."
    ::= { newNatLimits 5 }

Perreault, et al.       Expires December 20, 2012              [Page 11]
Internet-Draft                 NEW NAT MIB                     June 2012

newNatLimitSubscribers OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-write
    STATUS current
    DESCRIPTION
        "Global limit on the number of subscribers with active mappings.
         Zero means unlimited."
    ::= { newNatLimits 6 }

-- pools

newNatPoolTable OBJECT-TYPE
    SYNTAX SEQUENCE OF NewNatPoolEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Table of pools."
    ::= { newNatPoolObjects 1 }

newNatPoolEntry OBJECT-TYPE
    SYNTAX NewNatPoolEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Entry in the table of pools."
    INDEX { newNatPoolIndex }
    ::= { newNatPoolTable 1 }

NewNatPoolEntry ::=
    SEQUENCE {
        newNatPoolIndex         NatPoolIndex,
        newNatPoolUsage         Integer32,
        newNatPoolWatermarkLow  Integer32,
        newNatPoolWatermarkHigh Integer32,
        newNatPoolPortMin       InetPortNumber,
        newNatPoolPortMax       InetPortNumber
        -- TODO: virtual router ID, status, ref count, etc.
    }

newNatPoolIndex OBJECT-TYPE
    SYNTAX NatPoolIndex
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Index of an address pool."
    ::= { newNatPoolEntry 1 }

Perreault, et al.       Expires December 20, 2012              [Page 12]
Internet-Draft                 NEW NAT MIB                     June 2012

newNatPoolUsage OBJECT-TYPE
    SYNTAX Integer32 (0..100)
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Percentage of the pool's total number of external ports
         currently mapped."
    ::= { newNatPoolEntry 2 }

newNatPoolWatermarkLow OBJECT-TYPE
    SYNTAX Integer32 (-1|0..100)
    MAX-ACCESS read-create
    STATUS current
    DESCRIPTION
        "Low watermark on a pool's usage, in percentage of the total
         number of ports available. If set to -1, the watermark is
         disabled. Otherwise when newNatPoolUsage becomes lower than or
         equal to newNatPoolWatermarkLow, a notification is sent. The
         NAT may also start behaving in low usage mode (this is
         implementation-defined)."
    ::= { newNatPoolEntry 3 }

newNatPoolWatermarkHigh OBJECT-TYPE
    SYNTAX Integer32 (-1|0..100)
    MAX-ACCESS read-create
    STATUS current
    DESCRIPTION
        "High watermark on a pool's usage, in percentage of the total
         number of ports available. If set to -1, the watermark is
         disabled. Otherwise, when newNatPoolUsage becomes higher than
         or equal to newNatPoolWatermarkHigh, a notification is sent.
         The NAT may also start behaving in high usage mode (this is
         implementation-defined)."
    ::= { newNatPoolEntry 4 }

newNatPoolPortMin OBJECT-TYPE
    SYNTAX InetPortNumber
    MAX-ACCESS read-create
    STATUS current
    DESCRIPTION
        "Minimal port number to be allocated in this pool."
    ::= { newNatPoolEntry 5 }

newNatPoolPortMax OBJECT-TYPE
    SYNTAX InetPortNumber
    MAX-ACCESS read-create
    STATUS current
    DESCRIPTION

Perreault, et al.       Expires December 20, 2012              [Page 13]
Internet-Draft                 NEW NAT MIB                     June 2012

        "Maximal port number to be allocated in this pool."
    ::= { newNatPoolEntry 6 }

newNatPoolRangeTable OBJECT-TYPE
    SYNTAX SEQUENCE OF NewNatPoolRangeEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "This table contains address ranges used by pool entries."
    ::= { newNatPoolObjects 2 }

newNatPoolRangeEntry OBJECT-TYPE
    SYNTAX NewNatPoolRangeEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "NAT pool address range."
    INDEX { newNatPoolRangeType,
            newNatPoolRangeBegin }
    ::= { newNatPoolRangeTable 1 }

NewNatPoolRangeEntry ::=
    SEQUENCE {
        newNatPoolRangePoolIndex        NatPoolIndex,
        newNatPoolRangeType             InetAddressType,
        newNatPoolRangeBegin            InetAddress,
        newNatPoolRangeEnd              InetAddress,
        newNatPoolRangeAllocatedPorts   Gauge32
        -- TODO: the usual bookkeeping things
    }

newNatPoolRangePoolIndex OBJECT-TYPE
    SYNTAX NatPoolIndex
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Index of the address pool to which this address range belongs.
         See newNatPoolIndex."
    ::= { newNatPoolRangeEntry 1 }

newNatPoolRangeType OBJECT-TYPE
    SYNTAX InetAddressType
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "The address type of newNatPoolRangeBegin and
         newNatPoolRangeEnd."

Perreault, et al.       Expires December 20, 2012              [Page 14]
Internet-Draft                 NEW NAT MIB                     June 2012

    ::= { newNatPoolRangeEntry 2 }

newNatPoolRangeBegin OBJECT-TYPE
    SYNTAX InetAddress (SIZE (4|16))
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Lowest address included in this range."
    ::= { newNatPoolRangeEntry 3 }

newNatPoolRangeEnd OBJECT-TYPE
    SYNTAX InetAddress (SIZE (4|16))
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Highest address included in this range."
    ::= { newNatPoolRangeEntry 4 }

newNatPoolRangeAllocatedPorts OBJECT-TYPE
    SYNTAX Gauge32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of ports currently allocated on the addresses in this
         range."
    ::= { newNatPoolRangeEntry 5 }

-- indexed mapping tables

newNatMapIntAddrTable OBJECT-TYPE
    SYNTAX SEQUENCE OF NewNatMapIntAddrEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Table of mappings from internal to external address.

         This table is only applicable to NATs that have an 'IP address
         pooling' behavior of 'Paired' [RFC4787]."
    ::= { newNatMapObjects 1 }

newNatMapIntAddrEntry OBJECT-TYPE
    SYNTAX NewNatMapIntAddrEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Mapping from internal to external address."
    INDEX { newNatMapIntAddrType,

Perreault, et al.       Expires December 20, 2012              [Page 15]
Internet-Draft                 NEW NAT MIB                     June 2012

            newNatMapIntAddrInt }
    ::= { newNatMapIntAddrTable 1 }

NewNatMapIntAddrEntry ::=
    SEQUENCE {
        newNatMapIntAddrType    InetAddressType,
        newNatMapIntAddrInt     InetAddress,
        newNatMapIntAddrExt     InetAddress
    }

newNatMapIntAddrType OBJECT-TYPE
    SYNTAX InetAddressType
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Address type for newNatMapIntAddrInt and newNatMapIntAddrExt."
    ::= { newNatMapIntAddrEntry 1 }

newNatMapIntAddrInt OBJECT-TYPE
    SYNTAX InetAddress (SIZE (4|16))
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Internal address."
    ::= { newNatMapIntAddrEntry 2 }

newNatMapIntAddrExt OBJECT-TYPE
    SYNTAX InetAddress
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "External address."
    ::= { newNatMapIntAddrEntry 3 }

newNatMappingTable OBJECT-TYPE
    SYNTAX SEQUENCE OF NewNatMappingTableEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Table of mappings indexed by external 3-tuple."
    ::= { newNatMapObjects 2 }

newNatMappingTableEntry OBJECT-TYPE
    SYNTAX NewNatMappingTableEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "A single NAT mapping."

Perreault, et al.       Expires December 20, 2012              [Page 16]
Internet-Draft                 NEW NAT MIB                     June 2012

    INDEX { newNatMappingProto,
            newNatMappingExtAddressType,
            newNatMappingExtAddress,
            newNatMappingExtPort }
    ::= { newNatMappingTable 1 }

NewNatMappingTableEntry ::=
    SEQUENCE {
        newNatMappingProto          ProtocolNumber,
        newNatMappingExtAddressType InetAddressType,
        newNatMappingExtAddress     InetAddress,
        newNatMappingExtPort        InetPortNumber,
        newNatMappingIntAddressType InetAddressType,
        newNatMappingIntAddress     InetAddress,
        newNatMappingIntPort        InetPortNumber,
        newNatMappingPool           NatPoolIndex
    }

newNatMappingProto OBJECT-TYPE
    SYNTAX ProtocolNumber
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "The mapping's transport protocol number."
    ::= { newNatMappingTableEntry 1 }

newNatMappingExtAddressType OBJECT-TYPE
    SYNTAX InetAddressType
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Type of the mapping's external address."
    ::= { newNatMappingTableEntry 2 }

newNatMappingExtAddress OBJECT-TYPE
    SYNTAX InetAddress (SIZE (4|16))
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "The mapping's external address. If this is the undefined
         address, all external addresses are mapped to the internal
         address."
    ::= { newNatMappingTableEntry 3 }

newNatMappingExtPort OBJECT-TYPE
    SYNTAX InetPortNumber
    MAX-ACCESS not-accessible
    STATUS current

Perreault, et al.       Expires December 20, 2012              [Page 17]
Internet-Draft                 NEW NAT MIB                     June 2012

    DESCRIPTION
        "The mapping's external port number. If this is zero, all
         external ports are mapped to the internal port."
    ::= { newNatMappingTableEntry 4 }

newNatMappingIntAddressType OBJECT-TYPE
    SYNTAX InetAddressType
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Type of the mapping's internal address."
    ::= { newNatMappingTableEntry 5 }

newNatMappingIntAddress OBJECT-TYPE
    SYNTAX InetAddress
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The mapping's internal address. If this is the undefined
         address, addresses are not translated."
    ::= { newNatMappingTableEntry 6 }

newNatMappingIntPort OBJECT-TYPE
    SYNTAX InetPortNumber
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The mapping's internal port number. If this is zero, ports are
         not translated."
    ::= { newNatMappingTableEntry 7 }

newNatMappingPool OBJECT-TYPE
    SYNTAX NatPoolIndex (0|1..4294967295)
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Index of the pool that contains this mapping's external address
         and port. If zero, no pool is associated with this mapping."
    ::= { newNatMappingTableEntry 8 }

-- subscribers

newNatSubscribersTable OBJECT-TYPE
    SYNTAX SEQUENCE OF NewNatSubscribersTableEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION

Perreault, et al.       Expires December 20, 2012              [Page 18]
Internet-Draft                 NEW NAT MIB                     June 2012

        "Table of CGN subscribers."
    ::= { newNatSubscribers 1 }

newNatSubscribersTableEntry OBJECT-TYPE
    SYNTAX NewNatSubscribersTableEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Each entry describes a single CGN subscriber."
    INDEX { newNatSubscriberIdentifierType,
            newNatSubscriberIdentifier }
    ::= { newNatSubscribersTable 1 }

NewNatSubscribersTableEntry ::=
    SEQUENCE {
        newNatSubscriberIdentifierType      InetAddressType,
        newNatSubscriberIdentifier          InetAddress,
        newNatSubscriberIntPrefixType       InetAddressType,
        newNatSubscriberIntPrefix           InetAddress,
        newNatSubscriberIntPrefixLength     InetAddressPrefixLength,
        newNatSubscriberPool                NatPoolIndex,
        newNatSubscriberCntTranslates       Counter64,
        newNatSubscriberCntOOP              Counter64,
        newNatSubscriberCntResource         Counter64,
        newNatSubscriberCntStateMismatch    Counter64,
        newNatSubscriberCntQuota            Counter64,
        newNatSubscriberCntMappings         Gauge32,
        newNatSubscriberCntMapCreations     Counter64,
        newNatSubscriberCntMapRemovals      Counter64,
        newNatSubscriberLimitMappings       Unsigned32,
        newNatSubscriberMapNotifyThresh     Unsigned32
    }

newNatSubscriberIdentifierType OBJECT-TYPE
    SYNTAX InetAddressType
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Address type of the subscriber identifier."
    ::= { newNatSubscribersTableEntry 1 }

newNatSubscriberIdentifier OBJECT-TYPE
    SYNTAX InetAddress (SIZE (4|16))
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Address used for uniquely identifying the subscriber.

Perreault, et al.       Expires December 20, 2012              [Page 19]
Internet-Draft                 NEW NAT MIB                     June 2012

         In traditional NAT, this is the internal address assigned to
         the CPE. In case an address range is assigned to a subscriber,
         the first address in the range is used as identifier. For
         tunnelled connectivity (e.g., DS-Lite [RFC6333]), the outer
         address is used as identifier (i.e., the IPv6 address in the
         case of DS-Lite)."
    ::= { newNatSubscribersTableEntry 2 }

newNatSubscriberIntPrefixType OBJECT-TYPE
    SYNTAX InetAddressType
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Subscriber's internal prefix type."
    ::= { newNatSubscribersTableEntry 3 }

newNatSubscriberIntPrefix OBJECT-TYPE
    SYNTAX InetAddress
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Prefix assigned to a subscriber's CPE."
    ::= { newNatSubscribersTableEntry 4 }

newNatSubscriberIntPrefixLength OBJECT-TYPE
    SYNTAX InetAddressPrefixLength
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Length of the prefix assigned to a subscriber's CPE, in bits.
         In case a single address is assigned, this will be 32 for IPv4
         and 128 for IPv6."
    ::= { newNatSubscribersTableEntry 5 }

newNatSubscriberPool OBJECT-TYPE
    SYNTAX NatPoolIndex
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "External address pool to which this subscriber belongs."
    ::= { newNatSubscribersTableEntry 6 }

newNatSubscriberCntTranslates OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets received from or sent to this subscriber

Perreault, et al.       Expires December 20, 2012              [Page 20]
Internet-Draft                 NEW NAT MIB                     June 2012

         and to which NAT has been applied."
    ::= { newNatSubscribersTableEntry 7 }

newNatSubscriberCntOOP OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets received from this subscriber to which
         NAT could not be applied because no external port was
         available, excluding quota limitations."
    ::= { newNatSubscribersTableEntry 8 }

newNatSubscriberCntResource OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets received from this subscriber to which
         NAT could not be applied because of resource constraints
         (excluding out-of-ports condition)."
    ::= { newNatSubscribersTableEntry 9 }

newNatSubscriberCntStateMismatch OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets received from or destined to this
         subscriber to which NAT could not be applied because of mapping
         state mismatch. For example, a TCP packet that matches an
         existing mapping but is dropped because its flags are
         incompatible with the current state of the mapping would cause
         this counter to be incremented."
    ::= { newNatSubscribersTableEntry 10 }

newNatSubscriberCntQuota OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "The number of packets received from or destined to this
         subscriber to which NAT could not be applied because of quota
         limitations. Quotas include absolute limits as well as limits
         on the rate of allocation."
    ::= { newNatSubscribersTableEntry 11 }

newNatSubscriberCntMappings OBJECT-TYPE

Perreault, et al.       Expires December 20, 2012              [Page 21]
Internet-Draft                 NEW NAT MIB                     June 2012

    SYNTAX Gauge32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of currently active mappings created by or for this
         subscriber.

         Equal to newNatSubscriberCntMapRemovals -
         newNatSubscriberCntMapCreations."
    ::= { newNatSubscribersTableEntry 12 }

newNatSubscriberCntMapCreations OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of mappings created by or for this subscriber."
    ::= { newNatSubscribersTableEntry 13 }

newNatSubscriberCntMapRemovals OBJECT-TYPE
    SYNTAX Counter64
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of mappings removed by or for this subscriber."
    ::= { newNatSubscribersTableEntry 14 }

newNatSubscriberLimitMappings OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-write
    STATUS current
    DESCRIPTION
        "Limit on the number of active mappings created by or for this
         subscriber. Zero means unlimited."
    ::= { newNatSubscribersTableEntry 15 }

newNatSubscriberMapNotifyThresh OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-write
    STATUS current
    DESCRIPTION
        "See newNatNotifSubscriberMappings."
    ::= { newNatSubscribersTableEntry 16 }

-- conformance groups

newNatGroupBasicObjects OBJECT-GROUP

Perreault, et al.       Expires December 20, 2012              [Page 22]
Internet-Draft                 NEW NAT MIB                     June 2012

    OBJECTS { newNatCntTranslates,
              newNatCntOOP,
              newNatCntResource,
              newNatCntStateMismatch,
              newNatCntQuota,
              newNatCntMappings,
              newNatCntMapCreations,
              newNatCntMapRemovals,
              newNatCntProtocolTranslates,
              newNatCntProtocolOOP,
              newNatCntProtocolResource,
              newNatCntProtocolStateMismatch,
              newNatCntProtocolQuota,
              newNatCntProtocolMappings,
              newNatCntProtocolMapCreations,
              newNatCntProtocolMapRemovals,
              newNatLimitMappings,
              newNatMappingsNotifyThreshold,
              newNatPoolIndex,
              newNatPoolUsage,
              newNatPoolWatermarkLow,
              newNatPoolWatermarkHigh,
              newNatPoolPortMin,
              newNatPoolPortMax,
              newNatPoolRangePoolIndex,
              newNatPoolRangeEnd,
              newNatPoolRangeAllocatedPorts,
              newNatMappingIntAddressType,
              newNatMappingIntAddress,
              newNatMappingIntPort,
              newNatMappingPool }
    STATUS current
    DESCRIPTION
        "Basic counters, limits, and thresholds."
    ::= { newNatGroups 1 }

newNatGroupAddrMapObjects OBJECT-GROUP
    OBJECTS { newNatCntAddressMappings,
              newNatCntAddrMapCreations,
              newNatCntAddrMapRemovals,
              newNatLimitAddressMappings,
              newNatAddrMapNotifyThreshold,
              newNatMapIntAddrExt }
    STATUS current
    DESCRIPTION
        "Objects that require 'Paired IP address pooling' behavior
         [RFC4787]."
    ::= { newNatGroups 2 }

Perreault, et al.       Expires December 20, 2012              [Page 23]
Internet-Draft                 NEW NAT MIB                     June 2012

newNatGroupFragmentObjects OBJECT-GROUP
    OBJECTS { newNatLimitFragments }
    STATUS current
    DESCRIPTION
        "Objects that require 'Receive Fragments Out of Order' behavior
         [RFC4787]."
    ::= { newNatGroups 3 }

newNatGroupSubscriberObjects OBJECT-GROUP
    OBJECTS { newNatSubscriberIntPrefixType,
              newNatSubscriberIntPrefix,
              newNatSubscriberIntPrefixLength,
              newNatSubscriberPool,
              newNatSubscriberCntTranslates,
              newNatSubscriberCntOOP,
              newNatSubscriberCntResource,
              newNatSubscriberCntStateMismatch,
              newNatSubscriberCntQuota,
              newNatSubscriberCntMappings,
              newNatSubscriberCntMapCreations,
              newNatSubscriberCntMapRemovals,
              newNatSubscriberLimitMappings,
              newNatSubscriberMapNotifyThresh,
              newNatLimitSubscribers }
    STATUS current
    DESCRIPTION
        "Per-subscriber counters, limits, and thresholds."
    ::= { newNatGroups 4 }

newNatGroupBasicNotifications NOTIFICATION-GROUP
    NOTIFICATIONS { newNatNotifPoolWatermarkLow,
                    newNatNotifPoolWatermarkHigh,
                    newNatNotifMappings }
    STATUS current
    DESCRIPTION
        "Basic notifications."
    ::= { newNatGroups 5 }

newNatGroupAddrMapNotifications NOTIFICATION-GROUP
    NOTIFICATIONS { newNatNotifAddrMappings }
    STATUS current
    DESCRIPTION
        "Notifications about address mappings."
    ::= { newNatGroups 6 }

newNatGroupSubscriberNotifs NOTIFICATION-GROUP
    NOTIFICATIONS { newNatNotifSubscriberMappings }
    STATUS current

Perreault, et al.       Expires December 20, 2012              [Page 24]
Internet-Draft                 NEW NAT MIB                     June 2012

    DESCRIPTION
        "Notifications about subscribers."
    ::= { newNatGroups 7 }

-- compliance statements

newNatBasicCompliance MODULE-COMPLIANCE
    STATUS current
    DESCRIPTION
        "Basic compliance with this MIB is attained when the objects
         contained in the mandatory groups are implemented."
    MODULE  -- this module
        MANDATORY-GROUPS { newNatGroupBasicObjects,
                           newNatGroupBasicNotifications }
    ::= { newNatCompliance 1 }

newNatAddrMapCompliance MODULE-COMPLIANCE
    STATUS current
    DESCRIPTION
        "NATs that have 'Paired IP address pooling' behavior [RFC4787]
         and implement the objects in this group can claim this level of
         compliance."
    MODULE  -- this module
        MANDATORY-GROUPS { newNatGroupBasicObjects,
                           newNatGroupBasicNotifications,
                           newNatGroupAddrMapObjects,
                           newNatGroupAddrMapNotifications }
    ::= { newNatCompliance 2 }

newNatFragmentsCompliance MODULE-COMPLIANCE
    STATUS current
    DESCRIPTION
        "NATs that have 'Receive Fragments Out of Order' behavior
         [RFC4787] and implement the objects in this group can claim
         this level of compliance."
    MODULE  -- this module
        MANDATORY-GROUPS { newNatGroupBasicObjects,
                           newNatGroupBasicNotifications,
                           newNatGroupFragmentObjects }
    ::= { newNatCompliance 3 }

newNatCGNCompliance MODULE-COMPLIANCE
    STATUS current
    DESCRIPTION
        "NATs that have 'Paired IP address pooling' and 'Receive
         Fragments Out of Order' behavior [RFC4787] and implement the
         objects in this group can claim this level of compliance.

Perreault, et al.       Expires December 20, 2012              [Page 25]
Internet-Draft                 NEW NAT MIB                     June 2012

         This level of compliance is to be expected of a CGN compliant
         with [I-D.ietf-behave-lsn-requiremnents]."
    MODULE  -- this module
        MANDATORY-GROUPS { newNatGroupBasicObjects,
                           newNatGroupBasicNotifications,
                           newNatGroupAddrMapObjects,
                           newNatGroupAddrMapNotifications,
                           newNatGroupFragmentObjects,
                           newNatGroupSubscriberObjects,
                           newNatGroupSubscriberNotifs }
    ::= { newNatCompliance 4 }

END

4.  Security Considerations

   TBD

5.  IANA Considerations

   TBD

6.  References

6.1.  Normative References

   [RFC2578]  McCloghrie, K., Ed., Perkins, D., Ed., and J.
              Schoenwaelder, Ed., "Structure of Management Information
              Version 2 (SMIv2)", STD 58, RFC 2578, April 1999.

   [RFC2579]  McCloghrie, K., Ed., Perkins, D., Ed., and J.
              Schoenwaelder, Ed., "Textual Conventions for SMIv2",
              STD 58, RFC 2579, April 1999.

   [RFC4001]  Daniele, M., Haberman, B., Routhier, S., and J.
              Schoenwaelder, "Textual Conventions for Internet Network
              Addresses", RFC 4001, February 2005.

   [RFC4787]  Audet, F. and C. Jennings, "Network Address Translation
              (NAT) Behavioral Requirements for Unicast UDP", BCP 127,
              RFC 4787, January 2007.

Perreault, et al.       Expires December 20, 2012              [Page 26]
Internet-Draft                 NEW NAT MIB                     June 2012

6.2.  Informative References

   [RFC4008]  Rohit, R., Srisuresh, P., Raghunarayan, R., Pai, N., and
              C. Wang, "Definitions of Managed Objects for Network
              Address Translators (NAT)", RFC 4008, March 2005.

Appendix A.  Change Log (to be removed by RFC Editor prior to
             publication)

A.1.  Changed in -01

   o  Added CGN stuff (per-subscriber quotas, counters, notifications).

   o  Added conformance groups and compliance statements.

   o  Added mapping table indexed by external 3-tuple.

Authors' Addresses

   Simon Perreault
   Viagenie
   246 Aberdeen
   Quebec, QC  G1R 2E1
   Canada

   Phone: +1 418 656 9254
   Email: simon.perreault@viagenie.ca
   URI:   http://viagenie.ca

   Tina Tsou
   Huawei Technologies (USA)
   2330 Central Expressway
   Santa Clara, CA  95050
   USA

   Phone: +1 408 330 4424
   Email: tina.tsou.zouting@huawei.com

Perreault, et al.       Expires December 20, 2012              [Page 27]
Internet-Draft                 NEW NAT MIB                     June 2012

   Senthil Sivakumar
   Cisco Systems
   7100-8 Kit Creek Road
   Research Triangle Park, North Carolina  27709
   USA

   Phone: +1 919 392 5158
   Email: ssenthil@cisco.com

Perreault, et al.       Expires December 20, 2012              [Page 28]