draft-perrault-behave-natv2-mib-05.txt   rfc7659.txt 
Network Working Group S. Perreault Internet Engineering Task Force (IETF) S. Perreault
Internet-Draft Jive Communications Request for Comments: 7659 Jive Communications
Intended status: Standards Track T. Tsou Category: Standards Track T. Tsou
Expires: December 18, 2015 Huawei Technologies ISSN: 2070-1721 Huawei Technologies
S. Sivakumar S. Sivakumar
Cisco Systems Cisco Systems
T. Taylor T. Taylor
PT Taylor Consulting PT Taylor Consulting
June 16, 2015 October 2015
Definitions of Managed Objects for Network Address Translators (NAT) Definitions of Managed Objects for Network Address Translators (NATs)
draft-perrault-behave-natv2-mib-05
Abstract Abstract
This memo defines a portion of the Management Information Base (MIB) This memo defines a portion of the Management Information Base (MIB)
for devices implementing the Network Address Translator (NAT) for devices implementing the Network Address Translator (NAT)
function. The new MIB module defined in this document, NATV2-MIB, is function. The new MIB module defined in this document, NATV2-MIB, is
intended to replace module NAT-MIB (RFC 4008). NATV2-MIB is not intended to replace module NAT-MIB (RFC 4008). NATV2-MIB is not
backwards compatible with NAT-MIB, for reasons given in the text of backwards compatible with NAT-MIB, for reasons given in the text of
this document. A companion document deprecates all objects in NAT- this document. A companion document deprecates all objects in NAT-
MIB. NATV2-MIB can be used for monitoring of NAT instances on a MIB. NATV2-MIB can be used for the monitoring of NAT instances on a
device capable of NAT function. Compliance levels are defined for device capable of NAT function. Compliance levels are defined for
three application scenarios: basic NAT, pooled NAT, and carrier-grade three application scenarios: basic NAT, pooled NAT, and
NAT (CGN). carrier-grade NAT (CGN).
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This is an Internet Standards Track document.
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months This document is a product of the Internet Engineering Task Force
and may be updated, replaced, or obsoleted by other documents at any (IETF). It represents the consensus of the IETF community. It has
time. It is inappropriate to use Internet-Drafts as reference received public review and has been approved for publication by the
material or to cite them other than as "work in progress." Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 5741.
This Internet-Draft will expire on December 18, 2015. Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc7659.
Copyright Notice Copyright Notice
Copyright (c) 2015 IETF Trust and the persons identified as the Copyright (c) 2015 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. The SNMP Management Framework . . . . . . . . . . . . . . . . 3 1. The Internet-Standard Management Framework . . . . . . . . . 3
2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 5 3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 5
3.1. Content Provided by the NATV2-MIB Module . . . . . . . . 5 3.1. Content Provided by the NATV2-MIB Module . . . . . . . . 5
3.1.1. Configuration Data . . . . . . . . . . . . . . . . . 5 3.1.1. Configuration Data . . . . . . . . . . . . . . . . . 5
3.1.2. Notifications . . . . . . . . . . . . . . . . . . . . 6 3.1.2. Notifications . . . . . . . . . . . . . . . . . . . . 6
3.1.3. State Information . . . . . . . . . . . . . . . . . . 9 3.1.3. State Information . . . . . . . . . . . . . . . . . . 9
3.1.4. Statistics . . . . . . . . . . . . . . . . . . . . . 9 3.1.4. Statistics . . . . . . . . . . . . . . . . . . . . . 9
3.2. Outline of MIB Module Organization . . . . . . . . . . . 11 3.2. Outline of MIB Module Organization . . . . . . . . . . . 12
3.3. Detailed MIB Module Walk-Through . . . . . . . . . . . . 13 3.3. Detailed MIB Module Walk-Through . . . . . . . . . . . . 13
3.3.1. Textual Conventions . . . . . . . . . . . . . . . . . 13 3.3.1. Textual Conventions . . . . . . . . . . . . . . . . . 13
3.3.2. Notifications . . . . . . . . . . . . . . . . . . . . 13 3.3.2. Notifications . . . . . . . . . . . . . . . . . . . . 14
3.3.3. The Subscriber Table: natv2SubscriberTable . . . . . 13 3.3.3. The Subscriber Table: natv2SubscriberTable . . . . . 14
3.3.4. The Instance Table: natv2InstanceTable . . . . . . . 14 3.3.4. The Instance Table: natv2InstanceTable . . . . . . . 15
3.3.5. The Protocol Table: natv2ProtocolTable . . . . . . . 15 3.3.5. The Protocol Table: natv2ProtocolTable . . . . . . . 15
3.3.6. The Address Pool Table: natv2PoolTable . . . . . . . 15 3.3.6. The Address Pool Table: natv2PoolTable . . . . . . . 16
3.3.7. The Address Pool Address Range Table: 3.3.7. The Address Pool Address Range Table:
natv2PoolRangeTable . . . . . . . . . . . . . . . . . 16 natv2PoolRangeTable . . . . . . . . . . . . . . . . . 17
3.3.8. The Address Map Table: natv2AddressMapTable . . . . . 16 3.3.8. The Address Map Table: natv2AddressMapTable . . . . . 17
3.3.9. The Port Map Table: natv2PortMapTable . . . . . . . . 17 3.3.9. The Port Map Table: natv2PortMapTable . . . . . . . . 17
3.4. Conformance: Three Application Scenarios . . . . . . . . 17 3.4. Conformance: Three Application Scenarios . . . . . . . . 18
4. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 18 4. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 19
5. Operational and Management Considerations . . . . . . . . . . 74 5. Operational and Management Considerations . . . . . . . . . . 74
5.1. Configuration Requirements . . . . . . . . . . . . . . . 74 5.1. Configuration Requirements . . . . . . . . . . . . . . . 74
5.2. Transition From and Coexistence With NAT-MIB [RFC 4008] 76 5.2. Transition from and Coexistence with NAT-MIB (RFC 4008) . 76
6. Security Considerations . . . . . . . . . . . . . . . . . . . 78 6. Security Considerations . . . . . . . . . . . . . . . . . . . 78
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 81 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 81
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 81 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 81
8.1. Normative References . . . . . . . . . . . . . . . . . . 81 8.1. Normative References . . . . . . . . . . . . . . . . . . 81
8.2. Informative References . . . . . . . . . . . . . . . . . 82 8.2. Informative References . . . . . . . . . . . . . . . . . 82
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 83 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 84
1. The SNMP Management Framework 1. The Internet-Standard Management Framework
For a detailed overview of the documents that describe the current For a detailed overview of the documents that describe the current
Internet-Standard Management Framework, please refer to section 7 of Internet-Standard Management Framework, please refer to section 7 of
RFC 3410 [RFC3410]. RFC 3410 [RFC3410].
Managed objects are accessed via a virtual information store, termed Managed objects are accessed via a virtual information store, termed
the Management Information Base or MIB. MIB objects are generally the Management Information Base or MIB. MIB objects are generally
accessed through the Simple Network Management Protocol (SNMP). accessed through the Simple Network Management Protocol (SNMP).
Objects in the MIB are defined using the mechanisms defined in the Objects in the MIB are defined using the mechanisms defined in the
Structure of Management Information (SMI). This memo specifies a MIB Structure of Management Information (SMI). This memo specifies a MIB
module that is compliant to the SMIv2, which is described in STD 58, module that is compliant to the SMIv2, which is described in STD 58,
[RFC2578], [RFC2579] and [RFC2580]. RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580
[RFC2580].
2. Introduction 2. Introduction
Note to RFC Ed.: please replace RFC yyyy with actual RFC number
throughout this document and remove this note.
This memo defines a portion of the Management Information Base (MIB) This memo defines a portion of the Management Information Base (MIB)
for devices implementing NAT functions. This MIB module, NATV2-MIB, for devices implementing NAT functions. This MIB module, NATV2-MIB,
may be used for monitoring of such devices. NATV2-MIB supersedes may be used for the monitoring of such devices. NATV2-MIB supersedes
NAT-MIB [RFC4008], which did not fit well with existing NAT NAT-MIB [RFC4008], which did not fit well with existing NAT
implementations, and hence was not itself much implemented. implementations, and hence was not itself much implemented.
[I-D.perrault-behave-deprecate-nat-mib-v1] provides a detailed [RFC7658] provides a detailed analysis of the deficiencies of
analysis of the deficiencies of NAT-MIB. NAT-MIB.
Relative to [RFC4008] and based on the analysis just mentioned, the Relative to [RFC4008] and based on the analysis just mentioned, the
present document introduces the following changes: present document introduces the following changes:
o removed all writable configuration except that related to control o removed all writable configuration except that related to control
of the generation of notifications and the setting of quotas on of the generation of notifications and the setting of quotas on
the use of NAT resources; the use of NAT resources;
o minimized the read-only exposure of configuration to what is o minimized the read-only exposure of configuration to what is
needed to provide context for the state and statistical needed to provide context for the state and statistical
information presented by the MIB module; information presented by the MIB module;
o removed the association between mapping and interfaces, retaining o removed the association between mapping and interfaces, retaining
only the mapping aspect; only the mapping aspect;
o replaced references to NAT types with references to NAT behaviors o replaced references to NAT types with references to NAT behaviors
as specified in [RFC4787]; as specified in [RFC4787];
o replaced a module-specific enumeration of protocols with the o replaced a module-specific enumeration of protocols with the
standard protocol numbers provided by the IANA Assigned Internet standard protocol numbers provided by the IANA Protocol Numbers
Protocol Numbers registry. registry.
This MIB module adds the following features not present in [RFC4008]: This MIB module adds the following features not present in [RFC4008]:
o additional writable protective limits on NAT state data; o additional writable protective limits on NAT state data;
o additional objects to report state, statistics, and notifications; o additional objects to report state, statistics, and notifications;
o support for the carrier grade NAT (CGN) application, including o support for the carrier-grade NAT (CGN) application, including
subscriber-awareness, support for an arbitrary number of address subscriber-awareness, support for an arbitrary number of address
realms, and support for multiple NAT instances running on a single realms, and support for multiple NAT instances running on a single
device; device;
o expanded support for address pools; o expanded support for address pools;
o revised indexing of port map entries to simplify traceback from o revised indexing of port map entries to simplify traceback from
externally observable packet parameters to the corresponding externally observable packet parameters to the corresponding
internal endpoint. internal endpoint.
skipping to change at page 4, line 35 skipping to change at page 4, line 35
o Section 3 provides a verbal description of the content and o Section 3 provides a verbal description of the content and
organization of the MIB module. organization of the MIB module.
o Section 4 provides the MIB module definition. o Section 4 provides the MIB module definition.
o Section 5 discusses operational and management issues relating to o Section 5 discusses operational and management issues relating to
the deployment of NATV2-MIB. One of these issues is NAT the deployment of NATV2-MIB. One of these issues is NAT
management when both NAT-MIB [RFC4008] and NATV2-MIB are deployed. management when both NAT-MIB [RFC4008] and NATV2-MIB are deployed.
o Section 6 and Section 7 provide a security discussion and a o Sections 6 and 7 provide a security discussion and a request to
request to IANA for allocation of an object identifier for the IANA for allocation of an object identifier for the module in the
module in the mib-2 tree, respectively. mib-2 tree, respectively.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in "OPTIONAL" in this document are to be interpreted as described in
[RFC2119]. [RFC2119].
This document uses the following terminology: This document uses the following terminology:
Upper layer protocol: The protocol following the outer IP header of Upper-layer protocol: The protocol following the outer IP header of
a packet. This follows the terminology of [RFC2460], but as that a packet. This follows the terminology of [RFC2460], but as that
document points out, "upper" is not necessarily a correct document points out, "upper" is not necessarily a correct
description of the protocol relationships (e.g., where IP is description of the protocol relationships (e.g., where IP is
encapsulated in IP). The abbreviated term "protocol" will often encapsulated in IP). The abbreviated term "protocol" will often
be used where it is unambiguous. be used where it is unambiguous.
Trigger: With respect to notifications, the logical recognition of Trigger: With respect to notifications, the logical recognition of
the event that the notification is intended to report. the event that the notification is intended to report.
Report: The actual production of a notification message. Reporting Report: The actual production of a notification message. Reporting
can happen later than triggering, or may never happen for a given can happen later than triggering, or may never happen for a given
notification instance, because of the operation of notification notification instance, because of the operation of notification
rate controls. rate controls.
Address realm: A network domain in which the network addresses are Address realm: A network domain in which the network addresses are
uniquely assigned to entities such that datagrams can be routed to uniquely assigned to entities such that datagrams can be routed to
them. (Definition taken from [RFC2663] Section 2.1.) The them. (Definition taken from [RFC2663], Section 2.1.) The
abbreviated term "realm" will often be used. abbreviated term "realm" will often be used.
3. Overview 3. Overview
This section provides a prose description of the contents and This section provides a prose description of the contents and
organization of the NATV2-MIB module. organization of the NATV2-MIB module.
3.1. Content Provided by the NATV2-MIB Module 3.1. Content Provided by the NATV2-MIB Module
The content provided by the NATV2-MIB module can be classed under The content provided by the NATV2-MIB module can be classed under
skipping to change at page 5, line 38 skipping to change at page 5, line 38
3.1.1. Configuration Data 3.1.1. Configuration Data
As mentioned above, the intent in designing the NATV2-MIB module was As mentioned above, the intent in designing the NATV2-MIB module was
to minimize the amount of configuration data presented to that needed to minimize the amount of configuration data presented to that needed
to give a context for interpreting the other types of information to give a context for interpreting the other types of information
provided. Detailed descriptions of the configuration data are provided. Detailed descriptions of the configuration data are
included with the descriptions of the individual tables. In general, included with the descriptions of the individual tables. In general,
that data is limited to what is needed for indexing and cross- that data is limited to what is needed for indexing and cross-
referencing between tables. The two exceptions are the objects referencing between tables. The two exceptions are the objects
describing NAT instance behavior in the NAT instance table, and the describing NAT instance behavior in the NAT instance table and the
detailed enumeration of resources allocated to each address pool in detailed enumeration of resources allocated to each address pool in
the pool table and its extension. the pool table and its extension.
The NATV2-MIB module provides three sets of read-write objects, The NATV2-MIB module provides three sets of read-write objects,
specifically related to other aspects of the module content. The specifically related to other aspects of the module content. The
first set controls the rate at which specific notifications are first set controls the rate at which specific notifications are
generated. The second set provides thresholds used to trigger the generated. The second set provides thresholds used to trigger the
notifications. These objects are listed in Section 3.1.2. notifications. These objects are listed in Section 3.1.2.
A third set of read-write objects sets limits on resource consumption A third set of read-write objects sets limits on resource consumption
per NAT instance and per subscriber. When these limits are reached, per NAT instance and per subscriber. When these limits are reached,
packets requiring further consumption of the given resource are packets requiring further consumption of the given resource are
dropped rather than translated. Statistics described in dropped rather than translated. Statistics described in
Section 3.1.4 record the numbers of packets so dropped. Limits are Section 3.1.4 record the numbers of packets dropped. Limits are
provided for: provided for:
o total number of address map entries over the NAT instance. Limit o total number of address map entries over the NAT instance. Limit
is set by object natv2InstanceLimitAddressMapEntries in table is set by object natv2InstanceLimitAddressMapEntries in table
natv2InstanceTable. Dropped packets are counted in natv2InstanceTable. Dropped packets are counted in
natv2InstanceAddressMapEntryLimitDrops in that table. natv2InstanceAddressMapEntryLimitDrops in that table.
o total number of port map entries over the NAT instance. Limit is o total number of port map entries over the NAT instance. Limit is
set by object natv2InstanceLimitPortMapEntries in table set by object natv2InstanceLimitPortMapEntries in table
natv2InstanceTable. Dropped packets are counted in natv2InstanceTable. Dropped packets are counted in
natv2InstancePortMapEntryLimitDrops in that table. natv2InstancePortMapEntryLimitDrops in that table.
o total number of held fragments (applicable only when the NAT o total number of held fragments (applicable only when the NAT
instance can receive fragments out of order; see [RFC4787] instance can receive fragments out of order; see [RFC4787],
Section 11). Limit is set by object Section 11). Limit is set by object
natv2InstanceLimitPendingFragments in table natv2InstanceTable. natv2InstanceLimitPendingFragments in table natv2InstanceTable.
Dropped packets are counted by natv2InstanceFragmentDrops in the Dropped packets are counted by natv2InstanceFragmentDrops in the
same table. same table.
o total number of active subscribers (i.e., subscribers having at o total number of active subscribers (i.e., subscribers having at
least one mapping table entry) over the NAT instance. Limit is least one mapping table entry) over the NAT instance. Limit is
set by object natv2InstanceLimitSubscriberActives in table set by object natv2InstanceLimitSubscriberActives in table
natv2InstanceTable. Dropped packets are counted by natv2InstanceTable. Dropped packets are counted by
natv2InstanceSubscriberActiveLimitDrops in the same table. natv2InstanceSubscriberActiveLimitDrops in the same table.
skipping to change at page 6, line 44 skipping to change at page 6, line 45
unlike in the instance table, the per-subscriber count is lumped unlike in the instance table, the per-subscriber count is lumped
in with the count of packets dropped because of failures to in with the count of packets dropped because of failures to
allocate a port map entry for other reasons to save on storage. allocate a port map entry for other reasons to save on storage.
3.1.2. Notifications 3.1.2. Notifications
NATV2-MIB provides five notifications, intended to provide warning of NATV2-MIB provides five notifications, intended to provide warning of
the need to provision or reallocate NAT resources. As indicated in the need to provision or reallocate NAT resources. As indicated in
the previous section, each notification is associated with two read- the previous section, each notification is associated with two read-
write objects: a control on the rate at which that notification is write objects: a control on the rate at which that notification is
generated, and a threshold value used to trigger the notification in generated and a threshold value used to trigger the notification in
the first place. The default setting within the MIB module the first place. The default setting within the MIB module
specification is that all notifications are disabled. The setting of specification is that all notifications are disabled. The setting of
threshold values is discussed in Section 5. threshold values is discussed in Section 5.
The five notifications are as follows: The five notifications are as follows:
o Two notifications relate to the management of address pools. One o Two notifications relate to the management of address pools. One
indicates that usage equals or exceeds an upper threshold, and is indicates that usage equals or exceeds an upper threshold and is
therefore a warning that the pool may be over-utilized unless more therefore a warning that the pool may be over-utilized unless more
addresses are assigned to it. The other notification indicates addresses are assigned to it. The other notification indicates
that usage equals or has fallen below a lower threshold, that usage equals or has fallen below a lower threshold,
suggesting that some addresses allocated to that pool could be suggesting that some addresses allocated to that pool could be
reallocated to other pools. Address pool usage is calculated as reallocated to other pools. Address pool usage is calculated as
the percentage of the total number of ports allocated to the the percentage of the total number of ports allocated to the
address pool that are already in use, for the most-mapped protocol address pool that are already in use, for the most-mapped protocol
at the time the notification is generated. The notifications at the time the notification is generated. The notifications
identify that protocol and report the number of port map entries identify that protocol and report the number of port map entries
for that protocol in the given address pool at the moment the for that protocol in the given address pool at the moment the
notification was triggered. notification was triggered.
o Two notifications relate to the number of address and port map o Two notifications relate to the number of address and port map
entries respectively, in total over the whole NAT instance. In entries, respectively, in total over the whole NAT instance. In
both cases the threshold that triggers the notification is an both cases, the threshold that triggers the notification is an
upper threshold. The notifications return the number of mapping upper threshold. The notifications return the number of mapping
entries of the given type, plus a cumulative counter of the number entries of the given type, plus a cumulative counter of the number
of entries created in that mapping table at the moment the of entries created in that mapping table at the moment the
notification was triggered. The intent is that the notifications notification was triggered. The intent is that the notifications
provide a warning that the total number of address or port map provide a warning that the total number of address or port map
entries is approaching the configured limit. entries is approaching the configured limit.
o The final notification is generated on a per-subscriber basis when o The final notification is generated on a per-subscriber basis when
the number of port map entries for that subscriber crosses the the number of port map entries for that subscriber crosses the
associated threshold. The objects returned by this notification associated threshold. The objects returned by this notification
are similar to those returned for the instance-level mapping are similar to those returned for the instance-level mapping
notifications. This notification is a warning that the number of notifications. This notification is a warning that the number of
port map entries for the subscriber is approaching the configured port map entries for the subscriber is approaching the configured
limit for that subscriber. limit for that subscriber.
Here is a detailed specification of the notifications. A given Here is a detailed specification of the notifications. A given
notification can be disabled by setting the threshold to 0 (default), notification can be disabled by setting the threshold to -1
with the exception noted below. (default).
Notification: natv2NotificationPoolUsageLow. Indicates that address Notification: natv2NotificationPoolUsageLow. Indicates that address
pool usage for the most-mapped protocol equals or is less than the pool usage for the most-mapped protocol equals or is less than the
threshold value. threshold value.
Compared value: natv2PoolNotifiedPortMapEntries as a percentage of Compared value: natv2PoolNotifiedPortMapEntries as a percentage of
total available ports in the pool. total available ports in the pool.
Threshold: natv2PoolThresholdUsageLow in natv2PoolTable. To allow Threshold: natv2PoolThresholdUsageLow in natv2PoolTable.
for a threshold of zero usage, disabling of the
natv2NotificationPoolUsageLow is done by setting
natv2PoolThresholdUsageLow to -1 rather than 0, in contrast to all
of the other notifications.
Objects returned: natv2PoolNotifiedPortMapEntries and Objects returned: natv2PoolNotifiedPortMapEntries and
natv2PoolNotifiedPortMapProtocol in natv2PoolTable; natv2PoolNotifiedPortMapProtocol in natv2PoolTable.
Rate control: natv2PoolNotificationInterval in natv2PoolTable. Rate control: natv2PoolNotificationInterval in natv2PoolTable.
Notification: natv2NotificationPoolUsageHigh. Indicates that address Notification: natv2NotificationPoolUsageHigh. Indicates that address
pool usage for the most-mapped protocol has risen to the threshold pool usage for the most-mapped protocol has risen to the threshold
value or more. value or more.
Compared value: natv2PoolNotifiedPortMapEntries as a percentage of Compared value: natv2PoolNotifiedPortMapEntries as a percentage of
total available ports in the pool. total available ports in the pool.
Threshold: natv2PoolThresholdUsageHigh in natv2PoolTable; Threshold: natv2PoolThresholdUsageHigh in natv2PoolTable.
Objects returned: natv2PoolNotifiedPortMapEntries, Objects returned: natv2PoolNotifiedPortMapEntries and
natv2PoolNotifiedPortMapProtocol in natv2PoolTable; natv2PoolNotifiedPortMapProtocol in natv2PoolTable.
Rate control: natv2PoolNotificationInterval in natv2PoolTable. Rate control: natv2PoolNotificationInterval in natv2PoolTable.
Notification: natv2NotificationInstanceAddressMapEntriesHigh. Notification: natv2NotificationInstanceAddressMapEntriesHigh.
Indicates that the total number of entries in the address map table Indicates that the total number of entries in the address map table
over the whole NAT instance equals or exceeds the threshold value. over the whole NAT instance equals or exceeds the threshold value.
Compared value: natv2InstanceAddressMapEntries in Compared value: natv2InstanceAddressMapEntries in
natv2InstanceTable; natv2InstanceTable.
Threshold: natv2InstanceThresholdAddressMapEntriesHigh in Threshold: natv2InstanceThresholdAddressMapEntriesHigh in
natv2InstanceTable; natv2InstanceTable.
Objects returned: natv2InstanceAddressMapEntries, Objects returned: natv2InstanceAddressMapEntries and
natv2InstanceAddressMapCreations in natv2InstanceTable; natv2InstanceAddressMapCreations in natv2InstanceTable.
Rate control: natv2InstanceNotificationInterval in Rate control: natv2InstanceNotificationInterval in
natv2InstanceTable. natv2InstanceTable.
Notification: natv2NotificationInstancePortMapEntriesHigh. Indicates Notification: natv2NotificationInstancePortMapEntriesHigh. Indicates
that the total number of entries in the port map table over the whole that the total number of entries in the port map table over the whole
NAT instance equals or exceeds the threshold value. NAT instance equals or exceeds the threshold value.
Compared value: natv2InstancePortMapEntries in natv2InstanceTable; Compared value: natv2InstancePortMapEntries in natv2InstanceTable.
Threshold: natv2InstanceThresholdPortMapEntriesHigh in Threshold: natv2InstanceThresholdPortMapEntriesHigh in
natv2InstanceTable; natv2InstanceTable.
Objects returned: natv2InstancePortMapEntries, Objects returned: natv2InstancePortMapEntries and
natv2InstancePortMapCreations in natv2InstanceTable; natv2InstancePortMapCreations in natv2InstanceTable.
Rate control: natv2InstanceNotificationInterval in Rate control: natv2InstanceNotificationInterval in
natv2InstanceTable. natv2InstanceTable.
Notification: natv2NotificationSubscriberPortMapEntriesHigh. Notification: natv2NotificationSubscriberPortMapEntriesHigh.
Indicates that the total number of entries in the port map table for Indicates that the total number of entries in the port map table for
the given subscriber equals or exceeds the threshold value configured the given subscriber equals or exceeds the threshold value configured
for that subscriber. for that subscriber.
Compared value: natv2SubscriberPortMapEntries in Compared value: natv2SubscriberPortMapEntries in
natv2SubscriberTable; natv2SubscriberTable.
Threshold: natv2SubscriberThresholdPortMapEntriesHigh in Threshold: natv2SubscriberThresholdPortMapEntriesHigh in
natv2SubscriberTable; natv2SubscriberTable.
Objects returned: natv2SubscriberPortMapEntries, Objects returned: natv2SubscriberPortMapEntries and
natv2SubscriberPortMapCreations in natv2SubscriberTable; natv2SubscriberPortMapCreations in natv2SubscriberTable.
Rate control: natv2SubscriberNotificationInterval in Rate control: natv2SubscriberNotificationInterval in
natv2SubscriberTable. natv2SubscriberTable.
3.1.3. State Information 3.1.3. State Information
State information provides a snapshot of the content and extent of State information provides a snapshot of the content and extent of
the NAT mapping tables at a given moment of time. The address and the NAT mapping tables at a given moment of time. The address and
port mapping tables are described in detail below. In addition to port mapping tables are described in detail below. In addition to
these tables, two state variables are provided: current number of these tables, two state variables are provided: current number of
entries in the address mapping table, and current number of entries entries in the address mapping table, and current number of entries
in the port mapping table. With one exception, these are provided at in the port mapping table. With one exception, these are provided at
four levels of granularity: per NAT instance, per protocol, per four levels of granularity: per NAT instance, per protocol, per
address pool, and per subscriber. Address map entries are not address pool, and per subscriber. Address map entries are not
tracked per protocol, since address mapping is protocol-independent. tracked per protocol, since address mapping is protocol independent.
3.1.4. Statistics 3.1.4. Statistics
NATV2-MIB provides a number of counters, intended to help both with NATV2-MIB provides a number of counters, intended to help with both
provisioning of the NAT and debugging of problems. As with the state the provisioning of the NAT and the debugging of problems. As with
data, these counters are provided at the four levels of NAT instance, the state data, these counters are provided at the four levels of NAT
protocol, address pool, and subscriber when they make sense. Each instance, protocol, address pool, and subscriber when they make
counter is cumulative beginning from a "last discontuity time" sense. Each counter is cumulative, beginning from a "last
recorded by an object that is usually in the table containing the discontinuity time" recorded by an object that is usually in the
counter. table containing the counter.
The basic set of counters, as reflected in the NAT instance table, is The basic set of counters, as reflected in the NAT instance table, is
as follows: as follows:
Translations: number of packets processed and translated (in this Translations: number of packets processed and translated (in this
case, in total for the NAT instance); case, in total for the NAT instance).
Address map entry creations: cumulative number of address map Address map entry creations: cumulative number of address map
entries created, including static mappings; entries created, including static mappings.
Port map entry creations: cumulative number of port map entries Port map entry creations: cumulative number of port map entries
created, including static mappings; created, including static mappings.
Address map limit drops: cumulative number of packets dropped rather Address map limit drops: cumulative number of packets dropped rather
than translated because the packet would have triggered the than translated because the packet would have triggered the
creation of a new address mapping, but the configured limit on creation of a new address mapping, but the configured limit on
number of address map entries has already been reached. number of address map entries has already been reached.
Port map limit drops: cumulative number of packets dropped rather Port map limit drops: cumulative number of packets dropped rather
than translated because the packet would have triggered the than translated because the packet would have triggered the
creation of a new port mapping, but the configured limit on number creation of a new port mapping, but the configured limit on number
of port map entries has already been reached. of port map entries has already been reached.
skipping to change at page 10, line 46 skipping to change at page 10, line 46
mapping, but no port could be allocated for the protocol mapping, but no port could be allocated for the protocol
concerned. The precise conditions under which these packet drops concerned. The precise conditions under which these packet drops
occur depend on the pooling behavior [RFC4787] configured or occur depend on the pooling behavior [RFC4787] configured or
implemented in the NAT instance. See the DESCRIPTION clause for implemented in the NAT instance. See the DESCRIPTION clause for
the natv2InstancePortMapFailureDrops object for a detailed the natv2InstancePortMapFailureDrops object for a detailed
description of the different cases. These cases were defined with description of the different cases. These cases were defined with
care to ensure that address mapping failure could be distinguished care to ensure that address mapping failure could be distinguished
from port mapping failure. from port mapping failure.
Fragment drops: cumulative number of packets dropped because the Fragment drops: cumulative number of packets dropped because the
packet contains a fragment and the fragment behavior [RFC4787] packet contains a fragment, and the fragment behavior [RFC4787]
configured or implemented in the NAT instance indicates that the configured or implemented in the NAT instance indicates that the
packet should be dropped. The main case is a NAT instance that packet should be dropped. The main case is a NAT instance that
meets REQ-14 of [RFC4787], hence can receive and process out-of- meets REQ-14 of [RFC4787], hence it can receive and process out-
order fragments. In that case, dropping occurs only when the of-order fragments. In that case, dropping occurs only when the
configured limit on pending fragments provided by NATV2-MIB has configured limit on pending fragments provided by NATV2-MIB has
already been reached. The other cases are detailed in the already been reached. The other cases are detailed in the
DESCRIPTION clause of the natv2InstanceFragmentBehavior object. DESCRIPTION clause of the natv2InstanceFragmentBehavior object.
Other resource drops: cumulative number of packets dropped because Other resource drops: cumulative number of packets dropped because
of unavailability of some other resource. The most likely case of unavailability of some other resource. The most likely case
would be packets where the upper layer protocol is not one would be packets where the upper-layer protocol is not one
supported by the NAT instance. supported by the NAT instance.
Table 1 indicates the granularities at which these statistics are Table 1 indicates the granularities at which these statistics are
reported. reported.
+-----------------------+------------+----------+------+------------+ +-----------------------+------------+----------+------+------------+
| Statistic | NAT | Protocol | Pool | Subscriber | | Statistic | NAT | Protocol | Pool | Subscriber |
| | Instance | | | | | | Instance | | | |
+-----------------------+------------+----------+------+------------+ +-----------------------+------------+----------+------+------------+
| Translations | Yes | Yes | No | Yes | | Translations | Yes | Yes | No | Yes |
| | | | | |
| Address map entry | Yes | No | Yes | Yes | | Address map entry | Yes | No | Yes | Yes |
| creations | | | | | | creations | | | | |
| | | | | |
| Port map entry | Yes | Yes | Yes | Yes | | Port map entry | Yes | Yes | Yes | Yes |
| creations | | | | | | creations | | | | |
| | | | | |
| Address map limit | Yes | No | No | No | | Address map limit | Yes | No | No | No |
| drops | | | | | | drops | | | | |
| | | | | |
| Port map limit drops | Yes | No | No | Yes | | Port map limit drops | Yes | No | No | Yes |
| | | | | |
| Active subscriber | Yes | No | No | No | | Active subscriber | Yes | No | No | No |
| limit drops | | | | | | limit drops | | | | |
| | | | | |
| Address mapping | Yes | No | Yes | Yes | | Address mapping | Yes | No | Yes | Yes |
| failure drops | | | | | | failure drops | | | | |
| | | | | |
| Port mapping failure | Yes | Yes | Yes | Yes | | Port mapping failure | Yes | Yes | Yes | Yes |
| drops | | | | | | drops | | | | |
| | | | | |
| Fragment drops | Yes | No | No | No | | Fragment drops | Yes | No | No | No |
| | | | | |
| Other resource drops | Yes | No | No | No | | Other resource drops | Yes | No | No | No |
+-----------------------+------------+----------+------+------------+ +-----------------------+------------+----------+------+------------+
Table 1: Statistics Provided By Level of Granularity Table 1: Statistics Provided By Level of Granularity
3.2. Outline of MIB Module Organization 3.2. Outline of MIB Module Organization
Figure 1 shows how object identifiers are organized in the NATV2-MIB Figure 1 shows how object identifiers are organized in the NATV2-MIB
module. Under the general natv2MIB object identifier in the mib-2 module. Under the general natv2MIB object identifier in the mib-2
tree, the objects are classed into four groups: tree, the objects are classed into four groups:
natv2MIBNotifications(0) identifies the five notifications described natv2MIBNotifications(0): identifies the five notifications
in Section 3.1.2; described in Section 3.1.2.
natv2MIBDeviceObjects(1) identifies objects relating to the whole natv2MIBDeviceObjects(1): identifies objects relating to the whole
device, specifically, the subscriber table. device, specifically, the subscriber table.
natv2MIBInstanceObjects(2) identifies objects relating to individual natv2MIBInstanceObjects(2): identifies objects relating to
NAT instances. These include the NAT instance table, the protocol individual NAT instances. These include the NAT instance table,
table, the address pool table and its address range expansion, the the protocol table, the address pool table and its address range
address map table, and the port map table. expansion, the address map table, and the port map table.
natv2MIBConformance(3) identifies the group and compliance clauses, natv2MIBConformance(3): identifies the group and compliance clauses,
specified for the three application scenarios described in specified for the three application scenarios described in
Section 3.4. Section 3.4.
natv2MIB natv2MIB
| |
+-------------+-------------+-------------+ +-------------+-------------+-------------+
| | | | | | | |
| | | | | |
0 | | | 0 | | |
natv2MIBNotifications | | | natv2MIBNotifications | | |
skipping to change at page 12, line 32 skipping to change at page 13, line 23
| 1 | | | 1 | |
| natv2MIBDeviceObjects | | | natv2MIBDeviceObjects | |
Five | | Five | |
notifications | 2 | notifications | 2 |
| natv2MIBInstanceObjects | | natv2MIBInstanceObjects |
| | | |
Subscriber | 3 Subscriber | 3
table | natv2MIBConformance table | natv2MIBConformance
| | | |
| | | |
Six per-NAT- | Six per-NAT- |
instance tables | instance tables |
| |
+----------------------+------- +----------------------+-------
| | | |
| | | |
1 2 1 2
natv2MIBCompliances natv2MIBGroups natv2MIBCompliances natv2MIBGroups
| | | |
| | | |
Basic Basic Basic Basic
Pooled Pooled pooled pooled
Carrier grade NAT Carrier grade NAT carrier-grade NAT carrier-grade NAT
Figure 1: Organization of Object Identifiers For NATV2-MIB Figure 1: Organization of Object Identifiers for NATV2-MIB
3.3. Detailed MIB Module Walk-Through 3.3. Detailed MIB Module Walk-Through
This section reviews the contents of the NATV2-MIB module. The table This section reviews the contents of the NATV2-MIB module. The table
descriptions include references to subsections of Section 3.1 where descriptions include references to subsections of Section 3.1 where
desirable to avoid repetition of that information. desirable to avoid repetition of that information.
3.3.1. Textual Conventions 3.3.1. Textual Conventions
The module defines four key textual conventions: ProtocolNumber, The module defines four key textual conventions: ProtocolNumber,
Natv2SubscriberIndex, Natv2InstanceIndex, and Natv2PoolIndex. Natv2SubscriberIndex, Natv2InstanceIndex, and Natv2PoolIndex.
ProtocolNumber is based on the IANA registry of protocol numbers, ProtocolNumber is based on the IANA registry of protocol numbers and
hence is potentially reusable by other MIB modules. hence is potentially reusable by other MIB modules.
Objects of type Natv2SubscriberIndex identify individual subscribers Objects of type Natv2SubscriberIndex identify individual subscribers
served by the the NAT device. The values of these identifiers are served by the NAT device. The values of these identifiers are
administered and, in intent, are permanently associated with their administered and, in intent, are permanently associated with their
respective subscribers. Reuse of a value after a subscriber has been respective subscribers. Reuse of a value after a subscriber has been
deleted is discouraged. The scope of the subscriber index was deleted is discouraged. The scope of the subscriber index was
defined to be at device rather than NAT instance level to make it defined to be at the device rather than the NAT instance level to
easier to shift subscribers between instances (e.g., for load make it easier to shift subscribers between instances (e.g., for load
balancing). balancing).
Objects of type Natv2InstanceIndex identify specific NAT instances on Objects of type Natv2InstanceIndex identify specific NAT instances on
the device. Again, these are administered values intended to be the device. Again, these are administered values intended to be
permanently associated with the NAT instances to which they have been permanently associated with the NAT instances to which they have been
assigned. assigned.
Objects of type Natv2PoolIndex identify individual address pools in a Objects of type Natv2PoolIndex identify individual address pools in a
given NAT instance. As with the subscriber and instance index given NAT instance. As with the subscriber and instance index
objects, the pool identifiers are administered and intended to be objects, the pool identifiers are administered and intended to be
permanently associated with their respective pools. permanently associated with their respective pools.
3.3.2. Notifications 3.3.2. Notifications
Notifications were described in Section 3.1.2. Notifications were described in Section 3.1.2.
3.3.3. The Subscriber Table: natv2SubscriberTable 3.3.3. The Subscriber Table: natv2SubscriberTable
Table natv2SubscriberTable is indexed by subscriber index. One Table natv2SubscriberTable is indexed by the subscriber index. One
conceptual row contains information relating to a specific conceptual row contains information relating to a specific
subscriber: the subscriber's internal address or prefix for subscriber: the subscriber's internal address or prefix for
correlation with other management information; state and statistical correlation with other management information; state and statistical
information as described in Section 3.1.3 and Section 3.1.4, the per- information as described in Sections 3.1.3 and 3.1.4; the per-
subscriber control objects described in Section 3.1.1, and subscriber control objects described in Section 3.1.1; and
natv2SubscriberDiscontinuityTime, which provides a timestamp of the natv2SubscriberDiscontinuityTime, which provides a timestamp of the
latest time following which the statistics have accumulated without latest time following, which the statistics have accumulated without
discontinuity. discontinuity.
Turning back to the address information for a moment: this Turning back to the address information for a moment: this
information includes the identity of the address realm in which the information includes the identity of the address realm in which the
address is routable. That enables support of an arbitrary number of address is routable. That enables support of an arbitrary number of
address realms on the same NAT instance. Address realm identifiers address realms on the same NAT instance. Address realm identifiers
are administered values in the form of a limited-length are administered values in the form of a limited-length
SnmpAdminString. In the absence of configuration to the contrary, SnmpAdminString. In the absence of configuration to the contrary,
the default realm for all internal addresses as recorded in mapping the default realm for all internal addresses as recorded in mapping
entries is "internal". entries is "internal".
The term "address realm" is defined in [RFC2663] Section 2.1 and The term "address realm" is defined in [RFC2663], Section 2.1 and
reused in subsequent NAT-related documents. reused in subsequent NAT-related documents.
In the special case of DS-Lite [RFC6333], for unique matching of the In the special case of Dual-Stack Lite (DS-Lite) [RFC6333], for
subscriber data to other information in the MIB module, it is unique matching of the subscriber data to other information in the
necessary that the address information should relate to the outer MIB module, it is necessary that the address information should
IPv6 header of packets going to or from the host, with the address relate to the outer IPv6 header of packets going to or from the host,
realm being the one in which that IPv6 address is routable. The with the address realm being the one in which that IPv6 address is
presentation of address information for other types of tunneled routable. The presentation of address information for other types of
access to the NAT is out of scope. tunneled access to the NAT is out of scope.
3.3.4. The Instance Table: natv2InstanceTable 3.3.4. The Instance Table: natv2InstanceTable
Table natv2InstanceTable is indexed by an object of type Table natv2InstanceTable is indexed by an object of type
Natv2InstanceIndex. A conceptual row of this table provides Natv2InstanceIndex. A conceptual row of this table provides
information relating to a particular NAT instance configured on the information relating to a particular NAT instance configured on the
device. device.
Configuration information provided by this table includes an instance Configuration information provided by this table includes an instance
name of type DisplayString that may have been configured for this name of type DisplayString that may have been configured for this
instance, and a set of objects indicating respectively the port instance and a set of objects indicating, respectively, the port
mapping, filtering, pooling, and fragment behaviors configured or mapping, filtering, pooling, and fragment behaviors configured or
implemented in the instance. These behaviors are all defined in implemented in the instance. These behaviors are all defined in
[RFC4787]. Their values affect the interpretation of some of the [RFC4787]. Their values affect the interpretation of some of the
statistics provided in the instance table. statistics provided in the instance table.
Read-write objects listed in Section 3.1.2 set the notification rate Read-write objects listed in Section 3.1.2 set the notification rate
for instance-level notifications and set the thresholds that trigger for instance-level notifications and set the thresholds that trigger
them. Additional read-write objects described in Section 3.1.1 set them. Additional read-write objects described in Section 3.1.1 set
limits on the number of address and port mapping entries, number of limits on the number of address and port mapping entries, number of
pending fragments, and number of active subscribers for the instance. pending fragments, and number of active subscribers for the instance.
The state and statistical information provided by this table consists The state and statistical information provided by this table consists
of the per-instance items described in Section 3.1.3 and of the per-instance items described in Sections 3.1.3 and 3.1.4,
Section 3.1.4 respectively. natv2InstanceDiscontinuityTime is a respectively. natv2InstanceDiscontinuityTime is a timestamp giving
timestamp giving the time beyond which all of the statistical the time beyond which all of the statistical counters in
counters in natv2InstanceTable are guaranteed to have accumulated natv2InstanceTable are guaranteed to have accumulated continuously.
continuously.
3.3.5. The Protocol Table: natv2ProtocolTable 3.3.5. The Protocol Table: natv2ProtocolTable
The protocol table is indexed by the NAT instance number and an The protocol table is indexed by the NAT instance number and an
object of type ProtocolNumber as described in Section 3.3.1 (i.e., an object of type ProtocolNumber as described in Section 3.3.1 (i.e., an
IANA-registered protocol number). The set of protocols supported by IANA-registered protocol number). The set of protocols supported by
the NAT instance is implementation-dependent, but MUST include the NAT instance is implementation dependent, but they MUST include
ICMP(1), TCP(6), UDP(17), and ICMPv6(58). Depending on the ICMP(1), TCP(6), UDP(17), and ICMPv6(58). Depending on the
application, it SHOULD include IPv4 encapsulation(4), IPv6 application, it SHOULD include IPv4 encapsulation(4), IPv6
encapsulation(41), IPSec AH(51), and SCTP(132). Support of PIM(103) encapsulation(41), IPsec AH(51), and SCTP(132). Support of PIM(103)
is highly desirable. is highly desirable.
This table includes no configuration information. The state and This table includes no configuration information. The state and
statistical information provided by this table consists of the per- statistical information provided by this table consists of the per-
protocol items described in Section 3.1.3 and Section 3.1.4 protocol items described in Sections 3.1.3 and 3.1.4, respectively.
respectively. natv2InstanceDiscontinuityTime in natv2InstanceTable is natv2InstanceDiscontinuityTime in natv2InstanceTable is reused as the
reused as the timestamp giving the time beyond which all of the timestamp giving the time beyond which all of the statistical
statistical counters in natv2ProtocolTable are guaranteed to have counters in natv2ProtocolTable are guaranteed to have accumulated
accumulated continuously. The reasoning is that any event affecting continuously. The reasoning is that any event affecting the
the continuity of per-protocol statistics will affect the continuity continuity of per-protocol statistics will affect the continuity of
of NAT instance statistics, and vice versa. NAT instance statistics, and vice versa.
3.3.6. The Address Pool Table: natv2PoolTable 3.3.6. The Address Pool Table: natv2PoolTable
The address pool table is indexed by the NAT instance identifier for The address pool table is indexed by the NAT instance identifier for
the instance on which it is provisioned, plus a pool index of type the instance on which it is provisioned, plus a pool index of type
Natv2PoolIndex. Configuration information provided includes the Natv2PoolIndex. Configuration information provided includes the
address realm for which the pool provides addresses, the type of address realm for which the pool provides addresses, the type of
address (IPv4 or IPv6) supported by the realm, plus the port range it address (IPv4 or IPv6) supported by the realm, plus the port range it
makes available for allocation. The same set of port numbers (or, in makes available for allocation. The same set of port numbers (or, in
the ICMP case, identifier values), is made available for every the ICMP case, identifier values) is made available for every
protocol supported by the NAT instance. The port range is specified protocol supported by the NAT instance. The port range is specified
in terms of minimum and maximum port number. in terms of minimum and maximum port number.
The state and statistical information provided by this table consists The state and statistical information provided by this table consists
of the per-pool items described in Section 3.1.3 and Section 3.1.4 of the per-pool items described in Sections 3.1.3 and 3.1.4
respectively, plus two additional state objects described below. respectively, plus two additional state objects described below.
natv2PoolTable provides the pool-specific object natv2PoolTable provides the pool-specific object
natv2PoolDiscontinuityTime to indicate the time since which the natv2PoolDiscontinuityTime to indicate the time since the statistical
statistical counters have accumulated continuously. counters have accumulated continuously.
Read-write objects to set high and low thresholds for pool usage Read-write objects to set high and low thresholds for pool usage
notifications and for governing notification rate were identified in notifications and for governing the notification rate were identified
Section 3.1.2. in Section 3.1.2.
Implementation note: the thresholds are defined in terms of Implementation note: the thresholds are defined in terms of
percentage of available port utilization. The number of available percentage of available port utilization. The number of available
ports in a pool is equal to (max port - min port + 1) (from the ports in a pool is equal to (max port - min port + 1) (from the
natv2PoolTable configuration information) multiplied by the number natv2PoolTable configuration information) multiplied by the number
of addresses provisioned in the pool (sum of number of addresses of addresses provisioned in the pool (sum of number of addresses
provided by each natv2PoolRangeTable conceptual row relating to provided by each natv2PoolRangeTable conceptual row relating to
that pool). At configuration time, the thresholds can be that pool). At configuration time, the thresholds can be
recalculated in terms of total number of port map entries recalculated in terms of total number of port map entries
corresponding to the configured percentage, so that runtime corresponding to the configured percentage, so that runtime
skipping to change at page 16, line 44 skipping to change at page 17, line 34
of NAT instance index, internal realm, internal address type (IPv4 or of NAT instance index, internal realm, internal address type (IPv4 or
IPv6) in that realm, the internal address of the local host for which IPv6) in that realm, the internal address of the local host for which
the map entry was created, and a conceptual row index to traverse all the map entry was created, and a conceptual row index to traverse all
of the entries relating to the same internal address. of the entries relating to the same internal address.
In the special case of DS-Lite [RFC6333], the internal address and In the special case of DS-Lite [RFC6333], the internal address and
realm used in the index are those of the IPv6 outer header. The IPv4 realm used in the index are those of the IPv6 outer header. The IPv4
source address for the inner header, for which [RFC6333] has reserved source address for the inner header, for which [RFC6333] has reserved
addresses in the 192.0.0.0/29 range, is captured in two additional addresses in the 192.0.0.0/29 range, is captured in two additional
objects in the corresponding conceptual row: objects in the corresponding conceptual row:
natv2AddressMapInternalMappedAddressType, and natv2AddressMapInternalMappedAddressType and
natv2AddressMapInternalMappedAddress. In cases other than DS-Lite natv2AddressMapInternalMappedAddress. In cases other than DS-Lite
access these objects have no meaning. (Other tunneled access is out access, these objects have no meaning. (Other tunneled access is out
of scope.) of scope.)
The additional information provided by natv2AddressMapTable consists The additional information provided by natv2AddressMapTable consists
of the external realm, address type in that realm, and mapped of the external realm, address type in that realm, and mapped
external address. Depending on implementation support, the table external address. Depending on implementation support, the table
also provides the index of the address pool from which the external also provides the index of the address pool from which the external
address was drawn and the index of the subscriber to which the map address was drawn and the index of the subscriber to which the map
entry belongs. entry belongs.
3.3.9. The Port Map Table: natv2PortMapTable 3.3.9. The Port Map Table: natv2PortMapTable
skipping to change at page 17, line 37 skipping to change at page 18, line 26
of DS-Lite [RFC6333]. The realm and outgoing source address are of DS-Lite [RFC6333]. The realm and outgoing source address are
those for the outer header, and the address type is IPv6. Additional those for the outer header, and the address type is IPv6. Additional
objects natv2PortMapInternalMappedAddressType and objects natv2PortMapInternalMappedAddressType and
natv2PortMapInternalMappedAddress capture the outgoing source address natv2PortMapInternalMappedAddress capture the outgoing source address
in the inner header, which will be in the well-known 192.0.0.0/29 in the inner header, which will be in the well-known 192.0.0.0/29
range. range.
3.4. Conformance: Three Application Scenarios 3.4. Conformance: Three Application Scenarios
The conformance statements in NATV2-MIB provide for three application The conformance statements in NATV2-MIB provide for three application
scenarios: basic NAT, NAT supporting address pools, and carrier grade scenarios: basic NAT, NAT supporting address pools, and CGN.
NAT (CGN).
A basic NAT MAY limit the number of NAT instances it supports to one, A basic NAT MAY limit the number of NAT instances it supports to one,
but MUST support indexing by NAT instance. Similarly, a basic NAT but it MUST support indexing by NAT instance. Similarly, a basic NAT
MAY limit the number of realms it supports to two. By definition, a MAY limit the number of realms it supports to two. By definition, a
basic NAT is not required to support the subscriber table, the basic NAT is not required to support the subscriber table, the
address pool table, or the address pool address range table. Some address pool table, or the address pool address range table. Some
individual objects in other tables are also not relevant to basic individual objects in other tables are also not relevant to basic
NAT. NAT.
A NAT supporting address pools adds the address pool table and the A NAT supporting address pools adds the address pool table and the
address pool address range table to what it implements. Some address pool address range table to what it implements. Some
individual objects in other tables also need to be implemented. A individual objects in other tables also need to be implemented. A
NAT supporting address pools MUST support more than two realms. NAT supporting address pools MUST support more than two realms.
Finally, a CGN MUST support the full contents of the MIB module. Finally, a CGN MUST support the full contents of the MIB module.
That includes the subscriber table, but also includes the special That includes the subscriber table, but it also includes the special
provision for DS-Lite access in the address and port map tables. provision for DS-Lite access in the address and port map tables.
4. Definitions 4. Definitions
This MIB module IMPORTs objects from [RFC2578], [RFC2579], [RFC2580], This MIB module IMPORTs objects from [RFC2578], [RFC2579], [RFC2580],
[RFC3411], and [RFC4001]. [RFC3411], and [RFC4001].
NATV2-MIB DEFINITIONS ::= BEGIN NATV2-MIB DEFINITIONS ::= BEGIN
IMPORTS IMPORTS
MODULE-IDENTITY, MODULE-IDENTITY,
OBJECT-TYPE, OBJECT-TYPE,
Integer32, Integer32,
Unsigned32, Unsigned32,
Counter64, Counter64,
mib-2, mib-2,
NOTIFICATION-TYPE NOTIFICATION-TYPE
FROM SNMPv2-SMI -- RFC 2578 FROM SNMPv2-SMI -- RFC 2578
TEXTUAL-CONVENTION, TEXTUAL-CONVENTION,
DisplayString, DisplayString,
TimeStamp TimeStamp
FROM SNMPv2-TC -- RFC 2579 FROM SNMPv2-TC -- RFC 2579
MODULE-COMPLIANCE, MODULE-COMPLIANCE,
NOTIFICATION-GROUP, NOTIFICATION-GROUP,
OBJECT-GROUP OBJECT-GROUP
FROM SNMPv2-CONF -- RFC 2580 FROM SNMPv2-CONF -- RFC 2580
SnmpAdminString SnmpAdminString
FROM SNMP-FRAMEWORK-MIB -- RFC 3411 FROM SNMP-FRAMEWORK-MIB -- RFC 3411
InetAddressType, InetAddressType,
InetAddress, InetAddress,
InetAddressPrefixLength, InetAddressPrefixLength,
InetPortNumber InetPortNumber
FROM INET-ADDRESS-MIB; -- RFC 4001 FROM INET-ADDRESS-MIB; -- RFC 4001
natv2MIB MODULE-IDENTITY natv2MIB MODULE-IDENTITY
LAST-UPDATED "201502170000Z" LAST-UPDATED "201510020000Z" -- 2 October 2015
-- RFC Ed.: set to publication date
ORGANIZATION
"IETF Behavior Engineering for Hindrance
Avoidance (BEHAVE) Working Group"
CONTACT-INFO
"Working Group Email: behave@ietf.org
Simon Perreault ORGANIZATION
Jive Communications "IETF Behavior Engineering for Hindrance
Quebec, QC Avoidance (BEHAVE) Working Group"
Canada CONTACT-INFO
"Working Group Email: behave@ietf.org
Email: sperreault@jive.com Simon Perreault
Jive Communications
Quebec, QC
Canada
Tina Tsou Email: sperreault@jive.com
Huawei Technologies Tina Tsou
Bantian, Longgang Huawei Technologies
Shenzhen 518129 Bantian, Longgang
PR China Shenzhen 518129
China
Email: tina.tsou.zouting@huawei.com Email: tina.tsou.zouting@huawei.com
Senthil Sivakumar Senthil Sivakumar
Cisco Systems Cisco Systems
7100-8 Kit Creek Road 7100-8 Kit Creek Road
Research Triangle Park, North Carolina 27709 Research Triangle Park, North Carolina 27709
USA United States
Phone: +1 919 392 5158 Phone: +1 919 392 5158
Email: ssenthil@cisco.com Email: ssenthil@cisco.com
Tom Taylor Tom Taylor
PT Taylor Consulting PT Taylor Consulting
Ottawa Ottawa
Canada Canada
Email: tom.taylor.stds@gmail.com" Email: tom.taylor.stds@gmail.com"
DESCRIPTION DESCRIPTION
"This MIB module defines the generic managed objects "This MIB module defines the generic managed objects
for NAT. for NAT.
Copyright (C) The Internet Society (2015). This Copyright (c) 2015 IETF Trust and the persons
version of this MIB module is part of RFC yyyy; see identified as authors of the code. All rights reserved.
the RFC itself for full legal notices."
REVISION "201502170000Z"
-- RFC Ed.: set to publication date
DESCRIPTION
"Complete rewrite, published as RFC yyyy.
Replaces former version published as RFC 4008."
-- RFC Ed.: replace yyyy with actual RFC number and set date"
::= { mib-2 123 }
-- temporary for compilation pending IANA assignment
-- textual conventions Redistribution and use in source and binary forms, with
ProtocolNumber ::= TEXTUAL-CONVENTION or without modification, is permitted pursuant to, and
DISPLAY-HINT "d" subject to the license terms contained in, the Simplified
STATUS current BSD License set forth in Section 4.c of the IETF Trust's
DESCRIPTION Legal Provisions Relating to IETF Documents
"A protocol number, from the 'protocol-numbers' IANA (http://trustee.ietf.org/license-info).
registry."
REFERENCE
"IANA Protocol Numbers,
http://www.iana.org/assignments/protocol-numbers
/protocol-numbers.xhtml#protocol-numbers-1"
SYNTAX Unsigned32 (0..255)
Natv2SubscriberIndex ::= TEXTUAL-CONVENTION This version of this MIB module is part of RFC 7659;
DISPLAY-HINT "d" see the RFC itself for full legal notices."
STATUS current REVISION "201510020000Z" -- 2 October 2015
DESCRIPTION DESCRIPTION
"A unique value, greater than zero, for each subscriber "Complete rewrite, published as RFC 7659.
in the managed system. The value for each Replaces former version published as RFC 4008."
subscriber MUST remain constant at least from one ::= { mib-2 234 }
update of the entity's natv2SubscriberDiscontinuityTime
object until the next update of that object. If a
subscriber is deleted, its assigned index value MUST NOT
be assigned to another subscriber at least until
reinitialization of the entity's management system."
SYNTAX Unsigned32 (1..4294967295)
Natv2SubscriberIndexOrZero ::= TEXTUAL-CONVENTION -- Textual conventions
DISPLAY-HINT "d" ProtocolNumber ::= TEXTUAL-CONVENTION
STATUS current DISPLAY-HINT "d"
DESCRIPTION STATUS current
"This textual convention is an extension of the DESCRIPTION
Natv2SubscriberIndex convention. The latter defines a "A protocol number, from the IANA Protocol Numbers
greater than zero value used to identify a subscriber in registry."
the managed system. This extension permits the additional REFERENCE
value of zero, which serves as a placeholder when no "IANA Protocol Numbers,
subscriber is associated with the object." <http://www.iana.org/assignments/protocol-numbers>"
SYNTAX Unsigned32 (0|1..4294967295) SYNTAX Unsigned32 (0..255)
Natv2InstanceIndex ::= TEXTUAL-CONVENTION Natv2SubscriberIndex ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d" DISPLAY-HINT "d"
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"A unique value, greater than zero, for each NAT instance "A unique value, greater than zero, for each subscriber
in the managed system. It is RECOMMENDED that values are in the managed system. The value for each
assigned contiguously starting from 1. The value for each subscriber MUST remain constant at least from one
NAT instance MUST remain constant at least from one update of the entity's natv2SubscriberDiscontinuityTime
update of the entity's natv2InstanceDiscontinuityTime object until the next update of that object. If a
object until the next update of that object. If a NAT subscriber is deleted, its assigned index value MUST NOT
instance is deleted, its assigned index value MUST NOT be assigned to another subscriber at least until
be assigned to another NAT instance at least until reinitialization of the entity's management system."
reinitialization of the entity's management system." SYNTAX Unsigned32 (1..4294967295)
SYNTAX Unsigned32 (1..4294967295)
Natv2PoolIndex ::= TEXTUAL-CONVENTION Natv2SubscriberIndexOrZero ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d" DISPLAY-HINT "d"
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"A unique value over the containing NAT instance, greater than "This textual convention is an extension of the
zero, for each address pool supported by that NAT instance. Natv2SubscriberIndex convention. The latter defines a
It is RECOMMENDED that values are assigned contiguously greater than zero value used to identify a subscriber in
starting from 1. The value for each address pool MUST remain the managed system. This extension permits the additional
constant at least from one update of the entity's value of zero, which serves as a placeholder when no
natv2PoolDiscontinuityTime object until the next update of subscriber is associated with the object."
that object. If an address pool is deleted, its assigned SYNTAX Unsigned32 (0|1..4294967295)
index value MUST NOT be assigned to another address pool for
the same NAT instance at least until reinitialization of the
entity's management system."
SYNTAX Unsigned32 (1..4294967295)
Natv2PoolIndexOrZero ::= TEXTUAL-CONVENTION Natv2InstanceIndex ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d" DISPLAY-HINT "d"
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"This textual convention is an extension of the "A unique value, greater than zero, for each NAT instance
Natv2PoolIndex convention. The latter defines a greater in the managed system. It is RECOMMENDED that values are
than zero value used to identify address pools in the assigned contiguously starting from 1. The value for each
managed system. This extension permits the additional NAT instance MUST remain constant at least from one
value of zero, which serves as a placeholder when the update of the entity's natv2InstanceDiscontinuityTime
implementation does not support address pools or no address object until the next update of that object. If a NAT
pool is configured in a given external realm." instance is deleted, its assigned index value MUST NOT
SYNTAX Unsigned32 (0|1..4294967295) be assigned to another NAT instance at least until
reinitialization of the entity's management system."
SYNTAX Unsigned32 (1..4294967295)
-- notifications Natv2PoolIndex ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"A unique value over the containing NAT instance, greater than
zero, for each address pool supported by that NAT instance.
It is RECOMMENDED that values are assigned contiguously
starting from 1. The value for each address pool MUST remain
constant at least from one update of the entity's
natv2PoolDiscontinuityTime object until the next update of
that object. If an address pool is deleted, its assigned
index value MUST NOT be assigned to another address pool for
the same NAT instance at least until reinitialization of the
entity's management system."
SYNTAX Unsigned32 (1..4294967295)
natv2MIBNotifications OBJECT IDENTIFIER ::= { natv2MIB 0 } Natv2PoolIndexOrZero ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"This textual convention is an extension of the
Natv2PoolIndex convention. The latter defines a greater
than zero value used to identify address pools in the
managed system. This extension permits the additional
value of zero, which serves as a placeholder when the
implementation does not support address pools or no address
pool is configured in a given external realm."
SYNTAX Unsigned32 (0|1..4294967295)
natv2NotificationPoolUsageLow NOTIFICATION-TYPE -- Notifications
OBJECTS { natv2PoolNotifiedPortMapEntries,
natv2PoolNotifiedPortMapProtocol }
STATUS current
DESCRIPTION
"This notification is triggered when an address pool's usage
becomes less than or equal to the value of the
natv2PoolThresholdUsageLow object for that pool, unless the
notification has been disabled by setting the value of the
threshold to -1. It is reported subject to the rate
limitation specified by natv2PortMapNotificationInterval.
Address pool usage is calculated as the percentage of the natv2MIBNotifications OBJECT IDENTIFIER ::= { natv2MIB 0 }
total number of ports allocated to the address pool that are
already in use, for the most-mapped protocol at the time
the notification is triggered. The two returned objects are
members of natv2PoolTable indexed by the NAT instance and
pool indices for which the event is being reported. They
give the number of port map entries using external addresses
configured on the pool for the most-mapped protocol and
identify that protocol at the time the notification was
triggered."
REFERENCE
"RFC yyyy Section 3.1.2 and Section 3.3.6."
::= { natv2MIBNotifications 1 }
natv2NotificationPoolUsageHigh NOTIFICATION-TYPE natv2NotificationPoolUsageLow NOTIFICATION-TYPE
OBJECTS { natv2PoolNotifiedPortMapEntries, OBJECTS { natv2PoolNotifiedPortMapEntries,
natv2PoolNotifiedPortMapProtocol } natv2PoolNotifiedPortMapProtocol }
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"This notification is triggered when an address pool's usage "This notification is triggered when an address pool's usage
becomes greater than or equal to the value of the becomes less than or equal to the value of the
natv2PoolThresholdUsageHigh object for that pool, unless natv2PoolThresholdUsageLow object for that pool, unless the
the notification has been disabled by setting the value of notification has been disabled by setting the value of the
the threshold to -1. It is reported subject to the rate threshold to -1. It is reported subject to the rate
limitation specified by natv2PortMapNotificationInterval. limitation specified by natv2PortMapNotificationInterval.
Address pool usage is calculated as the percentage of the Address pool usage is calculated as the percentage of the
total number of ports allocated to the address pool that are total number of ports allocated to the address pool that are
already in use, for the most-mapped protocol at the time the already in use, for the most-mapped protocol at the time
notification is triggered. The two returned objects are the notification is triggered. The two returned objects are
members of natv2PoolTable indexed by the NAT instance and members of natv2PoolTable indexed by the NAT instance and
pool indices for which the event is being reported. They pool indices for which the event is being reported. They
give the number of port map entries using external addresses give the number of port map entries using external addresses
configured on the pool for the most-mapped protocol and configured on the pool for the most-mapped protocol and
identify that protocol at the time the notification was identify that protocol at the time the notification was
triggered." triggered."
REFERENCE REFERENCE
"RFC yyyy Section 3.1.2 and Section 3.3.6." "RFC 7659, Sections 3.1.2 and 3.3.6."
::= { natv2MIBNotifications 2 } ::= { natv2MIBNotifications 1 }
natv2NotificationInstanceAddressMapEntriesHigh NOTIFICATION-TYPE natv2NotificationPoolUsageHigh NOTIFICATION-TYPE
OBJECTS { natv2InstanceAddressMapEntries, OBJECTS { natv2PoolNotifiedPortMapEntries,
natv2InstanceAddressMapCreations } natv2PoolNotifiedPortMapProtocol }
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"This notification is triggered when the value of "This notification is triggered when an address pool's usage
natv2InstanceAddressMapEntries equals or exceeds the value becomes greater than or equal to the value of the
of the natv2InstanceThresholdAddressMapEntriesHigh object natv2PoolThresholdUsageHigh object for that pool, unless
for the NAT instance, unless disabled by setting that the notification has been disabled by setting the value of
threshold to -1. Reporting is subject to the rate limitation the threshold to -1. It is reported subject to the rate
given by natv2InstanceNotificationInterval. limitation specified by natv2PortMapNotificationInterval.
natv2InstanceAddressMapEntries and Address pool usage is calculated as the percentage of the
natv2InstanceAddressMapCreations are members of table total number of ports allocated to the address pool that are
natv2InstanceTable indexed by the identifier of the NAT already in use, for the most-mapped protocol at the time the
instance for which the event is being reported. The values notification is triggered. The two returned objects are
reported are those observed at the moment the notification members of natv2PoolTable indexed by the NAT instance and
was triggered." pool indices for which the event is being reported. They
REFERENCE give the number of port map entries using external addresses
"RFC yyyy Section 3.1.2." configured on the pool for the most-mapped protocol and
::= { natv2MIBNotifications 3 } identify that protocol at the time the notification was
triggered."
REFERENCE
"RFC 7659, Sections 3.1.2 and 3.3.6."
::= { natv2MIBNotifications 2 }
natv2NotificationInstancePortMapEntriesHigh NOTIFICATION-TYPE natv2NotificationInstanceAddressMapEntriesHigh NOTIFICATION-TYPE
OBJECTS { natv2InstancePortMapEntries, OBJECTS { natv2InstanceAddressMapEntries,
natv2InstancePortMapCreations } natv2InstanceAddressMapCreations }
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"This notification is triggered when the value of "This notification is triggered when the value of
natv2InstancePortMapEntries becomes greater than or equal natv2InstanceAddressMapEntries equals or exceeds the value
to the value of natv2InstanceThresholdPortMapEntriesHigh, of the natv2InstanceThresholdAddressMapEntriesHigh object
unless disabled by setting that threshold to -1. Reporting for the NAT instance, unless disabled by setting that
is subject to the rate limitation given by threshold to -1. Reporting is subject to the rate limitation
natv2InstanceNotificationInterval. given by natv2InstanceNotificationInterval.
natv2InstancePortMapEntries and natv2InstanceAddressMapEntries and
natv2InstancePortMapCreations are members of table natv2InstanceAddressMapCreations are members of table
natv2InstanceTable indexed by the identifier of the NAT natv2InstanceTable indexed by the identifier of the NAT
instance for which the event is being reported. The values instance for which the event is being reported. The values
reported are those observed at the moment the notification reported are those observed at the moment the notification
was triggered." was triggered."
::= { natv2MIBNotifications 4 } REFERENCE
"RFC 7659, Section 3.1.2."
::= { natv2MIBNotifications 3 }
natv2NotificationSubscriberPortMappingEntriesHigh natv2NotificationInstancePortMapEntriesHigh NOTIFICATION-TYPE
NOTIFICATION-TYPE OBJECTS { natv2InstancePortMapEntries,
OBJECTS { natv2SubscriberPortMapEntries, natv2InstancePortMapCreations }
natv2SubscriberPortMapCreations } STATUS current
STATUS current DESCRIPTION
DESCRIPTION "This notification is triggered when the value of
"This notification is triggered when the value of natv2InstancePortMapEntries becomes greater than or equal
natv2SubscriberPortMapEntries for an individual subscriber to the value of natv2InstanceThresholdPortMapEntriesHigh,
becomes greater than or equal to the value of the unless disabled by setting that threshold to -1. Reporting
natv2SubscriberThresholdPortMapEntriesHigh object for that is subject to the rate limitation given by
subscriber, unless disabled by setting that threshold to -1. natv2InstanceNotificationInterval.
Reporting is subject to the rate limitation given by natv2InstancePortMapEntries and
natv2SubscriberNotificationInterval. natv2InstancePortMapCreations are members of table
natv2InstanceTable indexed by the identifier of the NAT
instance for which the event is being reported. The values
reported are those observed at the moment the notification
was triggered."
::= { natv2MIBNotifications 4 }
natv2SubscriberPortMapEntries and natv2NotificationSubscriberPortMappingEntriesHigh
natv2SubscriberPortMapCreations are members of table NOTIFICATION-TYPE
natv2SubscriberTable indexed by the subscriber for OBJECTS { natv2SubscriberPortMapEntries,
which the event is being reported. The values natv2SubscriberPortMapCreations }
reported are those observed at the moment the notification STATUS current
was triggered." DESCRIPTION
::= { natv2MIBNotifications 5 } "This notification is triggered when the value of
natv2SubscriberPortMapEntries for an individual subscriber
becomes greater than or equal to the value of the
natv2SubscriberThresholdPortMapEntriesHigh object for that
subscriber, unless disabled by setting that threshold to -1.
Reporting is subject to the rate limitation given by
natv2SubscriberNotificationInterval.
-- Device-level objects natv2SubscriberPortMapEntries and
natv2SubscriberPortMapCreations are members of table
natv2SubscriberTable indexed by the subscriber for
which the event is being reported. The values
reported are those observed at the moment the notification
was triggered."
::= { natv2MIBNotifications 5 }
natv2MIBDeviceObjects OBJECT IDENTIFIER ::= { natv2MIB 1 } -- Device-level objects
-- subscriber table natv2MIBDeviceObjects OBJECT IDENTIFIER ::= { natv2MIB 1 }
natv2SubscriberTable OBJECT-TYPE -- Subscriber table
SYNTAX SEQUENCE OF Natv2SubscriberEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Table of subscribers. As well as the subscriber index, it
provides per-subscriber state and counter objects, a last
discontinuity time object for the counters, and writable
threshold value and limit on port consumption."
REFERENCE
"RFC yyyy Section 3.3.3."
::= { natv2MIBDeviceObjects 1 }
natv2SubscriberEntry OBJECT-TYPE natv2SubscriberTable OBJECT-TYPE
SYNTAX Natv2SubscriberEntry SYNTAX SEQUENCE OF Natv2SubscriberEntry
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Each entry describes a single subscriber." "Table of subscribers. As well as the subscriber index, it
INDEX { natv2SubscriberIndex } provides per-subscriber state and counter objects, a last
::= { natv2SubscriberTable 1 } discontinuity time object for the counters, and a writable
threshold value and limit on port consumption."
REFERENCE
"RFC 7659, Section 3.3.3."
::= { natv2MIBDeviceObjects 1 }
Natv2SubscriberEntry ::= natv2SubscriberEntry OBJECT-TYPE
SEQUENCE { SYNTAX Natv2SubscriberEntry
natv2SubscriberIndex Natv2SubscriberIndex, MAX-ACCESS not-accessible
natv2SubscriberInternalRealm SnmpAdminString, STATUS current
natv2SubscriberInternalPrefixType InetAddressType, DESCRIPTION
natv2SubscriberInternalPrefix InetAddress, "Each entry describes a single subscriber."
natv2SubscriberInternalPrefixLength InetAddressPrefixLength, INDEX { natv2SubscriberIndex }
-- State ::= { natv2SubscriberTable 1 }
natv2SubscriberAddressMapEntries Unsigned32,
natv2SubscriberPortMapEntries Unsigned32,
-- Counters and last discontinuity time
natv2SubscriberTranslations Counter64,
natv2SubscriberAddressMapCreations Counter64,
natv2SubscriberPortMapCreations Counter64,
natv2SubscriberAddressMapFailureDrops Counter64,
natv2SubscriberPortMapFailureDrops Counter64,
natv2SubscriberDiscontinuityTime TimeStamp,
-- Read-write controls
natv2SubscriberLimitPortMapEntries Unsigned32,
-- Disable notifications by setting threshold to -1
natv2SubscriberThresholdPortMapEntriesHigh Integer32,
-- Disable limit by setting to 0
natv2SubscriberNotificationInterval Unsigned32
}
natv2SubscriberIndex OBJECT-TYPE Natv2SubscriberEntry ::=
SYNTAX Natv2SubscriberIndex SEQUENCE {
MAX-ACCESS not-accessible natv2SubscriberIndex Natv2SubscriberIndex,
STATUS current natv2SubscriberInternalRealm SnmpAdminString,
DESCRIPTION natv2SubscriberInternalPrefixType InetAddressType,
"A unique value, greater than zero, for each subscriber natv2SubscriberInternalPrefix InetAddress,
in the managed system. The value for each natv2SubscriberInternalPrefixLength InetAddressPrefixLength,
subscriber MUST remain constant at least from one -- State
update of the entity's natv2SubscriberDiscontinuityTime natv2SubscriberAddressMapEntries Unsigned32,
object until the next update of that object. If a natv2SubscriberPortMapEntries Unsigned32,
subscriber is deleted, its assigned index value MUST NOT
be assigned to another subscriber at least until
reinitialization of the entity's management system."
::= { natv2SubscriberEntry 1 }
-- Configuration for this subscriber: realm, internal address(es) -- Counters and last discontinuity time
natv2SubscriberTranslations Counter64,
natv2SubscriberAddressMapCreations Counter64,
natv2SubscriberPortMapCreations Counter64,
natv2SubscriberAddressMapFailureDrops Counter64,
natv2SubscriberPortMapFailureDrops Counter64,
natv2SubscriberDiscontinuityTime TimeStamp,
-- Read-write controls
natv2SubscriberLimitPortMapEntries Unsigned32,
-- Disable notifications by setting threshold to -1
natv2SubscriberThresholdPortMapEntriesHigh Integer32,
-- Disable limit by setting to 0
natv2SubscriberNotificationInterval Unsigned32
}
natv2SubscriberInternalRealm OBJECT-TYPE natv2SubscriberIndex OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(0..32)) SYNTAX Natv2SubscriberIndex
MAX-ACCESS read-only MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The address realm to which this subscriber belongs. A realm "A unique value, greater than zero, for each subscriber
defines an address space. All NATs support at least two in the managed system. The value for each
realms. subscriber MUST remain constant at least from one
update of the entity's natv2SubscriberDiscontinuityTime
object until the next update of that object. If a
subscriber is deleted, its assigned index value MUST NOT
be assigned to another subscriber at least until
reinitialization of the entity's management system."
::= { natv2SubscriberEntry 1 }
The default realm for subscribers is 'internal'. -- Configuration for this subscriber: realm, internal address(es)
Administrators can set other values for individual
subscribers when they are configured. The administrator MAY
configure a new value of natv2SubscriberRealm at any time
subsequent to initial configuration of the subscriber. If
this happens, it MUST be treated as a point of discontinuity
requiring an update of natv2SubscriberDiscontinuityTime.
When the subscriber sends a packet to the NAT through a natv2SubscriberInternalRealm OBJECT-TYPE
DS-Lite [RFC 6333] tunnel, this is the realm of the outer SYNTAX SnmpAdminString (SIZE(0..32))
packet header source address. Other tunneled access is out MAX-ACCESS read-only
of scope." STATUS current
REFERENCE DESCRIPTION
"Address realm: RFC 2663. DS-Lite: RFC 6333." "The address realm to which this subscriber belongs. A realm
DEFVAL defines an address space. All NATs support at least two
{ "internal" } realms.
::= { natv2SubscriberEntry 2 }
natv2SubscriberInternalPrefixType OBJECT-TYPE The default realm for subscribers is 'internal'.
SYNTAX InetAddressType Administrators can set other values for individual
MAX-ACCESS read-only subscribers when they are configured. The administrator MAY
STATUS current configure a new value of natv2SubscriberRealm at any time
DESCRIPTION subsequent to initial configuration of the subscriber. If
"Subscriber's internal prefix type. Any value other than this happens, it MUST be treated as a point of discontinuity
ipv4(1) or ipv6(2) would be unexpected. In the case of requiring an update of natv2SubscriberDiscontinuityTime.
DS-Lite access, this is the prefix type (IPv6(2)) used in
the outer packet header."
REFERENCE
"DS-Lite: RFC 6333."
::= { natv2SubscriberEntry 3 }
natv2SubscriberInternalPrefix OBJECT-TYPE When the subscriber sends a packet to the NAT through a
SYNTAX InetAddress DS-Lite (RFC 6333) tunnel, this is the realm of the outer
MAX-ACCESS read-only packet header source address. Other tunneled access is out
STATUS current of scope."
DESCRIPTION REFERENCE
"Prefix assigned to a subscriber's CPE. The type of this "Address realm: RFC 2663. DS-Lite: RFC 6333."
prefix is given by natv2SubscriberInternalPrefixType. Source DEFVAL
addresses of packets outgoing from the subscriber will be { "internal" }
contained within this prefix. In the case of DS-Lite ::= { natv2SubscriberEntry 2 }
access, the source address taken from the prefix will be
that of the outer header."
REFERENCE
"DS-Lite: RFC 6333."
::= { natv2SubscriberEntry 4 }
natv2SubscriberInternalPrefixLength OBJECT-TYPE natv2SubscriberInternalPrefixType OBJECT-TYPE
SYNTAX InetAddressPrefixLength SYNTAX InetAddressType
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Length of the prefix assigned to a subscriber's CPE, in "Subscriber's internal prefix type. Any value other than
bits. If a single address is assigned, this will be 32 ipv4(1) or ipv6(2) would be unexpected. In the case of
for IPv4 and 128 for IPv6." DS-Lite access, this is the prefix type (IPv6(2)) used in
::= { natv2SubscriberEntry 5 } the outer packet header."
REFERENCE
"DS-Lite: RFC 6333."
::= { natv2SubscriberEntry 3 }
-- State objects natv2SubscriberInternalPrefix OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Prefix assigned to a subscriber's Customer Premises Equipment
(CPE). The type of this prefix is given by
natv2SubscriberInternalPrefixType. Source addresses of packets
outgoing from the subscriber will be contained within this
prefix. In the case of DS-Lite access, the source address
taken from the prefix will be that of the outer header."
REFERENCE
"DS-Lite: RFC 6333."
::= { natv2SubscriberEntry 4 }
natv2SubscriberAddressMapEntries OBJECT-TYPE natv2SubscriberInternalPrefixLength OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX InetAddressPrefixLength
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The current number of address map entries for the "Length of the prefix assigned to a subscriber's CPE, in
subscriber, including static mappings. An address map entry bits. If a single address is assigned, this will be 32
maps from a given internal address and realm to an external for IPv4 and 128 for IPv6."
address in a particular external realm. This definition ::= { natv2SubscriberEntry 5 }
includes 'hairpin' mappings, where the external realm is the
same as the internal one. Address map entries are also
tracked per instance and per address pool within the
instance."
REFERENCE
"RFC yyyy Section 3.3.8."
::= { natv2SubscriberEntry 6 }
natv2SubscriberPortMapEntries OBJECT-TYPE -- State objects
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The current number of port map entries in the port map table
for the subscriber, including static mappings. A port map
entry maps from a given external realm, address, and port
for a given protocol to an internal realm, address, and
port. This definition includes 'hairpin' mappings, where the
external realm is the same as the internal one. Port map
entries are also tracked per instance and per protocol and
address pool within the instance."
REFERENCE
"RFC yyyy Section 3.3.9."
::= { natv2SubscriberEntry 7 }
-- Counters and last discontinuity time natv2SubscriberAddressMapEntries OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The current number of address map entries for the
subscriber, including static mappings. An address map entry
maps from a given internal address and realm to an external
address in a particular external realm. This definition
includes 'hairpin' mappings, where the external realm is the
same as the internal one. Address map entries are also
tracked per instance and per address pool within the
instance."
REFERENCE
"RFC 7659, Section 3.3.8."
::= { natv2SubscriberEntry 6 }
natv2SubscriberTranslations OBJECT-TYPE natv2SubscriberPortMapEntries OBJECT-TYPE
SYNTAX Counter64 SYNTAX Unsigned32
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The cumulative number of translated packets received from or "The current number of port map entries in the port map table
sent to this subscriber. This value MUST be monotone for the subscriber, including static mappings. A port map
increasing in the periods between updates of the entity's entry maps from a given external realm, address, and port
natv2SubscriberDiscontinuityTime. If a manager detects a for a given protocol to an internal realm, address, and
change in the latter since the last time it sampled this port. This definition includes 'hairpin' mappings, where the
counter, it SHOULD NOT make use of the difference between external realm is the same as the internal one. Port map
the latest value of the counter and any value retrieved entries are also tracked per instance and per protocol and
before the new value of natv2SubscriberDiscontinuityTime." address pool within the instance."
::= { natv2SubscriberEntry 8 } REFERENCE
"RFC 7659, Section 3.3.9."
::= { natv2SubscriberEntry 7 }
natv2SubscriberAddressMapCreations OBJECT-TYPE -- Counters and last discontinuity time
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The cumulative number of address map entries created for
this subscriber, including static mappings. Address map
entries are also tracked per instance and per protocol and
address pool within the instance.
This value MUST be monotone increasing in natv2SubscriberTranslations OBJECT-TYPE
the periods between updates of the entity's SYNTAX Counter64
natv2SubscriberDiscontinuityTime. If a manager detects a MAX-ACCESS read-only
change in the latter since the last time it sampled this STATUS current
counter, it SHOULD NOT make use of the difference between DESCRIPTION
the latest value of the counter and any value retrieved "The cumulative number of translated packets received from or
before the new value of natv2SubscriberDiscontinuityTime." sent to this subscriber. This value MUST be monotone
::= { natv2SubscriberEntry 9 } increasing in the periods between updates of the entity's
natv2SubscriberDiscontinuityTime. If a manager detects a
change in the latter since the last time it sampled this
counter, it SHOULD NOT make use of the difference between
the latest value of the counter and any value retrieved
before the new value of natv2SubscriberDiscontinuityTime."
::= { natv2SubscriberEntry 8 }
natv2SubscriberPortMapCreations OBJECT-TYPE natv2SubscriberAddressMapCreations OBJECT-TYPE
SYNTAX Counter64 SYNTAX Counter64
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The cumulative number of port map entries created for this "The cumulative number of address map entries created for
subscriber, including static mappings. Port map entries are this subscriber, including static mappings. Address map
also tracked per instance and per protocol and address pool entries are also tracked per instance and per protocol and
within the instance. address pool within the instance.
This value MUST be monotone increasing in the periods This value MUST be monotone increasing in
between updates of the entity's the periods between updates of the entity's
natv2SubscriberDiscontinuityTime. If a manager detects a natv2SubscriberDiscontinuityTime. If a manager detects a
change in the latter since the last time it sampled this change in the latter since the last time it sampled this
counter, it SHOULD NOT make use of the difference between counter, it SHOULD NOT make use of the difference between
the latest value of the counter and any value retrieved the latest value of the counter and any value retrieved
before the new value of natv2SubscriberDiscontinuityTime." before the new value of natv2SubscriberDiscontinuityTime."
::= { natv2SubscriberEntry 10 } ::= { natv2SubscriberEntry 9 }
natv2SubscriberAddressMapFailureDrops OBJECT-TYPE natv2SubscriberPortMapCreations OBJECT-TYPE
SYNTAX Counter64 SYNTAX Counter64
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The cumulative number of packets originated by this "The cumulative number of port map entries created for this
subscriber that were dropped because the packet would have subscriber, including static mappings. Port map entries are
triggered the creation of a new address map entry, but no also tracked per instance and per protocol and address pool
address could be allocated in the selected external realm within the instance.
because all addresses from the selected address pool (or the
whole realm, if no address pool has been configured for that
realm) have already been fully allocated.
This value MUST be monotone increasing in the periods This value MUST be monotone increasing in the periods
between updates of the entity's between updates of the entity's
natv2SubscriberDiscontinuityTime. If a manager detects a natv2SubscriberDiscontinuityTime. If a manager detects a
change in the latter since the last time it sampled this change in the latter since the last time it sampled this
counter, it SHOULD NOT make use of the difference between counter, it SHOULD NOT make use of the difference between
the latest value of the counter and any value retrieved the latest value of the counter and any value retrieved
before the new value of natv2SubscriberDiscontinuityTime." before the new value of natv2SubscriberDiscontinuityTime."
::= { natv2SubscriberEntry 11 } ::= { natv2SubscriberEntry 10 }
natv2SubscriberPortMapFailureDrops OBJECT-TYPE natv2SubscriberAddressMapFailureDrops OBJECT-TYPE
SYNTAX Counter64 SYNTAX Counter64
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The cumulative number of packets dropped because the "The cumulative number of packets originated by this
packet would have triggered the creation of a new subscriber that were dropped because the packet would have
port mapping, but no port could be allocated for the triggered the creation of a new address map entry, but no
protocol concerned. The usual case for this will be address could be allocated in the selected external realm
for a NAT instance that supports address pooling and because all addresses from the selected address pool (or the
the 'paired' pooling behavior recommended by RFC 4787, whole realm, if no address pool has been configured for that
where the internal endpoint has used up all of the realm) have already been fully allocated.
ports allocated to it for the address it was mapped to
in the selected address pool in the external realm
concerned and cannot be given more ports because
- policy or implementation prevents it from having a
second address in the same pool, and
- policy or unavailability prevents it from acquiring
more ports at its originally assigned address.
If the NAT instance supports address pooling but its This value MUST be monotone increasing in the periods
pooling behavior is 'arbitrary' (meaning that between updates of the entity's
the NAT instance can allocate a new port mapping for natv2SubscriberDiscontinuityTime. If a manager detects a
the given internal endpoint on any address in the change in the latter since the last time it sampled this
selected address pool and is not bound to what it has counter, it SHOULD NOT make use of the difference between
already mapped for that endpoint), then this counter the latest value of the counter and any value retrieved
is incremented when all ports for the protocol concerned before the new value of natv2SubscriberDiscontinuityTime."
over the whole of the selected address pool are already ::= { natv2SubscriberEntry 11 }
in use.
As a third case, if no address pools have been configured natv2SubscriberPortMapFailureDrops OBJECT-TYPE
for the external realm concerned, then this counter is SYNTAX Counter64
incremented because all ports for the protocol involved over MAX-ACCESS read-only
the whole set of addresses available for that external realm STATUS current
are already in use. DESCRIPTION
"The cumulative number of packets dropped because the
packet would have triggered the creation of a new
port mapping, but no port could be allocated for the
protocol concerned. The usual case for this will be
for a NAT instance that supports address pooling and
the 'Paired' pooling behavior recommended by RFC 4787,
where the internal endpoint has used up all of the
ports allocated to it for the address it was mapped to
in the selected address pool in the external realm
concerned and cannot be given more ports because
- policy or implementation prevents it from having a
second address in the same pool, and
- policy or unavailability prevents it from acquiring
more ports at its originally assigned address.
Finally, this counter is incremented if the packet would If the NAT instance supports address pooling but its
have triggered the creation of a new port mapping, but the pooling behavior is 'Arbitrary' (meaning that
current value of natv2SubscriberPortMapEntries equals or the NAT instance can allocate a new port mapping for
exceeds the value of natv2SubscriberLimitPortMapEntries the given internal endpoint on any address in the
for this subscriber (unless that limit is disabled). selected address pool and is not bound to what it has
already mapped for that endpoint), then this counter
is incremented when all ports for the protocol concerned
over the whole of the selected address pool are already
in use.
This value MUST be monotone increasing in the periods As a third case, if no address pools have been configured
between updates of the entity's for the external realm concerned, then this counter is
natv2SubscriberDiscontinuityTime. If a manager detects a incremented because all ports for the protocol involved over
change in the latter since the last time it sampled this the whole set of addresses available for that external realm
counter, it SHOULD NOT make use of the difference between are already in use.
the latest value of the counter and any value retrieved
before the new value of natv2SubscriberDiscontinuityTime."
REFERENCE
"Pooling behavior: RFC 4787, end of section 4.1."
::= { natv2SubscriberEntry 12 }
natv2SubscriberDiscontinuityTime OBJECT-TYPE Finally, this counter is incremented if the packet would
SYNTAX TimeStamp have triggered the creation of a new port mapping, but the
MAX-ACCESS read-only current value of natv2SubscriberPortMapEntries equals or
STATUS current exceeds the value of natv2SubscriberLimitPortMapEntries
DESCRIPTION for this subscriber (unless that limit is disabled).
"Snapshot of the value of the sysUpTime object at the
beginning of the latest period of continuity of the
statistical counters associated with this subscriber."
::= { natv2SubscriberEntry 14 }
-- Per-subscriber limit and threshold on port mappings This value MUST be monotone increasing in the periods
-- Disabled if set to zero between updates of the entity's
natv2SubscriberLimitPortMapEntries OBJECT-TYPE natv2SubscriberDiscontinuityTime. If a manager detects a
SYNTAX Unsigned32 change in the latter since the last time it sampled this
MAX-ACCESS read-write counter, it SHOULD NOT make use of the difference between
STATUS current the latest value of the counter and any value retrieved
DESCRIPTION before the new value of natv2SubscriberDiscontinuityTime."
"Limit on total number of port mappings active for this REFERENCE
subscriber (natv2SubscriberPortMapEntries). Once this limit "Pooling behavior: RFC 4787, end of Section 4.1."
is reached, packets that might have triggered new port ::= { natv2SubscriberEntry 12 }
mappings are dropped. The number of such packets dropped is
counted in natv2InstancePortMapFailureDrops.
Limit is disabled if set to zero." natv2SubscriberDiscontinuityTime OBJECT-TYPE
DEFVAL SYNTAX TimeStamp
{ 0 } MAX-ACCESS read-only
::= { natv2SubscriberEntry 15 } STATUS current
DESCRIPTION
"Snapshot of the value of the sysUpTime object at the
beginning of the latest period of continuity of the
statistical counters associated with this subscriber."
::= { natv2SubscriberEntry 14 }
natv2SubscriberThresholdPortMapEntriesHigh OBJECT-TYPE -- Per-subscriber limit and threshold on port mappings
SYNTAX Integer32 -- Disabled if set to zero
MAX-ACCESS read-write natv2SubscriberLimitPortMapEntries OBJECT-TYPE
STATUS current SYNTAX Unsigned32
DESCRIPTION MAX-ACCESS read-write
"Notification threshold for total number of port mappings STATUS current
active for this subscriber. Whenever DESCRIPTION
natv2SubscriberPortMapEntries is updated, if it equals or "Limit on total number of port mappings active for this
exceeds natv2SubscriberThresholdPortMapEntriesHigh, the subscriber (natv2SubscriberPortMapEntries). Once this limit
notification is reached, packets that might have triggered new port
natv2NotificationSubscriberPortMappingEntriesHigh is mappings are dropped. The number of such packets dropped is
triggered, unless the notification is disabled by setting counted in natv2InstancePortMapFailureDrops.
the threshold to -1. Reporting is subject to the minimum
inter-notification interval given by
natv2SubscriberNotificationInterval. If multiple
notifications are triggered during one interval, the agent
MUST report only the one containing the highest value of
natv2SubscriberPortMapEntries and discard the others."
DEFVAL
{ -1 }
::= { natv2SubscriberEntry 16 }
natv2SubscriberNotificationInterval OBJECT-TYPE Limit is disabled if set to zero."
SYNTAX Unsigned32 (1..3600)
UNITS
"Seconds"
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Minimum number of seconds between successive
reporting of notifications for this subscriber. Controls the
reporting of
natv2NotificationSubscriberPortMappingEntriesHigh."
DEFVAL
{ 60 }
::= { natv2SubscriberEntry 17 }
-- Per-NAT-instance objects DEFVAL
{ 0 }
::= { natv2SubscriberEntry 15 }
natv2MIBInstanceObjects OBJECT IDENTIFIER ::= { natv2MIB 2 } natv2SubscriberThresholdPortMapEntriesHigh OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Notification threshold for total number of port mappings
active for this subscriber. Whenever
natv2SubscriberPortMapEntries is updated, if it equals or
exceeds natv2SubscriberThresholdPortMapEntriesHigh, the
notification
natv2NotificationSubscriberPortMappingEntriesHigh is
triggered, unless the notification is disabled by setting
the threshold to -1. Reporting is subject to the minimum
inter-notification interval given by
natv2SubscriberNotificationInterval. If multiple
notifications are triggered during one interval, the agent
MUST report only the one containing the highest value of
natv2SubscriberPortMapEntries and discard the others."
DEFVAL
{ -1 }
::= { natv2SubscriberEntry 16 }
-- Instance table natv2SubscriberNotificationInterval OBJECT-TYPE
natv2InstanceTable OBJECT-TYPE SYNTAX Unsigned32 (1..3600)
SYNTAX SEQUENCE OF Natv2InstanceEntry UNITS
MAX-ACCESS not-accessible "Seconds"
STATUS current MAX-ACCESS read-write
DESCRIPTION STATUS current
"Table of NAT instances. As well as state and counter DESCRIPTION
objects, it provides the instance index, instance name, and "Minimum number of seconds between successive
the last discontinuity time object which is applicable to reporting of notifications for this subscriber. Controls
the counters. It also contains writable thresholds for the reporting of
reporting of notifications and limits on usage of resources natv2NotificationSubscriberPortMappingEntriesHigh."
at the level of the NAT instance. DEFVAL
{ 60 }
::= { natv2SubscriberEntry 17 }
It is assumed that NAT instances can be created and deleted -- Per-NAT-instance objects
dynamically, but this MIB module does not provide the means
to do so. For restrictions on assignment and maintenance of
the NAT index instance see the description of
natv2InstanceIndex in the table below. For the requirements
on maintenance of the values of the counters in this table
see the description of natv2InstanceDiscontinuityTime in
this table.
Each NAT instance has its own resources and behavior. The natv2MIBInstanceObjects OBJECT IDENTIFIER ::= { natv2MIB 2 }
resources include memory as reflected in space for map
entries, processing power as reflected in the rate of map
creation and deletion, and mappable addresses in each realm
that can play the role of an external realm for at least
some mappings for that instance. The NAT instance table
includes limits and notification thresholds that relate to
memory usage for mapping at the level of the whole instance.
The limit on number of subscribers with active mappings is a
limit to some extent on processor usage.
The mappable 'external' addresses may or may not be -- Instance table
organized into address pools. For a definition of address natv2InstanceTable OBJECT-TYPE
pools see the description of natv2PoolTable. If the instance SYNTAX SEQUENCE OF Natv2InstanceEntry
does support address pools, it also has a pooling behavior. MAX-ACCESS not-accessible
Mapping, filtering, and pooling behavior are defined in the STATUS current
descriptions of the natv2InstancePortMappingBehavior, DESCRIPTION
natv2InstanceFilteringBehavior, and "Table of NAT instances. As well as state and counter
natv2InstancePoolingBehavior objects in this table. The objects, it provides the instance index, instance name, and
instance also has a fragmentation behavior, defined in the the last discontinuity time object that is applicable to
description of the natv2InstanceFragmentBehavior object." the counters. It also contains writable thresholds for
REFERENCE reporting of notifications and limits on usage of resources
"RFC yyyy Section 3.3.4. NAT behaviors: RFC 4787 at the level of the NAT instance.
(primary, UDP); RFC 5382 (TCP), RFC 5508 (ICMP), RFC5597
(DCCP)."
::= { natv2MIBInstanceObjects 1 }
natv2InstanceEntry OBJECT-TYPE It is assumed that NAT instances can be created and deleted
SYNTAX Natv2InstanceEntry dynamically, but this MIB module does not provide the means
MAX-ACCESS not-accessible to do so. For restrictions on assignment and maintenance of
STATUS current the NAT index instance, see the description of
DESCRIPTION natv2InstanceIndex in the table below. For the requirements
"Objects related to a single NAT instance." on maintenance of the values of the counters in this table,
INDEX { natv2InstanceIndex } see the description of natv2InstanceDiscontinuityTime in
::= { natv2InstanceTable 1 } this table.
Natv2InstanceEntry ::= Each NAT instance has its own resources and behavior. The
SEQUENCE { resources include memory as reflected in space for map
natv2InstanceIndex Natv2InstanceIndex, entries, processing power as reflected in the rate of map
natv2InstanceAlias DisplayString, creation and deletion, and mappable addresses in each realm
-- Configured behaviors that can play the role of an external realm for at least
natv2InstancePortMappingBehavior INTEGER, some mappings for that instance. The NAT instance table
natv2InstanceFilteringBehavior INTEGER, includes limits and notification thresholds that relate to
natv2InstancePoolingBehavior INTEGER, memory usage for mapping at the level of the whole instance.
natv2InstanceFragmentBehavior INTEGER, The limit on number of subscribers with active mappings is a
-- State limit to some extent on processor usage.
natv2InstanceAddressMapEntries Unsigned32,
natv2InstancePortMapEntries Unsigned32,
-- Statistics and discontinuity time
natv2InstanceTranslations Counter64,
natv2InstanceAddressMapCreations Counter64,
natv2InstancePortMapCreations Counter64,
natv2InstanceAddressMapEntryLimitDrops Counter64,
natv2InstancePortMapEntryLimitDrops Counter64,
natv2InstanceSubscriberActiveLimitDrops Counter64,
natv2InstanceAddressMapFailureDrops Counter64,
natv2InstancePortMapFailureDrops Counter64,
natv2InstanceFragmentDrops Counter64,
natv2InstanceOtherResourceFailureDrops Counter64,
natv2InstanceDiscontinuityTime TimeStamp,
-- Notification thresholds, disabled if set to -1
natv2InstanceThresholdAddressMapEntriesHigh Integer32,
natv2InstanceThresholdPortMapEntriesHigh Integer32,
natv2InstanceNotificationInterval Unsigned32,
-- Limits, disabled if set to 0
natv2InstanceLimitAddressMapEntries Unsigned32,
natv2InstanceLimitPortMapEntries Unsigned32,
natv2InstanceLimitPendingFragments Unsigned32,
natv2InstanceLimitSubscriberActives Unsigned32
}
natv2InstanceIndex OBJECT-TYPE The mappable 'external' addresses may or may not be
SYNTAX Natv2InstanceIndex organized into address pools. For a definition of address
MAX-ACCESS not-accessible pools, see the description of natv2PoolTable. If the instance
STATUS current does support address pools, it also has a pooling behavior.
DESCRIPTION Mapping, filtering, and pooling behavior are defined in the
"NAT instance index. It is up to the implementation to descriptions of the natv2InstancePortMappingBehavior,
determine which values correspond to in-service NAT natv2InstanceFilteringBehavior, and
instances. This object is used as an index for all tables natv2InstancePoolingBehavior objects in this table. The
defined below." instance also has a fragmentation behavior, defined in the
::= { natv2InstanceEntry 1 } description of the natv2InstanceFragmentBehavior object."
REFERENCE
"RFC 7659, Section 3.3.4.
NAT behaviors: RFC 4787 (primary, UDP); RFC 5382 (TCP);
RFC 5508 (ICMP); and RFC 5597 (Datagram Congestion Control
Protocol (DCCP))."
::= { natv2MIBInstanceObjects 1 }
natv2InstanceAlias OBJECT-TYPE natv2InstanceEntry OBJECT-TYPE
SYNTAX DisplayString (SIZE (0..64)) SYNTAX Natv2InstanceEntry
MAX-ACCESS read-only MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"This object is an 'alias' name for the NAT instance as "Objects related to a single NAT instance."
specified by a network manager, and provides a non-volatile INDEX { natv2InstanceIndex }
'handle' for the instance. ::= { natv2InstanceTable 1 }
An example of the value which a network manager might store Natv2InstanceEntry ::=
in this object for a NAT instance is the name/identifier of SEQUENCE {
the interface that brings in internal traffic for this NAT natv2InstanceIndex Natv2InstanceIndex,
instance or the name of the VRF for internal traffic." natv2InstanceAlias DisplayString,
::= { natv2InstanceEntry 2 } -- Configured behaviors
natv2InstancePortMappingBehavior INTEGER,
natv2InstanceFilteringBehavior INTEGER,
natv2InstancePoolingBehavior INTEGER,
natv2InstanceFragmentBehavior INTEGER,
-- State
natv2InstanceAddressMapEntries Unsigned32,
natv2InstancePortMapEntries Unsigned32,
-- Statistics and discontinuity time
natv2InstanceTranslations Counter64,
natv2InstanceAddressMapCreations Counter64,
natv2InstancePortMapCreations Counter64,
natv2InstanceAddressMapEntryLimitDrops Counter64,
natv2InstancePortMapEntryLimitDrops Counter64,
natv2InstanceSubscriberActiveLimitDrops Counter64,
natv2InstanceAddressMapFailureDrops Counter64,
natv2InstancePortMapFailureDrops Counter64,
natv2InstanceFragmentDrops Counter64,
natv2InstanceOtherResourceFailureDrops Counter64,
natv2InstanceDiscontinuityTime TimeStamp,
-- Notification thresholds, disabled if set to -1
natv2InstanceThresholdAddressMapEntriesHigh Integer32,
natv2InstanceThresholdPortMapEntriesHigh Integer32,
natv2InstanceNotificationInterval Unsigned32,
-- Limits, disabled if set to 0
natv2InstanceLimitAddressMapEntries Unsigned32,
natv2InstanceLimitPortMapEntries Unsigned32,
natv2InstanceLimitPendingFragments Unsigned32,
natv2InstanceLimitSubscriberActives Unsigned32
}
-- Configured behaviors natv2InstanceIndex OBJECT-TYPE
SYNTAX Natv2InstanceIndex
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"NAT instance index. It is up to the implementation to
determine which values correspond to in-service NAT
instances. This object is used as an index for all tables
defined below."
::= { natv2InstanceEntry 1 }
natv2InstancePortMappingBehavior OBJECT-TYPE natv2InstanceAlias OBJECT-TYPE
SYNTAX INTEGER { SYNTAX DisplayString (SIZE (0..64))
endpointIndependent (0), MAX-ACCESS read-only
addressDependent (1), STATUS current
addressAndPortDependent (2) DESCRIPTION
} "This object is an 'alias' name for the NAT instance as
MAX-ACCESS read-only specified by a network manager and provides a non-volatile
STATUS current 'handle' for the instance.
DESCRIPTION
"Port mapping behavior is the policy governing selection of
external address and port in a given realm for a given
five-tuple of source address and port, destination address
and port, and protocol.
endpointIndependent(0), the behavior REQUIRED by RFC 4787 An example of the value that a network manager might store
REQ-1, maps the source address and port to the same in this object for a NAT instance is the name/identifier of
external address and port for all destination address and the interface that brings in internal traffic for this NAT
port combinations reached through the same external realm instance or the name of the Virtual Routing and Forwarding
and using the given protocol. (VRF) for internal traffic."
::= { natv2InstanceEntry 2 }
addressDependent(1) maps to the same external address and -- Configured behaviors
port for all destination ports at the same destination
address reached through the same external realm and using
the given protocol.
addressAndPortDependent(2) maps to a separate external natv2InstancePortMappingBehavior OBJECT-TYPE
address and port combination for each different SYNTAX INTEGER {
destination address and port combination reached through endpointIndependent (0),
the same external realm." addressDependent (1),
REFERENCE addressAndPortDependent (2)
"RFC 4787 section 4.1." }
::= { natv2InstanceEntry 3 } MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Port mapping behavior is the policy governing the selection
of external address and port in a given realm for a given
five-tuple of source address and port, destination address
and port, and protocol.
natv2InstanceFilteringBehavior OBJECT-TYPE endpointIndependent(0), the behavior REQUIRED by RFC 4787,
SYNTAX INTEGER { REQ-1, maps the source address and port to the same
endpointIndependent (0), external address and port for all destination address and
addressDependent (1), port combinations reached through the same external realm
addressAndPortDependent (2) and using the given protocol.
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Filtering behavior is the policy governing acceptance or
dropping of packets incoming from remote sources via a
given external realm and destined to a specific three-tuple
of external address, port, and protocol at the NAT instance
that has been assigned in a port mapping.
endpointIndependent(0) accepts for translation packets from addressDependent(1) maps to the same external address and
all combinations of remote address and port destined to the port for all destination ports at the same destination
mapped external address and port via the given external address reached through the same external realm and using
realm and using the given protocol. the given protocol.
addressDependent(1) accepts for translation packets from all addressAndPortDependent(2) maps to a separate external
remote ports from the same remote source address destined to address and port combination for each different
the mapped external address and port via the given external destination address and port combination reached through
realm and using the given protocol. the same external realm."
REFERENCE
"RFC 4787, Section 4.1."
::= { natv2InstanceEntry 3 }
addressAndPortDependent(2) accepts for translation only natv2InstanceFilteringBehavior OBJECT-TYPE
those packets with the same remote source address, port, and SYNTAX INTEGER {
protocol incoming from the same external realm as identified endpointIndependent (0),
when the applicable port map entry was created. addressDependent (1),
addressAndPortDependent (2)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Filtering behavior is the policy governing acceptance or
the dropping of packets incoming from remote sources via a
given external realm and destined to a specific three-tuple
of external address, port, and protocol at the NAT instance
that has been assigned in a port mapping.
RFC 4787 REQ-8 recommends either endpointIndependent(0) or endpointIndependent(0) accepts for translation packets from
addressDependent(1) filtering behavior depending on whether all combinations of remote address and port destined to the
application-friendliness or security takes priority." mapped external address and port via the given external
REFERENCE realm and using the given protocol.
"RFC 4787 section 5."
::= { natv2InstanceEntry 4 }
natv2InstancePoolingBehavior OBJECT-TYPE addressDependent(1) accepts for translation packets from all
SYNTAX INTEGER { remote ports from the same remote source address destined to
arbitrary (0), the mapped external address and port via the given external
paired (1) realm and using the given protocol.
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Pooling behavior is the policy used to select the address
for a new port mapping within a given address pool to which
the internal address has already been mapped.
arbitrary(0) pooling behavior means that the NAT instance addressAndPortDependent(2) accepts for translation only
may create the new port mapping using any address in the those packets with the same remote source address, port, and
pool that has a free port for the protocol concerned. protocol incoming from the same external realm as identified
when the applicable port map entry was created.
paired(1) pooling behavior, the behavior RECOMMENDED by RFC RFC 4787, REQ-8 recommends either endpointIndependent(0) or
4787 REQ-2, means that once a given internal address has addressDependent(1) filtering behavior depending on whether
been mapped to a particular address in a particular pool, application friendliness or security takes priority."
further mappings of the same internal address to that pool REFERENCE
will reuse the previously assigned pool member address." "RFC 4787, Section 5."
REFERENCE
"RFC 4787 near the end of section 4.1"
::= { natv2InstanceEntry 5 }
natv2InstanceFragmentBehavior OBJECT-TYPE ::= { natv2InstanceEntry 4 }
SYNTAX INTEGER {
fragmentNone (0),
fragmentInOrder (1),
fragmentOutOfOrder (2)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Fragment behavior is the NAT instance's capability to
receive and translate fragments incoming from remote
sources.
fragmentNone(0) implies no capability to translate incoming natv2InstancePoolingBehavior OBJECT-TYPE
fragments, so all received fragments are dropped. Each SYNTAX INTEGER {
dropped fragment is counted in natv2InstanceFragmentDrops. arbitrary (0),
paired (1)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Pooling behavior is the policy used to select the address
for a new port mapping within a given address pool to which
the internal address has already been mapped.
fragmentInOrder(1) implies the ability to translate arbitrary(0) pooling behavior means that the NAT instance
fragments only if they are received in order, so that in may create the new port mapping using any address in the
particular the header is in the first packet. If a fragment pool that has a free port for the protocol concerned.
is received out of order, it is dropped and counted in
natv2InstanceFragmentDrops.
fragmentOutOfOrder(2), the capability REQUIRED by RFC 4787 paired(1) pooling behavior, the behavior RECOMMENDED by RFC
REQ-14, implies the capability to translate fragments even 4787, REQ-2, means that once a given internal address has
when they arrive out of order, subject to a protective been mapped to a particular address in a particular pool,
limit natv2InstanceLimitPendingFragments on total number of further mappings of the same internal address to that pool
fragments awaiting the first fragment of the chain. If the will reuse the previously assigned pool member address."
implementation supports this capability, REFERENCE
natv2InstanceFragmentDrops is incremented only when a new "RFC 4787, near the end of Section 4.1"
fragment arrives but is dropped because the limit on pending ::= { natv2InstanceEntry 5 }
fragments has already been reached."
REFERENCE
"RFC 4787 section 11."
::= { natv2InstanceEntry 6 }
-- State natv2InstanceFragmentBehavior OBJECT-TYPE
SYNTAX INTEGER {
fragmentNone (0),
fragmentInOrder (1),
fragmentOutOfOrder (2)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Fragment behavior is the NAT instance's capability to
receive and translate fragments incoming from remote
sources.
natv2InstanceAddressMapEntries OBJECT-TYPE fragmentNone(0) implies no capability to translate incoming
SYNTAX Unsigned32 fragments, so all received fragments are dropped. Each
MAX-ACCESS read-only dropped fragment is counted in natv2InstanceFragmentDrops.
STATUS current
DESCRIPTION
"The current number of address map entries in total over the
whole NAT instance, including static mappings. An address
map entry maps from a given internal address and realm to an
external address in a particular external realm. This
definition includes 'hairpin' mappings, where the external
realm is the same as the internal one. Address map entries
are also tracked per subscriber and per address pool within
the instance."
REFERENCE
"RFC yyyy Section 3.3.8. RFC 4787 section 6."
::= { natv2InstanceEntry 7 }
natv2InstancePortMapEntries OBJECT-TYPE fragmentInOrder(1) implies the ability to translate
SYNTAX Unsigned32 fragments only if they are received in order, so that in
MAX-ACCESS read-only particular the header is in the first packet. If a fragment
STATUS current is received out of order, it is dropped and counted in
DESCRIPTION natv2InstanceFragmentDrops.
"The current number of entries in the port map table in total
over the whole NAT instance, including static mappings. A
port map entry maps from a given external realm, address,
and port for a given protocol to an internal realm, address,
and port. This definition includes 'hairpin' mappings, where
the external realm is the same as the internal one. Port map
entries are also tracked per subscriber and per protocol and
address pool within the instance."
REFERENCE
"RFC yyyy Section 3.3.9.
Hairpinning: RFC 4787 Section 6."
::= { natv2InstanceEntry 8 }
-- Statistics fragmentOutOfOrder(2), the capability REQUIRED by RFC 4787,
natv2InstanceTranslations OBJECT-TYPE REQ-14, implies the capability to translate fragments even
SYNTAX Counter64 when they arrive out of order, subject to a protective
MAX-ACCESS read-only limit natv2InstanceLimitPendingFragments on total number of
STATUS current fragments awaiting the first fragment of the chain. If the
DESCRIPTION implementation supports this capability,
"The cumulative number of translated packets passing through natv2InstanceFragmentDrops is incremented only when a new
this NAT instance. This value MUST be monotone increasing in fragment arrives but is dropped because the limit on pending
the periods between updates of fragments has already been reached."
natv2InstanceDiscontinuityTime. If a manager detects a REFERENCE
change in the latter since the last time it sampled this "RFC 4787, Section 11."
counter, it SHOULD NOT make use of the difference between ::= { natv2InstanceEntry 6 }
the latest value of the counter and any value retrieved
before the new value of natv2InstanceDiscontinuityTime."
::= { natv2InstanceEntry 9 }
natv2InstanceAddressMapCreations OBJECT-TYPE -- State
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The cumulative number of address map entries created by the
NAT instance, including static mappings. Address map
creations are also tracked per address pool within the
instance and per subscriber.
This value MUST be monotone increasing in natv2InstanceAddressMapEntries OBJECT-TYPE
the periods between updates of SYNTAX Unsigned32
natv2InstanceDiscontinuityTime. If a manager detects a MAX-ACCESS read-only
change in the latter since the last time it sampled this STATUS current
counter, it SHOULD NOT make use of the difference between DESCRIPTION
the latest value of the counter and any value retrieved "The current number of address map entries in total over the
before the new value of natv2InstanceDiscontinuityTime." whole NAT instance, including static mappings. An address
::= { natv2InstanceEntry 10 } map entry maps from a given internal address and realm to an
external address in a particular external realm. This
definition includes 'hairpin' mappings, where the external
realm is the same as the internal one. Address map entries
are also tracked per subscriber and per address pool within
the instance."
REFERENCE
"RFC 7659, Section 3.3.8.
Hairpinning: RFC 4787, Section 6."
::= { natv2InstanceEntry 7 }
natv2InstancePortMapCreations OBJECT-TYPE natv2InstancePortMapEntries OBJECT-TYPE
SYNTAX Counter64 SYNTAX Unsigned32
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The cumulative number of port map entries created by the "The current number of entries in the port map table in total
NAT instance, including static mappings. Port map over the whole NAT instance, including static mappings. A
creations are also tracked per protocol and address pool port map entry maps from a given external realm, address,
within the instance and per subscriber. and port for a given protocol to an internal realm, address,
and port. This definition includes 'hairpin' mappings, where
the external realm is the same as the internal one. Port map
entries are also tracked per subscriber and per protocol and
address pool within the instance."
REFERENCE
"RFC 7659, Section 3.3.9.
Hairpinning: RFC 4787, Section 6."
::= { natv2InstanceEntry 8 }
This value MUST be monotone increasing in -- Statistics
the periods between updates of
natv2InstanceDiscontinuityTime. If a manager detects a
change in the latter since the last time it sampled this
counter, it SHOULD NOT make use of the difference between
the latest value of the counter and any value retrieved
before the new value of natv2InstanceDiscontinuityTime."
::= { natv2InstanceEntry 11 }
natv2InstanceAddressMapEntryLimitDrops OBJECT-TYPE natv2InstanceTranslations OBJECT-TYPE
SYNTAX Counter64 SYNTAX Counter64
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The cumulative number of packets dropped rather than "The cumulative number of translated packets passing through
translated because the packet would have triggered this NAT instance. This value MUST be monotone increasing in
the creation of a new address map entry but the limit the periods between updates of
on number of address map entries for the NAT instance natv2InstanceDiscontinuityTime. If a manager detects a
given by natv2InstanceLimitAddressMapEntries has change in the latter since the last time it sampled this
already been reached. counter, it SHOULD NOT make use of the difference between
the latest value of the counter and any value retrieved
before the new value of natv2InstanceDiscontinuityTime."
::= { natv2InstanceEntry 9 }
This value MUST be monotone increasing in the periods natv2InstanceAddressMapCreations OBJECT-TYPE
between updates of the entity's SYNTAX Counter64
natv2InstanceDiscontinuityTime. If a manager detects a MAX-ACCESS read-only
change in the latter since the last time it sampled this STATUS current
counter, it SHOULD NOT make use of the difference between DESCRIPTION
the latest value of the counter and any value retrieved "The cumulative number of address map entries created by the
before the new value of natv2InstanceDiscontinuityTime." NAT instance, including static mappings. Address map
::= { natv2InstanceEntry 12 } creations are also tracked per address pool within the
instance and per subscriber.
natv2InstancePortMapEntryLimitDrops OBJECT-TYPE This value MUST be monotone increasing in
SYNTAX Counter64 the periods between updates of
MAX-ACCESS read-only natv2InstanceDiscontinuityTime. If a manager detects a
STATUS current change in the latter since the last time it sampled this
DESCRIPTION counter, it SHOULD NOT make use of the difference between
"The cumulative number of packets dropped rather than the latest value of the counter and any value retrieved
translated because the packet would have triggered before the new value of natv2InstanceDiscontinuityTime."
the creation of a new port map entry but the limit ::= { natv2InstanceEntry 10 }
on number of port map entries for the NAT instance
given by natv2InstanceLimitPortMapEntries has
already been reached.
This value MUST be monotone increasing in the periods natv2InstancePortMapCreations OBJECT-TYPE
between updates of the entity's SYNTAX Counter64
natv2InstanceDiscontinuityTime. If a manager detects a MAX-ACCESS read-only
change in the latter since the last time it sampled this STATUS current
counter, it SHOULD NOT make use of the difference between DESCRIPTION
the latest value of the counter and any value retrieved "The cumulative number of port map entries created by the
before the new value of natv2InstanceDiscontinuityTime." NAT instance, including static mappings. Port map
::= { natv2InstanceEntry 13 } creations are also tracked per protocol and address pool
within the instance and per subscriber.
natv2InstanceSubscriberActiveLimitDrops OBJECT-TYPE This value MUST be monotone increasing in
SYNTAX Counter64 the periods between updates of
MAX-ACCESS read-only natv2InstanceDiscontinuityTime. If a manager detects a
STATUS current change in the latter since the last time it sampled this
DESCRIPTION counter, it SHOULD NOT make use of the difference between
"The cumulative number of packets dropped rather than the latest value of the counter and any value retrieved
translated because the packet would have triggered the before the new value of natv2InstanceDiscontinuityTime."
creation of a new mapping for a subscriber with no other ::= { natv2InstanceEntry 11 }
active mappings, but the limit on number of active
subscribers for the NAT instance given by
natv2InstanceLimitSubscriberActives has already been
reached.
This value MUST be monotone increasing in the periods natv2InstanceAddressMapEntryLimitDrops OBJECT-TYPE
between updates of the entity's SYNTAX Counter64
natv2InstanceDiscontinuityTime. If a manager detects a MAX-ACCESS read-only
change in the latter since the last time it sampled this STATUS current
counter, it SHOULD NOT make use of the difference between DESCRIPTION
the latest value of the counter and any value retrieved "The cumulative number of packets dropped rather than
before the new value of natv2InstanceDiscontinuityTime." translated because the packet would have triggered
::= { natv2InstanceEntry 14 } the creation of a new address map entry, but the limit
on number of address map entries for the NAT instance
given by natv2InstanceLimitAddressMapEntries has
already been reached.
natv2InstanceAddressMapFailureDrops OBJECT-TYPE This value MUST be monotone increasing in the periods
SYNTAX Counter64 between updates of the entity's
MAX-ACCESS read-only natv2InstanceDiscontinuityTime. If a manager detects a
STATUS current change in the latter since the last time it sampled this
DESCRIPTION counter, it SHOULD NOT make use of the difference between
"The cumulative number of packets dropped because the packet the latest value of the counter and any value retrieved
would have triggered the creation of a new address map before the new value of natv2InstanceDiscontinuityTime."
entry, but no address could be allocated in the selected ::= { natv2InstanceEntry 12 }
external realm because all addresses from the selected
address pool (or the whole realm, if no address pool has
been configured for that realm) have already been fully
allocated.
This value MUST be monotone increasing in the periods natv2InstancePortMapEntryLimitDrops OBJECT-TYPE
between updates of the entity's SYNTAX Counter64
natv2InstanceDiscontinuityTime. If a manager detects a MAX-ACCESS read-only
change in the latter since the last time it sampled this STATUS current
counter, it SHOULD NOT make use of the difference between DESCRIPTION
the latest value of the counter and any value retrieved "The cumulative number of packets dropped rather than
before the new value of natv2InstanceDiscontinuityTime." translated because the packet would have triggered
::= { natv2InstanceEntry 15 } the creation of a new port map entry, but the limit
on number of port map entries for the NAT instance
given by natv2InstanceLimitPortMapEntries has
already been reached.
natv2InstancePortMapFailureDrops OBJECT-TYPE This value MUST be monotone increasing in the periods
SYNTAX Counter64 between updates of the entity's
MAX-ACCESS read-only natv2InstanceDiscontinuityTime. If a manager detects a
STATUS current change in the latter since the last time it sampled this
DESCRIPTION counter, it SHOULD NOT make use of the difference between
"The cumulative number of packets dropped because the the latest value of the counter and any value retrieved
packet would have triggered the creation of a new before the new value of natv2InstanceDiscontinuityTime."
port map entry, but no port could be allocated for the ::= { natv2InstanceEntry 13 }
protocol concerned. The usual case for this will be
for a NAT instance that supports address pooling and
the 'paired' pooling behavior recommended by RFC 4787,
where the internal endpoint has used up all of the
ports allocated to it for the address it was mapped to
in the selected address pool in the external realm
concerned and cannot be given more ports because
- policy or implementation prevents it from having a
second address in the same pool, and
- policy or unavailability prevents it from acquiring
more ports at its originally assigned address.
If the NAT instance supports address pooling but its natv2InstanceSubscriberActiveLimitDrops OBJECT-TYPE
pooling behavior is 'arbitrary' (meaning that SYNTAX Counter64
the NAT instance can allocate a new port mapping for MAX-ACCESS read-only
the given internal endpoint on any address in the STATUS current
selected address pool and is not bound to what it has DESCRIPTION
already mapped for that endpoint), then this counter "The cumulative number of packets dropped rather than
is incremented when all ports for the protocol concerned translated because the packet would have triggered the
over the whole of the selected address pool are already creation of a new mapping for a subscriber with no other
in use. active mappings, but the limit on number of active
subscribers for the NAT instance given by
natv2InstanceLimitSubscriberActives has already been
reached.
Finally, if no address pools have been configured for the This value MUST be monotone increasing in the periods
external realm concerned, then this counter is incremented between updates of the entity's
because all ports for the protocol involved over the whole natv2InstanceDiscontinuityTime. If a manager detects a
set of addresses available for that external realm are change in the latter since the last time it sampled this
already in use. counter, it SHOULD NOT make use of the difference between
the latest value of the counter and any value retrieved
before the new value of natv2InstanceDiscontinuityTime."
::= { natv2InstanceEntry 14 }
This value MUST be monotone increasing in the periods natv2InstanceAddressMapFailureDrops OBJECT-TYPE
between updates of the entity's SYNTAX Counter64
natv2InstanceDiscontinuityTime. If a manager detects a MAX-ACCESS read-only
change in the latter since the last time it sampled this STATUS current
counter, it SHOULD NOT make use of the difference between DESCRIPTION
the latest value of the counter and any value retrieved "The cumulative number of packets dropped because the packet
before the new value of natv2InstanceDiscontinuityTime." would have triggered the creation of a new address map
REFERENCE entry, but no address could be allocated in the selected
"Pooling behavior: RFC 4787, end of section 4.1." external realm because all addresses from the selected
::= { natv2InstanceEntry 16 } address pool (or the whole realm, if no address pool has
been configured for that realm) have already been fully
allocated.
natv2InstanceFragmentDrops OBJECT-TYPE This value MUST be monotone increasing in the periods
SYNTAX Counter64 between updates of the entity's
MAX-ACCESS read-only natv2InstanceDiscontinuityTime. If a manager detects a
STATUS current change in the latter since the last time it sampled this
DESCRIPTION counter, it SHOULD NOT make use of the difference between
"The cumulative number of fragments received by the NAT the latest value of the counter and any value retrieved
instance but dropped rather than translated. When the NAT before the new value of natv2InstanceDiscontinuityTime."
instance supports the 'Receive Fragment Out of Order' ::= { natv2InstanceEntry 15 }
capability as required by RFC 4787, this occurs because the
fragment was received out of order and would be added to the
queue of fragments awaiting the initial fragment of the
chain, but the queue has already reached the limit set by
natv2InstanceLimitsPendingFragments. Counting in other cases
is specified in the description of
natv2InstanceFragmentBehavior.
This value MUST be monotone increasing in the periods natv2InstancePortMapFailureDrops OBJECT-TYPE
between updates of the entity's SYNTAX Counter64
natv2InstanceDiscontinuityTime. If a manager detects a MAX-ACCESS read-only
change in the latter since the last time it sampled this STATUS current
counter, it SHOULD NOT make use of the difference between DESCRIPTION
the latest value of the counter and any value retrieved "The cumulative number of packets dropped because the
before the new value of natv2InstanceDiscontinuityTime." packet would have triggered the creation of a new
REFERENCE port map entry, but no port could be allocated for the
"RFC 4787, section 11." protocol concerned. The usual case for this will be
::= { natv2InstanceEntry 17 } for a NAT instance that supports address pooling and
the 'Paired' pooling behavior recommended by RFC 4787,
where the internal endpoint has used up all of the
ports allocated to it for the address it was mapped to
in the selected address pool in the external realm
concerned and cannot be given more ports because
- policy or implementation prevents it from having a
second address in the same pool, and
- policy or unavailability prevents it from acquiring
more ports at its originally assigned address.
natv2InstanceOtherResourceFailureDrops OBJECT-TYPE If the NAT instance supports address pooling but its
SYNTAX Counter64 pooling behavior is 'Arbitrary' (meaning that
MAX-ACCESS read-only the NAT instance can allocate a new port mapping for
STATUS current the given internal endpoint on any address in the
DESCRIPTION selected address pool and is not bound to what it has
"The cumulative number of packets dropped because of already mapped for that endpoint), then this counter
unavailability of a resource other than an address or port is incremented when all ports for the protocol concerned
that would have been required to process it. The most likely over the whole of the selected address pool are already
case is where the upper layer protocol in the packet is not in use.
supported by the NAT instance.
This value MUST be monotone increasing in the periods Finally, if no address pools have been configured for the
between updates of the entity's external realm concerned, then this counter is incremented
natv2InstanceDiscontinuityTime. If a manager detects a because all ports for the protocol involved over the whole
change in the latter since the last time it sampled this set of addresses available for that external realm are
counter, it SHOULD NOT make use of the difference between already in use.
the latest value of the counter and any value retrieved
before the new value of natv2InstanceDiscontinuityTime."
::= { natv2InstanceEntry 18 }
natv2InstanceDiscontinuityTime OBJECT-TYPE This value MUST be monotone increasing in the periods
SYNTAX TimeStamp between updates of the entity's
MAX-ACCESS read-only natv2InstanceDiscontinuityTime. If a manager detects a
STATUS current change in the latter since the last time it sampled this
DESCRIPTION counter, it SHOULD NOT make use of the difference between
"Snapshot of the value of the sysUpTime object at the the latest value of the counter and any value retrieved
beginning of the latest period of continuity of the before the new value of natv2InstanceDiscontinuityTime."
statistical counters associated with this NAT instance."
::= { natv2InstanceEntry 19 }
-- Notification thresholds, disabled by setting to zero REFERENCE
"Pooling behavior: RFC 4787, end of Section 4.1."
::= { natv2InstanceEntry 16 }
natv2InstanceThresholdAddressMapEntriesHigh OBJECT-TYPE natv2InstanceFragmentDrops OBJECT-TYPE
SYNTAX Integer32 SYNTAX Counter64
MAX-ACCESS read-write MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Notification threshold for total number of address map "The cumulative number of fragments received by the NAT
entries held by this NAT instance. Whenever instance but dropped rather than translated. When the NAT
natv2InstanceAddressMapEntries is updated, if it equals or instance supports the 'Receive Fragment Out of Order'
exceeds natv2InstanceThresholdAddressMapEntriesHigh, then capability as required by RFC 4787, this occurs because the
natv2NotificationInstanceAddressMapEntriesHigh may be fragment was received out of order and would be added to the
triggered, unless the notification is disabled by setting queue of fragments awaiting the initial fragment of the
the threshold to -1. Reporting is subject to the minimum chain, but the queue has already reached the limit set by
inter-notification interval given by natv2InstanceLimitsPendingFragments. Counting in other cases
natv2InstanceNotificationInterval. If multiple notifications is specified in the description of
are triggered during one interval, the agent MUST report natv2InstanceFragmentBehavior.
only the one containing the highest value of
natv2InstanceAddressMapEntries and discard the others."
DEFVAL
{ -1 }
::= { natv2InstanceEntry 20 }
natv2InstanceThresholdPortMapEntriesHigh OBJECT-TYPE This value MUST be monotone increasing in the periods
SYNTAX Integer32 between updates of the entity's
MAX-ACCESS read-write natv2InstanceDiscontinuityTime. If a manager detects a
STATUS current change in the latter since the last time it sampled this
DESCRIPTION counter, it SHOULD NOT make use of the difference between
"Notification threshold for total number of port map the latest value of the counter and any value retrieved
entries held by this NAT instance. Whenever before the new value of natv2InstanceDiscontinuityTime."
natv2InstancePortMapEntries is updated, if it equals or REFERENCE
exceeds natv2InstanceThresholdPortMapEntriesHigh, then "RFC 4787, Section 11."
natv2NotificationInstancePortMapEntriesHigh may be ::= { natv2InstanceEntry 17 }
triggered, unless the notification is disabled by setting
the threshold to -1. Reporting is subject to the minimum
inter-notification interval given by
natv2InstanceNotificationInterval. If multiple notifications
are triggered during one interval, the agent MUST report
only the one containing the highest value of
natv2InstancePortMapEntries and discard the others."
DEFVAL
{ -1 }
::= { natv2InstanceEntry 21 }
natv2InstanceNotificationInterval OBJECT-TYPE natv2InstanceOtherResourceFailureDrops OBJECT-TYPE
SYNTAX Unsigned32 (1..3600) SYNTAX Counter64
UNITS MAX-ACCESS read-only
"Seconds" STATUS current
MAX-ACCESS read-write DESCRIPTION
STATUS current "The cumulative number of packets dropped because of
DESCRIPTION unavailability of a resource other than an address or port
"Minimum number of seconds between successive that would have been required to process it. The most likely
notifications for this NAT instance. Controls the reporting case is where the upper-layer protocol in the packet is not
of natv2NotificationInstanceAddressMapEntriesHigh and supported by the NAT instance.
natv2NotificationInstancePortMapEntriesHigh."
DEFVAL
{ 10 }
::= { natv2InstanceEntry 22 }
-- Limits, disabled if set to 0 This value MUST be monotone increasing in the periods
between updates of the entity's
natv2InstanceDiscontinuityTime. If a manager detects a
change in the latter since the last time it sampled this
counter, it SHOULD NOT make use of the difference between
the latest value of the counter and any value retrieved
before the new value of natv2InstanceDiscontinuityTime."
::= { natv2InstanceEntry 18 }
natv2InstanceLimitAddressMapEntries OBJECT-TYPE natv2InstanceDiscontinuityTime OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX TimeStamp
MAX-ACCESS read-write MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Limit on total number of address map entries supported by "Snapshot of the value of the sysUpTime object at the
the NAT instance. When natv2InstanceAddressMapEntries has beginning of the latest period of continuity of the
reached this limit, subsequent packets that would normally statistical counters associated with this NAT instance."
trigger creation of a new address map entry will be dropped ::= { natv2InstanceEntry 19 }
and counted in natv2InstanceAddressMapEntryLimitDrops.
Warning of an approach to this limit can be achieved by
setting natv2InstanceThresholdAddressMapEntriesHigh to a
non-zero value, for example, 80% of the limit. The limit is
disabled by setting its value to zero.
For further information please see the descriptions of -- Notification thresholds, disabled by setting to -1.
natv2NotificationInstanceAddressMapEntriesHigh and
natv2InstanceAddressMapEntries."
DEFVAL
{ 0 }
::= { natv2InstanceEntry 23 }
natv2InstanceLimitPortMapEntries OBJECT-TYPE natv2InstanceThresholdAddressMapEntriesHigh OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Integer32
MAX-ACCESS read-write MAX-ACCESS read-write
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Limit on total number of port map entries supported by the "Notification threshold for total number of address map
NAT instance. When natv2InstancePortMapEntries has reached entries held by this NAT instance. Whenever
this limit, subsequent packets that would normally trigger natv2InstanceAddressMapEntries is updated, if it equals or
creation of a new port map entry will be dropped and counted exceeds natv2InstanceThresholdAddressMapEntriesHigh, then
in natv2InstancePortMapEntryLimitDrops. Warning of an natv2NotificationInstanceAddressMapEntriesHigh may be
approach to this limit can be achieved by setting triggered, unless the notification is disabled by setting
natv2InstanceThresholdPortMapEntriesHigh to a non-zero the threshold to -1. Reporting is subject to the minimum
value, for example, 80% of the limit. The limit is disabled inter-notification interval given by
by setting its value to zero. natv2InstanceNotificationInterval. If multiple notifications
are triggered during one interval, the agent MUST report
only the one containing the highest value of
natv2InstanceAddressMapEntries and discard the others."
DEFVAL
{ -1 }
::= { natv2InstanceEntry 20 }
For further information please see the descriptions of natv2InstanceThresholdPortMapEntriesHigh OBJECT-TYPE
natv2NotificationInstancePortMapEntriesHigh and SYNTAX Integer32
natv2InstancePortMapEntries." MAX-ACCESS read-write
DEFVAL STATUS current
{ 0 } DESCRIPTION
::= { natv2InstanceEntry 24 } "Notification threshold for total number of port map
entries held by this NAT instance. Whenever
natv2InstancePortMapEntries is updated, if it equals or
exceeds natv2InstanceThresholdPortMapEntriesHigh, then
natv2NotificationInstancePortMapEntriesHigh may be
triggered, unless the notification is disabled by setting
the threshold to -1. Reporting is subject to the minimum
inter-notification interval given by
natv2InstanceNotificationInterval. If multiple notifications
are triggered during one interval, the agent MUST report
only the one containing the highest value of
natv2InstancePortMapEntries and discard the others."
DEFVAL
{ -1 }
::= { natv2InstanceEntry 21 }
natv2InstanceLimitPendingFragments OBJECT-TYPE natv2InstanceNotificationInterval OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32 (1..3600)
MAX-ACCESS read-write UNITS
STATUS current "Seconds"
DESCRIPTION MAX-ACCESS read-write
"Limit on number of out-of-order fragments received by the STATUS current
NAT instance from remote sources and held until head of DESCRIPTION
chain appears. While the number of held fragments is at this "Minimum number of seconds between successive
limit, subsequent packets that contain fragments not notifications for this NAT instance. Controls the reporting
relating to those already held will be dropped and counted of natv2NotificationInstanceAddressMapEntriesHigh and
in natv2InstancePendingFragmentLimitDrops. The limit is natv2NotificationInstancePortMapEntriesHigh."
disabled by setting the value to zero. DEFVAL
{ 10 }
::= { natv2InstanceEntry 22 }
Applicable only when the NAT instance supports 'Receive -- Limits, disabled if set to 0
Fragments Out of Order' behavior, leave at default
otherwise. See the description of
natv2InstanceFragmentBehavior."
REFERENCE
"RFC 4787 Section 11"
DEFVAL { 0 }
::= { natv2InstanceEntry 25 }
natv2InstanceLimitSubscriberActives OBJECT-TYPE natv2InstanceLimitAddressMapEntries OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32
MAX-ACCESS read-write MAX-ACCESS read-write
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Limit on number of total number of active subscribers "Limit on total number of address map entries supported by
supported by the NAT instance. An active subscriber is the NAT instance. When natv2InstanceAddressMapEntries has
defined as any subscriber with at least one map entry, reached this limit, subsequent packets that would normally
including static mappings. While the number of active trigger creation of a new address map entry will be dropped
subscribers is at this limit, subsequent packets that would and counted in natv2InstanceAddressMapEntryLimitDrops.
otherwise trigger first mappings for newly active Warning of an approach to this limit can be achieved by
subscribers will be dropped and counted in setting natv2InstanceThresholdAddressMapEntriesHigh to a
natv2InstanceSubscriberActiveLimitDrops. The limit is non-zero value, for example, 80% of the limit. The limit is
disabled by setting the value to zero." disabled by setting its value to zero.
DEFVAL { 0 } For further information, please see the descriptions of
::= { natv2InstanceEntry 26 } natv2NotificationInstanceAddressMapEntriesHigh and
natv2InstanceAddressMapEntries."
DEFVAL
{ 0 }
::= { natv2InstanceEntry 23 }
-- Table of counters per upper layer protocol identified by the natv2InstanceLimitPortMapEntries OBJECT-TYPE
-- packet header and supported by the NAT instance SYNTAX Unsigned32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Limit on total number of port map entries supported by the
NAT instance. When natv2InstancePortMapEntries has reached
this limit, subsequent packets that would normally trigger
creation of a new port map entry will be dropped and counted
in natv2InstancePortMapEntryLimitDrops. Warning of an
approach to this limit can be achieved by setting
natv2InstanceThresholdPortMapEntriesHigh to a non-zero
value, for example, 80% of the limit. The limit is disabled
by setting its value to zero.
natv2ProtocolTable OBJECT-TYPE For further information, please see the descriptions of
SYNTAX SEQUENCE OF Natv2ProtocolEntry natv2NotificationInstancePortMapEntriesHigh and
MAX-ACCESS not-accessible natv2InstancePortMapEntries."
STATUS current DEFVAL
DESCRIPTION { 0 }
"Table of protocols with per-protocol counters. Conceptual ::= { natv2InstanceEntry 24 }
rows of the table are indexed by the combination of the NAT
instance number and the IANA-assigned upper layer protocol
number as given by the ProtocolNumber TC and contained in
the packet IP header. It is up to the agent implementation
to determine and operate upon only those upper layer
protocol numbers supported by the NAT instance."
REFERENCE
"RFC yyyy Section 3.3.5."
::= { natv2MIBInstanceObjects 2 }
natv2ProtocolEntry OBJECT-TYPE natv2InstanceLimitPendingFragments OBJECT-TYPE
SYNTAX Natv2ProtocolEntry SYNTAX Unsigned32
MAX-ACCESS not-accessible MAX-ACCESS read-write
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Per-protocol counters." "Limit on number of out-of-order fragments received by the
INDEX { natv2ProtocolInstanceIndex, NAT instance from remote sources and held until head of
natv2ProtocolNumber } chain appears. While the number of held fragments is at this
::= { natv2ProtocolTable 1 } limit, subsequent packets that contain fragments not
relating to those already held will be dropped and counted
in natv2InstancePendingFragmentLimitDrops. The limit is
disabled by setting the value to zero.
Natv2ProtocolEntry ::= Applicable only when the NAT instance supports 'Receive
SEQUENCE { Fragments Out of Order' behavior; leave at default
natv2ProtocolInstanceIndex Natv2InstanceIndex, otherwise. See the description of
natv2ProtocolNumber ProtocolNumber, natv2InstanceFragmentBehavior."
-- State REFERENCE
natv2ProtocolPortMapEntries Unsigned32, "RFC 4787, Section 11."
-- Statistics. Discontinuity object from instance table reused here. DEFVAL { 0 }
natv2ProtocolTranslations Counter64, ::= { natv2InstanceEntry 25 }
natv2ProtocolPortMapCreations Counter64,
natv2ProtocolPortMapFailureDrops Counter64
}
natv2ProtocolInstanceIndex OBJECT-TYPE natv2InstanceLimitSubscriberActives OBJECT-TYPE
SYNTAX Natv2InstanceIndex SYNTAX Unsigned32
MAX-ACCESS not-accessible MAX-ACCESS read-write
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"NAT instance index. It is up to the implementation to "Limit on number of total number of active subscribers
determine and operate upon only those values that supported by the NAT instance. An active subscriber is
correspond to in-service NAT instances." defined as any subscriber with at least one map entry,
::= { natv2ProtocolEntry 1 } including static mappings. While the number of active
subscribers is at this limit, subsequent packets that would
otherwise trigger first mappings for newly active
subscribers will be dropped and counted in
natv2InstanceSubscriberActiveLimitDrops. The limit is
disabled by setting the value to zero."
DEFVAL { 0 }
::= { natv2InstanceEntry 26 }
natv2ProtocolNumber OBJECT-TYPE -- Table of counters per upper-layer protocol identified by the
SYNTAX ProtocolNumber -- packet header and supported by the NAT instance.
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Counters in this conceptual row apply to packets indicating
the upper layer protocol identified by the value of
this object. It is up to the implementation to determine and
operate upon only those values that correspond to protocols
supported by the NAT instance."
REFERENCE
"RFC yyyy Section 3.3.5.
IANA Protocol Numbers, http://www.iana.org/assignments/
protocol-numbers/protocol-numbers.xhtml#protocol-numbers-1"
::= { natv2ProtocolEntry 2 }
-- State natv2ProtocolTable OBJECT-TYPE
natv2ProtocolPortMapEntries OBJECT-TYPE SYNTAX SEQUENCE OF Natv2ProtocolEntry
SYNTAX Unsigned32 MAX-ACCESS not-accessible
MAX-ACCESS read-only STATUS current
STATUS current DESCRIPTION
DESCRIPTION "Table of protocols with per-protocol counters. Conceptual
"The current number of entries in the port map table in total rows of the table are indexed by the combination of the NAT
over the whole NAT instance for a given protocol, including instance number and the IANA-assigned upper-layer protocol
static mappings. A port map entry maps from a given external number as given by the ProtocolNumber Textual Convention
realm, address, and port for a given protocol to an internal (TC) and contained in the packet IP header. It is up to the
realm, address, and port. This definition includes 'hairpin' agent implementation to determine and operate upon only
mappings, where the external realm is the same as the those upper-layer protocol numbers supported by the NAT
internal one. Port map entries are also tracked per instance."
subscriber, per instance, and per address pool within the REFERENCE
instance." "RFC 7659, Section 3.3.5."
REFERENCE ::= { natv2MIBInstanceObjects 2 }
"RFC yyyy Section 3.3.5 and Section 3.3.9. Hairpinning:
RFC 4787 Section 6."
::= { natv2ProtocolEntry 3 }
-- Statistics natv2ProtocolEntry OBJECT-TYPE
natv2ProtocolTranslations OBJECT-TYPE SYNTAX Natv2ProtocolEntry
SYNTAX Counter64 MAX-ACCESS not-accessible
MAX-ACCESS read-only STATUS current
STATUS current DESCRIPTION
DESCRIPTION "Per-protocol counters."
"The cumulative number of packets translated by the NAT INDEX { natv2ProtocolInstanceIndex,
instance in either direction for the given protocol. natv2ProtocolNumber }
::= { natv2ProtocolTable 1 }
This value MUST be monotone increasing in the periods Natv2ProtocolEntry ::=
between updates of the NAT instance SEQUENCE {
natv2InstanceDiscontinuityTime. If a manager detects a natv2ProtocolInstanceIndex Natv2InstanceIndex,
change in the latter since the last time it sampled this natv2ProtocolNumber ProtocolNumber,
counter, it SHOULD NOT make use of the difference between
the latest value of the counter and any value retrieved
before the new value of natv2InstanceDiscontinuityTime."
::= { natv2ProtocolEntry 4 }
natv2ProtocolPortMapCreations OBJECT-TYPE -- State
SYNTAX Counter64 natv2ProtocolPortMapEntries Unsigned32,
MAX-ACCESS read-only -- Statistics. Discontinuity object from instance table reused here.
STATUS current natv2ProtocolTranslations Counter64,
DESCRIPTION natv2ProtocolPortMapCreations Counter64,
"The cumulative number of port map entries created by the NAT natv2ProtocolPortMapFailureDrops Counter64
instance for the given protocol. }
This value MUST be monotone increasing in the periods natv2ProtocolInstanceIndex OBJECT-TYPE
between updates of the NAT instance SYNTAX Natv2InstanceIndex
natv2InstanceDiscontinuityTime. If a manager detects a MAX-ACCESS not-accessible
change in the latter since the last time it sampled this STATUS current
counter, it SHOULD NOT make use of the difference between DESCRIPTION
the latest value of the counter and any value retrieved "NAT instance index. It is up to the implementation to
before the new value of natv2InstanceDiscontinuityTime." determine and operate upon only those values that
::= { natv2ProtocolEntry 5 } correspond to in-service NAT instances."
::= { natv2ProtocolEntry 1 }
natv2ProtocolPortMapFailureDrops OBJECT-TYPE natv2ProtocolNumber OBJECT-TYPE
SYNTAX Counter64 SYNTAX ProtocolNumber
MAX-ACCESS read-only MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The cumulative number of packets dropped because the packet "Counters in this conceptual row apply to packets indicating
would have triggered the creation of a new port map entry, the upper-layer protocol identified by the value of
but no port could be allocated for the protocol concerned. this object. It is up to the implementation to determine and
The usual case for this will be for a NAT instance that operate upon only those values that correspond to protocols
supports address pooling and the 'paired' pooling behavior supported by the NAT instance."
recommended by RFC 4787, where the internal endpoint has REFERENCE
used up all of the ports allocated to it for the address it "RFC 7659, Section 3.3.5.
was mapped to in the selected address pool in the external IANA Protocol Numbers,
realm concerned and cannot be given more ports because <http://www.iana.org/assignments/protocol-numbers>"
- policy or implementation prevents it from having a ::= { natv2ProtocolEntry 2 }
second address in the same pool, and
- policy or unavailability prevents it from acquiring
more ports at its originally assigned address.
If the NAT instance supports address pooling but its -- State
pooling behavior is 'arbitrary' (meaning that natv2ProtocolPortMapEntries OBJECT-TYPE
the NAT instance can allocate a new port mapping for SYNTAX Unsigned32
the given internal endpoint on any address in the MAX-ACCESS read-only
selected address pool and is not bound to what it has STATUS current
already mapped for that endpoint), then this counter DESCRIPTION
is incremented when all ports for the protocol concerned "The current number of entries in the port map table in total
over the whole of the selected address pool are already over the whole NAT instance for a given protocol, including
in use. static mappings. A port map entry maps from a given external
realm, address, and port for a given protocol to an internal
realm, address, and port. This definition includes 'hairpin'
mappings, where the external realm is the same as the
internal one. Port map entries are also tracked per
subscriber, per instance, and per address pool within the
instance."
REFERENCE
"RFC 7659, Sections 3.3.5 and 3.3.9.
Hairpinning: RFC 4787, Section 6."
::= { natv2ProtocolEntry 3 }
Finally, if the NAT instance has no configured address -- Statistics
pooling, then this counter is incremented because all natv2ProtocolTranslations OBJECT-TYPE
ports for the protocol concerned over the whole of the SYNTAX Counter64
NAT instance for the external realm concerned are already MAX-ACCESS read-only
in use. STATUS current
DESCRIPTION
"The cumulative number of packets translated by the NAT
instance in either direction for the given protocol.
This value MUST be monotone increasing in the periods This value MUST be monotone increasing in the periods
between updates of the NAT instance between updates of the NAT instance
natv2InstanceDiscontinuityTime. If a manager detects a natv2InstanceDiscontinuityTime. If a manager detects a
change in the latter since the last time it sampled this change in the latter since the last time it sampled this
counter, it SHOULD NOT make use of the difference between counter, it SHOULD NOT make use of the difference between
the latest value of the counter and any value retrieved the latest value of the counter and any value retrieved
before the new value of natv2InstanceDiscontinuityTime." before the new value of natv2InstanceDiscontinuityTime."
REFERENCE ::= { natv2ProtocolEntry 4 }
"RFC 4787, end of section 4.1."
::= { natv2ProtocolEntry 6 }
-- pools natv2ProtocolPortMapCreations OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The cumulative number of port map entries created by the NAT
instance for the given protocol.
natv2PoolTable OBJECT-TYPE This value MUST be monotone increasing in the periods
SYNTAX SEQUENCE OF Natv2PoolEntry between updates of the NAT instance
MAX-ACCESS not-accessible natv2InstanceDiscontinuityTime. If a manager detects a
STATUS current change in the latter since the last time it sampled this
DESCRIPTION counter, it SHOULD NOT make use of the difference between
"Table of address pools, applicable only if these are the latest value of the counter and any value retrieved
supported by the NAT instance. An address pool is a set of before the new value of natv2InstanceDiscontinuityTime."
addresses and ports in a particular realm, available for ::= { natv2ProtocolEntry 5 }
assignment to the 'external' portion of a mapping. Where more
than one pool has been configured for the realm, policy
determines which subscribers and/or services are mapped to
which pool. natv2PoolTable provides basic information, state,
statistics, and two notification thresholds for each pool.
natv2PoolRangeTable is an expansion table for natv2PoolTable
that identifies particular address ranges allocated to the
pool."
REFERENCE
"RFC yyyy Section 3.3.6."
::= { natv2MIBInstanceObjects 3 } natv2ProtocolPortMapFailureDrops OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The cumulative number of packets dropped because the packet
would have triggered the creation of a new port map entry,
but no port could be allocated for the protocol concerned.
The usual case for this will be for a NAT instance that
supports address pooling and the 'Paired' pooling behavior
recommended by RFC 4787, where the internal endpoint has
used up all of the ports allocated to it for the address it
was mapped to in the selected address pool in the external
realm concerned and cannot be given more ports because
- policy or implementation prevents it from having a
second address in the same pool, and
- policy or unavailability prevents it from acquiring
more ports at its originally assigned address.
natv2PoolEntry OBJECT-TYPE If the NAT instance supports address pooling but its
SYNTAX Natv2PoolEntry pooling behavior is 'Arbitrary' (meaning that
MAX-ACCESS not-accessible the NAT instance can allocate a new port mapping for
STATUS current the given internal endpoint on any address in the
DESCRIPTION selected address pool and is not bound to what it has
"Entry in the table of address pools." already mapped for that endpoint), then this counter
INDEX { natv2PoolInstanceIndex, natv2PoolIndex } is incremented when all ports for the protocol concerned
::= { natv2PoolTable 1 } over the whole of the selected address pool are already
in use.
Natv2PoolEntry ::= Finally, if the NAT instance has no configured address
SEQUENCE { pooling, then this counter is incremented because all
-- Index ports for the protocol concerned over the whole of the
natv2PoolInstanceIndex Natv2InstanceIndex, NAT instance for the external realm concerned are already
natv2PoolIndex Natv2PoolIndex, in use.
-- Configuration
natv2PoolRealm SnmpAdminString,
natv2PoolAddressType InetAddressType,
natv2PoolMinimumPort InetPortNumber,
natv2PoolMaximumPort InetPortNumber,
-- State
natv2PoolAddressMapEntries Unsigned32,
natv2PoolPortMapEntries Unsigned32,
-- Statistics and discontinuity time
natv2PoolAddressMapCreations Counter64,
natv2PoolPortMapCreations Counter64,
natv2PoolAddressMapFailureDrops Counter64,
natv2PoolPortMapFailureDrops Counter64,
natv2PoolDiscontinuityTime TimeStamp,
-- Notification thresholds and objects returned by notifications
natv2PoolThresholdUsageLow Integer32,
natv2PoolThresholdUsageHigh Integer32,
natv2PoolNotifiedPortMapEntries Unsigned32,
natv2PoolNotifiedPortMapProtocol ProtocolNumber,
natv2PoolNotificationInterval Unsigned32
}
natv2PoolInstanceIndex OBJECT-TYPE This value MUST be monotone increasing in the periods
SYNTAX Natv2InstanceIndex between updates of the NAT instance
MAX-ACCESS not-accessible natv2InstanceDiscontinuityTime. If a manager detects a
STATUS current change in the latter since the last time it sampled this
DESCRIPTION counter, it SHOULD NOT make use of the difference between
"NAT instance index. It is up to the agent implementation the latest value of the counter and any value retrieved
to determine and operate upon only those values that before the new value of natv2InstanceDiscontinuityTime."
correspond to in-service NAT instances." REFERENCE
::= { natv2PoolEntry 1 } "RFC 4787, end of Section 4.1."
::= { natv2ProtocolEntry 6 }
natv2PoolIndex OBJECT-TYPE -- pools
SYNTAX Natv2PoolIndex
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Index of an address pool, unique for a given NAT instance.
It is up to the agent implementation to determine and
operate upon only those values that correspond to
provisioned pools."
::= { natv2PoolEntry 2 }
-- configuration natv2PoolTable OBJECT-TYPE
natv2PoolRealm OBJECT-TYPE SYNTAX SEQUENCE OF Natv2PoolEntry
SYNTAX SnmpAdminString (SIZE (0..32)) MAX-ACCESS not-accessible
MAX-ACCESS read-only STATUS current
STATUS current DESCRIPTION
DESCRIPTION "Table of address pools, applicable only if these are
"Address realm to which this pool's addresses belong." supported by the NAT instance. An address pool is a set of
REFERENCE addresses and ports in a particular realm, available for
"Address realms are discussed in Section 3.3.3 of assignment to the 'external' portion of a mapping. Where more
RFC yyyy. Primary reference is RFC 2663 Section 2.1." than one pool has been configured for the realm, policy
::= { natv2PoolEntry 3 } determines which subscribers and/or services are mapped to
which pool. natv2PoolTable provides basic information, state,
statistics, and two notification thresholds for each pool.
natv2PoolRangeTable is an expansion table for natv2PoolTable
that identifies particular address ranges allocated to the
pool."
REFERENCE
"RFC 7659, Section 3.3.6."
::= { natv2MIBInstanceObjects 3 }
natv2PoolAddressType OBJECT-TYPE natv2PoolEntry OBJECT-TYPE
SYNTAX InetAddressType SYNTAX Natv2PoolEntry
MAX-ACCESS read-create MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Address type supplied by this address pool. This will be the "Entry in the table of address pools."
same for all pools in a given realm (by definition of an INDEX { natv2PoolInstanceIndex, natv2PoolIndex }
address realm). Values other than ipv4(1) or ipv6(2) would ::= { natv2PoolTable 1 }
be unexpected."
REFERENCE
"InetAddressType in RFC 4001."
::= { natv2PoolEntry 4 }
natv2PoolMinimumPort OBJECT-TYPE Natv2PoolEntry ::=
SYNTAX InetPortNumber SEQUENCE {
MAX-ACCESS read-create -- Index
STATUS current natv2PoolInstanceIndex Natv2InstanceIndex,
DESCRIPTION natv2PoolIndex Natv2PoolIndex,
"Minimum port number of the range that can be allocated in -- Configuration
this pool. Applies to all protocols supported by the NAT natv2PoolRealm SnmpAdminString,
instance." natv2PoolAddressType InetAddressType,
REFERENCE natv2PoolMinimumPort InetPortNumber,
"InetPortNumber in RFC 4001." natv2PoolMaximumPort InetPortNumber,
::= { natv2PoolEntry 5 } -- State
natv2PoolAddressMapEntries Unsigned32,
natv2PoolPortMapEntries Unsigned32,
-- Statistics and discontinuity time
natv2PoolAddressMapCreations Counter64,
natv2PoolPortMapCreations Counter64,
natv2PoolAddressMapFailureDrops Counter64,
natv2PoolPortMapFailureDrops Counter64,
natv2PoolDiscontinuityTime TimeStamp,
-- Notification thresholds and objects returned by notifications
natv2PoolThresholdUsageLow Integer32,
natv2PoolThresholdUsageHigh Integer32,
natv2PoolNotifiedPortMapEntries Unsigned32,
natv2PoolNotifiedPortMapProtocol ProtocolNumber,
natv2PoolNotificationInterval Unsigned32
}
natv2PoolMaximumPort OBJECT-TYPE natv2PoolInstanceIndex OBJECT-TYPE
SYNTAX InetPortNumber SYNTAX Natv2InstanceIndex
MAX-ACCESS read-create MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Maximum port number of the range that can be allocated in "NAT instance index. It is up to the agent implementation
this pool. Applies to all protocols supported by the NAT to determine and operate upon only those values that
instance." correspond to in-service NAT instances."
REFERENCE ::= { natv2PoolEntry 1 }
"InetPortNumber in RFC 4001."
::= { natv2PoolEntry 6 }
-- State natv2PoolIndex OBJECT-TYPE
natv2PoolAddressMapEntries OBJECT-TYPE SYNTAX Natv2PoolIndex
SYNTAX Unsigned32 MAX-ACCESS not-accessible
MAX-ACCESS read-only STATUS current
STATUS current DESCRIPTION
DESCRIPTION "Index of an address pool that is unique for a given NAT
"The current number of address map entries using external instance. It is up to the agent implementation to determine
addresses drawn from this pool, including static mappings. and operate upon only those values that correspond to
This definition includes 'hairpin' mappings, where the provisioned pools."
external realm is the same as the internal one. Address map ::= { natv2PoolEntry 2 }
entries are also tracked per subscriber and per instance."
REFERENCE
"RFC yyyy Section 3.3.8. Hairpinning: RFC 4787 section 6."
::= { natv2PoolEntry 7 }
natv2PoolPortMapEntries OBJECT-TYPE -- Configuration
SYNTAX Unsigned32 natv2PoolRealm OBJECT-TYPE
MAX-ACCESS read-only SYNTAX SnmpAdminString (SIZE (0..32))
STATUS current MAX-ACCESS read-only
DESCRIPTION STATUS current
"The current number of entries in the port map table using DESCRIPTION
external addresses and ports drawn from this pool, including "Address realm to which this pool's addresses belong."
static mappings. This definition includes 'hairpin' REFERENCE
mappings, where the external realm is the same as the "Address realms are discussed in Section 3.3.3 of
internal one. Port map entries are also tracked per RFC 7659. The primary reference is RFC 2663, Section 2.1."
subscriber, per instance, and per protocol within the ::= { natv2PoolEntry 3 }
instance."
REFERENCE
"RFC yyyy Section 3.3.9. Hairpinning: RFC 4787 Section 6."
::= { natv2PoolEntry 8 }
-- Statistics and discontinuity time natv2PoolAddressType OBJECT-TYPE
natv2PoolAddressMapCreations OBJECT-TYPE SYNTAX InetAddressType
SYNTAX Counter64 MAX-ACCESS read-only
MAX-ACCESS read-only STATUS current
STATUS current DESCRIPTION
DESCRIPTION "Address type supplied by this address pool. This will be the
"The cumulative number of address map entries created in this same for all pools in a given realm (by definition of an
pool, including static mappings. Address map entries are address realm). Values other than ipv4(1) or ipv6(2) would
also tracked per instance and per subscriber. be unexpected."
REFERENCE
"InetAddressType in RFC 4001."
::= { natv2PoolEntry 4 }
This value MUST be monotone increasing in natv2PoolMinimumPort OBJECT-TYPE
the periods between updates of the entity's SYNTAX InetPortNumber
natv2PoolDiscontinuityTime. If a manager detects a MAX-ACCESS read-only
change in the latter since the last time it sampled this STATUS current
counter, it SHOULD NOT make use of the difference between DESCRIPTION
the latest value of the counter and any value retrieved "Minimum port number of the range that can be allocated in
before the new value of natv2PoolDiscontinuityTime." this pool. Applies to all protocols supported by the NAT
::= { natv2PoolEntry 9 } instance."
REFERENCE
"InetPortNumber in RFC 4001."
::= { natv2PoolEntry 5 }
natv2PoolPortMapCreations OBJECT-TYPE natv2PoolMaximumPort OBJECT-TYPE
SYNTAX Counter64 SYNTAX InetPortNumber
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The cumulative number of port map entries created in this "Maximum port number of the range that can be allocated in
pool, including static mappings. Port map entries are also this pool. Applies to all protocols supported by the NAT
tracked per instance, per protocol, and per subscriber. instance."
REFERENCE
"InetPortNumber in RFC 4001."
::= { natv2PoolEntry 6 }
This value MUST be monotone increasing in the periods -- State
between updates of the entity's natv2PoolAddressMapEntries OBJECT-TYPE
natv2PoolDiscontinuityTime. If a manager detects a SYNTAX Unsigned32
change in the latter since the last time it sampled this MAX-ACCESS read-only
counter, it SHOULD NOT make use of the difference between STATUS current
the latest value of the counter and any value retrieved DESCRIPTION
before the new value of natv2PoolDiscontinuityTime." "The current number of address map entries using external
::= { natv2PoolEntry 10 } addresses drawn from this pool, including static mappings.
This definition includes 'hairpin' mappings, where the
external realm is the same as the internal one. Address map
entries are also tracked per subscriber and per instance."
REFERENCE
"RFC 7659, Section 3.3.8.
Hairpinning: RFC 4787, Section 6."
::= { natv2PoolEntry 7 }
natv2PoolAddressMapFailureDrops OBJECT-TYPE natv2PoolPortMapEntries OBJECT-TYPE
SYNTAX Counter64 SYNTAX Unsigned32
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The cumulative number of packets originated by the "The current number of entries in the port map table using
subscriber that were dropped because the packet would have external addresses and ports drawn from this pool, including
triggered the creation of a new address map entry, but no static mappings. This definition includes 'hairpin'
address could be allocated from this address pool because mappings, where the external realm is the same as the
all addresses in the pool have already been fully allocated. internal one. Port map entries are also tracked per
Counters of this event are also provided per instance, per subscriber, per instance, and per protocol within the
protocol and per subscriber. instance."
REFERENCE
"RFC 7659, Section 3.3.9.
Hairpinning: RFC 4787, Section 6."
::= { natv2PoolEntry 8 }
This value MUST be monotone increasing in the periods -- Statistics and discontinuity time
between updates of the entity's natv2PoolAddressMapCreations OBJECT-TYPE
natv2PoolDiscontinuityTime. If a manager detects a SYNTAX Counter64
change in the latter since the last time it sampled this MAX-ACCESS read-only
counter, it SHOULD NOT make use of the difference between STATUS current
the latest value of the counter and any value retrieved DESCRIPTION
before the new value of natv2PoolDiscontinuityTime." "The cumulative number of address map entries created in this
::= { natv2PoolEntry 11 } pool, including static mappings. Address map entries are
also tracked per instance and per subscriber.
natv2PoolPortMapFailureDrops OBJECT-TYPE This value MUST be monotone increasing in
SYNTAX Counter64 the periods between updates of the entity's
MAX-ACCESS read-only natv2PoolDiscontinuityTime. If a manager detects a
STATUS current change in the latter since the last time it sampled this
DESCRIPTION counter, it SHOULD NOT make use of the difference between
"The cumulative number of packets dropped because the packet the latest value of the counter and any value retrieved
would have triggered the creation of a new port map entry, before the new value of natv2PoolDiscontinuityTime."
but no port could be allocated for the protocol concerned. ::= { natv2PoolEntry 9 }
The usual case for this will be for a NAT instance that
supports the 'paired' pooling behavior recommended by RFC
4787, where the internal endpoint has used up all of the
ports allocated to it for the address it was mapped to in
this pool and cannot be given more ports because
- policy or implementation prevents it from having a
second address in the same pool, and
- policy or unavailability prevents it from acquiring
more ports at its originally assigned address.
If the NAT instance pooling behavior is 'arbitrary' (meaning natv2PoolPortMapCreations OBJECT-TYPE
that the NAT instance can allocate a new port mapping for SYNTAX Counter64
the given internal endpoint on any address in the selected MAX-ACCESS read-only
address pool and is not bound to what it has already mapped STATUS current
for that endpoint), then this counter is incremented when DESCRIPTION
all ports for the protocol concerned over the whole of this "The cumulative number of port map entries created in this
address pool are already in use. pool, including static mappings. Port map entries are also
tracked per instance, per protocol, and per subscriber.
This value MUST be monotone increasing in the periods This value MUST be monotone increasing in the periods
between updates of the entity's between updates of the entity's
natv2PoolDiscontinuityTime. If a manager detects a natv2PoolDiscontinuityTime. If a manager detects a
change in the latter since the last time it sampled this change in the latter since the last time it sampled this
counter, it SHOULD NOT make use of the difference between counter, it SHOULD NOT make use of the difference between
the latest value of the counter and any value retrieved the latest value of the counter and any value retrieved
before the new value of natv2PoolDiscontinuityTime." before the new value of natv2PoolDiscontinuityTime."
REFERENCE ::= { natv2PoolEntry 10 }
"Pooling behavior: RFC 4787, end of section 4.1."
::= { natv2PoolEntry 12 }
natv2PoolDiscontinuityTime OBJECT-TYPE natv2PoolAddressMapFailureDrops OBJECT-TYPE
SYNTAX TimeStamp SYNTAX Counter64
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Snapshot of the value of the sysUpTime object at the "The cumulative number of packets originated by the
beginning of the latest period of continuity of the subscriber that were dropped because the packet would have
statistical counters associated with this address triggered the creation of a new address map entry, but no
pool. This MUST be initialized when the address pool address could be allocated from this address pool because
is configured and MUST be updated whenever the port all addresses in the pool have already been fully allocated.
or address ranges allocated to the pool change." Counters of this event are also provided per instance, per
::= { natv2PoolEntry 13 } protocol, and per subscriber.
-- Notification thresholds and objects returned by notifications This value MUST be monotone increasing in the periods
natv2PoolThresholdUsageLow OBJECT-TYPE between updates of the entity's
SYNTAX Integer32 (-1|0..100) natv2PoolDiscontinuityTime. If a manager detects a
UNITS "Percent" change in the latter since the last time it sampled this
MAX-ACCESS read-write counter, it SHOULD NOT make use of the difference between
STATUS current the latest value of the counter and any value retrieved
DESCRIPTION before the new value of natv2PoolDiscontinuityTime."
"Threshold for reporting low utilization of the address pool. ::= { natv2PoolEntry 11 }
Utilization at a given instant is calculated as the
percentage of ports allocated in port map entries for the
most-used protocol at that instant. If utilization is less
than or equal to natv2PoolThresholdUsageLow, an instance of
natv2NotificationPoolUsageLow may be triggered, unless
disabled by setting it to -1. Note the difference from the
disabling setting for other notifications. Reporting is
subject to the per-pool notification interval given by
natv2PoolNotificationInterval. If multiple notifications are
triggered during one interval, the agent MUST report only
the one with the lowest value of
natv2PoolNotifiedPortMapEntries and discard the others.
Implementation note: the percentage specified by this object natv2PoolPortMapFailureDrops OBJECT-TYPE
can be converted to a number of port map entries at SYNTAX Counter64
configuration time (after port and address ranges have been MAX-ACCESS read-only
configured or reconfigured) and compared to the current STATUS current
value of natv2PoolNotifiedPortMapEntries." DESCRIPTION
REFERENCE "The cumulative number of packets dropped because the packet
"RFC yyyy Section 3.1.2 and Section 3.3.6." would have triggered the creation of a new port map entry,
DEFVAL { -1 } but no port could be allocated for the protocol concerned.
::= { natv2PoolEntry 14 } The usual case for this will be for a NAT instance that
supports the 'Paired' pooling behavior recommended by RFC
4787, where the internal endpoint has used up all of the
ports allocated to it for the address it was mapped to in
this pool and cannot be given more ports because
- policy or implementation prevents it from having a
second address in the same pool, and
- policy or unavailability prevents it from acquiring
more ports at its originally assigned address.
natv2PoolThresholdUsageHigh OBJECT-TYPE If the NAT instance pooling behavior is 'Arbitrary' (meaning
SYNTAX Integer32 (-1|0..100) that the NAT instance can allocate a new port mapping for
UNITS "Percent" the given internal endpoint on any address in the selected
MAX-ACCESS read-write address pool and is not bound to what it has already mapped
STATUS current for that endpoint), then this counter is incremented when
DESCRIPTION all ports for the protocol concerned over the whole of this
"Threshold for reporting high utilization of the address address pool are already in use.
pool. Utilization at a given instant is calculated as the
percentage of ports allocated in port map entries for the
most-used protocol at that instant. If utilization is
greater than or equal to natv2PoolThresholdUsageHigh, an
instance of natv2NotificationPoolUsageHigh may be triggered,
unless disabled by setting it to -1.
Reporting is subject to the per-pool notification interval This value MUST be monotone increasing in the periods
given by natv2PoolNotificationInterval. If multiple between updates of the entity's
notifications are triggered during one interval, the agent natv2PoolDiscontinuityTime. If a manager detects a
MUST report only the one with the highest value of change in the latter since the last time it sampled this
natv2PoolNotifiedPortMapEntries and discard the others. In counter, it SHOULD NOT make use of the difference between
the rare case where both upper and lower thresholds the latest value of the counter and any value retrieved
are crossed in the same interval, the agent MUST report only before the new value of natv2PoolDiscontinuityTime."
the upper threshold notification. REFERENCE
"Pooling behavior: RFC 4787, end of Section 4.1."
::= { natv2PoolEntry 12 }
Implementation note: the percentage specified by this object natv2PoolDiscontinuityTime OBJECT-TYPE
can be converted to a number of port map entries at SYNTAX TimeStamp
configuration time (after port and address ranges have been MAX-ACCESS read-only
configured or reconfigured) and compared to the current STATUS current
value of natv2PoolNotifiedPortMapEntries." DESCRIPTION
DEFVAL { -1 } "Snapshot of the value of the sysUpTime object at the
::= { natv2PoolEntry 15 } beginning of the latest period of continuity of the
statistical counters associated with this address
pool. This MUST be initialized when the address pool
is configured and MUST be updated whenever the port
or address ranges allocated to the pool change."
::= { natv2PoolEntry 13 }
natv2PoolNotifiedPortMapEntries OBJECT-TYPE -- Notification thresholds and objects returned by notifications
SYNTAX Unsigned32 natv2PoolThresholdUsageLow OBJECT-TYPE
MAX-ACCESS accessible-for-notify SYNTAX Integer32 (-1|0..100)
STATUS current UNITS "Percent"
DESCRIPTION MAX-ACCESS read-write
"Number of port map entries using addresses and ports from STATUS current
this address pool for the most-used protocol at a given DESCRIPTION
instant. One of the objects returned by "Threshold for reporting low utilization of the address pool.
natv2NotificationPoolUsageLow and Utilization at a given instant is calculated as the
natv2NotificationPoolUsageHigh." percentage of ports allocated in port map entries for the
::= { natv2PoolEntry 16 } most-used protocol at that instant. If utilization is less
than or equal to natv2PoolThresholdUsageLow, an instance of
natv2NotificationPoolUsageLow may be triggered, unless
disabled by setting it to -1. Reporting is subject to the
per-pool notification interval given by
natv2PoolNotificationInterval. If multiple notifications
are triggered during one interval, the agent MUST report
only the one with the lowest value of
natv2PoolNotifiedPortMapEntries and discard the others.
natv2PoolNotifiedPortMapProtocol OBJECT-TYPE Implementation note: the percentage specified by this object
SYNTAX ProtocolNumber can be converted to a number of port map entries at
MAX-ACCESS accessible-for-notify configuration time (after port and address ranges have been
STATUS current configured or reconfigured) and compared to the current
DESCRIPTION value of natv2PoolNotifiedPortMapEntries."
"The most-used protocol (i.e., with the largest number of REFERENCE
port map entries) mapped into this address pool at a given "RFC 7659, Sections 3.1.2 and 3.3.6."
instant. One of the objects returned by
natv2NotificationPoolUsageLow and
natv2NotificationPoolUsageHigh."
::= { natv2PoolEntry 17 }
natv2PoolNotificationInterval OBJECT-TYPE DEFVAL { -1 }
SYNTAX Unsigned32 (1..3600) ::= { natv2PoolEntry 14 }
UNITS
"Seconds"
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Minimum number of seconds between successive
notifications for this address pool. Controls the generation
of natv2NotificationPoolUsageLow and
natv2NotificationPoolUsageHigh."
DEFVAL
{ 20 }
::= { natv2PoolEntry 18 }
natv2PoolRangeTable OBJECT-TYPE natv2PoolThresholdUsageHigh OBJECT-TYPE
SYNTAX SEQUENCE OF Natv2PoolRangeEntry SYNTAX Integer32 (-1|0..100)
MAX-ACCESS not-accessible UNITS "Percent"
STATUS current MAX-ACCESS read-write
DESCRIPTION STATUS current
"This table contains address ranges used by pool entries. DESCRIPTION
It is an expansion of natv2PoolTable." "Threshold for reporting high utilization of the address
REFERENCE pool. Utilization at a given instant is calculated as the
"RFC yyyy <xref target='poolRangeTable'/>." percentage of ports allocated in port map entries for the
::= { natv2MIBInstanceObjects 4 } most-used protocol at that instant. If utilization is
greater than or equal to natv2PoolThresholdUsageHigh, an
instance of natv2NotificationPoolUsageHigh may be triggered,
unless disabled by setting it to -1.
natv2PoolRangeEntry OBJECT-TYPE Reporting is subject to the per-pool notification interval
SYNTAX Natv2PoolRangeEntry given by natv2PoolNotificationInterval. If multiple
MAX-ACCESS not-accessible notifications are triggered during one interval, the agent
STATUS current MUST report only the one with the highest value of
DESCRIPTION natv2PoolNotifiedPortMapEntries and discard the others.
"NAT pool address range." In the rare case where both upper and lower thresholds
INDEX { are crossed in the same interval, the agent MUST report only
natv2PoolRangeInstanceIndex, the upper-threshold notification.
natv2PoolRangePoolIndex,
natv2PoolRangeRowIndex
}
::= { natv2PoolRangeTable 1 }
Natv2PoolRangeEntry ::= Implementation note: the percentage specified by this object
SEQUENCE { can be converted to a number of port map entries at
natv2PoolRangeInstanceIndex Natv2InstanceIndex, configuration time (after port and address ranges have been
natv2PoolRangePoolIndex Natv2PoolIndex, configured or reconfigured) and compared to the current
natv2PoolRangeRowIndex Unsigned32, value of natv2PoolNotifiedPortMapEntries."
natv2PoolRangeBegin InetAddress, DEFVAL { -1 }
natv2PoolRangeEnd InetAddress ::= { natv2PoolEntry 15 }
}
natv2PoolRangeInstanceIndex OBJECT-TYPE natv2PoolNotifiedPortMapEntries OBJECT-TYPE
SYNTAX Natv2InstanceIndex SYNTAX Unsigned32
MAX-ACCESS not-accessible MAX-ACCESS accessible-for-notify
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Index of the NAT instance on which the address pool and this "Number of port map entries using addresses and ports from
address range are configured. See Natv2InstanceIndex." this address pool for the most-used protocol at a given
::= { natv2PoolRangeEntry 1 } instant. One of the objects returned by
natv2NotificationPoolUsageLow and
natv2NotificationPoolUsageHigh."
::= { natv2PoolEntry 16 }
natv2PoolRangePoolIndex OBJECT-TYPE natv2PoolNotifiedPortMapProtocol OBJECT-TYPE
SYNTAX Natv2PoolIndex SYNTAX ProtocolNumber
MAX-ACCESS not-accessible MAX-ACCESS accessible-for-notify
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Index of the address pool to which this address range "The most-used protocol (i.e., with the largest number of
belongs. See Natv2PoolIndex." port map entries) mapped into this address pool at a given
::= { natv2PoolRangeEntry 2 } instant. One of the objects returned by
natv2NotificationPoolUsageLow and
natv2NotificationPoolUsageHigh."
::= { natv2PoolEntry 17 }
natv2PoolRangeRowIndex OBJECT-TYPE natv2PoolNotificationInterval OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32 (1..3600)
MAX-ACCESS not-accessible UNITS
STATUS current "Seconds"
DESCRIPTION MAX-ACCESS read-write
"Row index for successive range entries for the same STATUS current
address pool." DESCRIPTION
::= { natv2PoolRangeEntry 3 } "Minimum number of seconds between successive
notifications for this address pool. Controls the generation
of natv2NotificationPoolUsageLow and
natv2NotificationPoolUsageHigh."
DEFVAL
{ 20 }
::= { natv2PoolEntry 18 }
natv2PoolRangeBegin OBJECT-TYPE natv2PoolRangeTable OBJECT-TYPE
SYNTAX InetAddress SYNTAX SEQUENCE OF Natv2PoolRangeEntry
MAX-ACCESS read-only MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Lowest address included in this range. The type of address "This table contains address ranges used by pool entries.
(IPv4 or IPv6) is given by natv2PoolAddressType It is an expansion of natv2PoolTable."
in natv2PoolTable." REFERENCE
::= { natv2PoolRangeEntry 4 } "RFC 7659, Section 3.3.7."
::= { natv2MIBInstanceObjects 4 }
natv2PoolRangeEnd OBJECT-TYPE natv2PoolRangeEntry OBJECT-TYPE
SYNTAX InetAddress SYNTAX Natv2PoolRangeEntry
MAX-ACCESS read-only MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Highest address included in this range. The type of address "NAT pool address range."
(IPv4 or IPv6) is given by natv2PoolAddressType INDEX {
in natv2PoolTable." natv2PoolRangeInstanceIndex,
::= { natv2PoolRangeEntry 5 } natv2PoolRangePoolIndex,
natv2PoolRangeRowIndex
}
::= { natv2PoolRangeTable 1 }
-- indexed mapping tables Natv2PoolRangeEntry ::=
SEQUENCE {
natv2PoolRangeInstanceIndex Natv2InstanceIndex,
natv2PoolRangePoolIndex Natv2PoolIndex,
natv2PoolRangeRowIndex Unsigned32,
natv2PoolRangeBegin InetAddress,
natv2PoolRangeEnd InetAddress
}
-- Address Map Table. Mapped from internal to external address. natv2PoolRangeInstanceIndex OBJECT-TYPE
SYNTAX Natv2InstanceIndex
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Index of the NAT instance on which the address pool and this
address range are configured. See Natv2InstanceIndex."
::= { natv2PoolRangeEntry 1 }
natv2AddressMapTable OBJECT-TYPE natv2PoolRangePoolIndex OBJECT-TYPE
SYNTAX SEQUENCE OF Natv2AddressMapEntry SYNTAX Natv2PoolIndex
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Table of mappings from internal to external address. By "Index of the address pool to which this address range
definition, this is a snapshot of NAT instance state at a belongs. See Natv2PoolIndex."
given moment. Indexed by NAT instance, internal realm, and ::= { natv2PoolRangeEntry 2 }
internal address in that realm. Provides the mapped external
address and, depending on implementation support, identifies
the address pool from which the external address and port
were taken and the index of the subscriber to which the
mapping has been allocated.
In the case of DS-Lite [RFC 6333], the indexing realm and natv2PoolRangeRowIndex OBJECT-TYPE
address are those of the IPv6 encapsulation rather than the SYNTAX Unsigned32
IPv4 inner packet." MAX-ACCESS not-accessible
REFERENCE STATUS current
"RFC yyyy Section 3.3.8. DS-Lite: RFC 6333" DESCRIPTION
::= { natv2MIBInstanceObjects 5 } "Row index for successive range entries for the same
address pool."
::= { natv2PoolRangeEntry 3 }
natv2AddressMapEntry OBJECT-TYPE natv2PoolRangeBegin OBJECT-TYPE
SYNTAX Natv2AddressMapEntry SYNTAX InetAddress
MAX-ACCESS not-accessible MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Mapping from internal to external address." "Lowest address included in this range. The type of address
INDEX { natv2AddressMapInstanceIndex, (IPv4 or IPv6) is given by natv2PoolAddressType
natv2AddressMapInternalRealm, in natv2PoolTable."
natv2AddressMapInternalAddressType, ::= { natv2PoolRangeEntry 4 }
natv2AddressMapInternalAddress,
natv2AddressMapRowIndex }
::= { natv2AddressMapTable 1 }
Natv2AddressMapEntry ::= natv2PoolRangeEnd OBJECT-TYPE
SEQUENCE { SYNTAX InetAddress
natv2AddressMapInstanceIndex Natv2InstanceIndex, MAX-ACCESS read-only
natv2AddressMapInternalRealm SnmpAdminString, STATUS current
natv2AddressMapInternalAddressType InetAddressType, DESCRIPTION
natv2AddressMapInternalAddress InetAddress, "Highest address included in this range. The type of address
natv2AddressMapRowIndex Unsigned32, (IPv4 or IPv6) is given by natv2PoolAddressType
natv2AddressMapInternalMappedAddressType InetAddressType, in natv2PoolTable."
natv2AddressMapInternalMappedAddress InetAddress, ::= { natv2PoolRangeEntry 5 }
natv2AddressMapExternalRealm SnmpAdminString,
natv2AddressMapExternalAddressType InetAddressType,
natv2AddressMapExternalAddress InetAddress,
natv2AddressMapExternalPoolIndex Natv2PoolIndexOrZero,
natv2AddressMapSubscriberIndex Natv2SubscriberIndexOrZero
}
natv2AddressMapInstanceIndex OBJECT-TYPE -- Indexed mapping tables
SYNTAX Natv2InstanceIndex
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Index of the NAT instance that generated this address map."
::= { natv2AddressMapEntry 1 }
natv2AddressMapInternalRealm OBJECT-TYPE -- Address Map Table. Mapped from the internal to external address.
SYNTAX SnmpAdminString (SIZE(0..32))
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Realm to which the internal address belongs. In most cases
this is the realm defining the address space of the packet
being translated. However, in the case of DS-Lite [RFC
6333], this realm defines the IPv6 outer header address
space. It is the combination of that outer header and
the inner IPv4 packet header that is remapped to the
external address and realm. The corresponding IPv4 realm is
restricted in scope to the tunnel, so there is no point in
identifying it. The mapped IPv4 address will normally be the
well-known value 192.0.0.2, or at least lie in the reserved
192.0.0.0/29 range.
If natv2AddressMapSubscriberIndex in this table is a valid natv2AddressMapTable OBJECT-TYPE
subscriber index (i.e., greater than zero), then the value SYNTAX SEQUENCE OF Natv2AddressMapEntry
of natv2AddressMapInternalRealm MUST be identical to the MAX-ACCESS not-accessible
value of natv2SubscriberRealm associated with that index." STATUS current
REFERENCE DESCRIPTION
"DS-Lite: RFC 6333, Section 5.7 for well-known addresses and "Table of mappings from the internal to external address. By
Section 6.6 on the need to have the IPv6 tunnel address in definition, this is a snapshot of NAT instance state at a
the NAT mapping tables." given moment. Indexed by NAT instance, internal realm, and
::= { natv2AddressMapEntry 2 } internal address in that realm. Provides the mapped external
address and, depending on implementation support, identifies
the address pool from which the external address and port
were taken and the index of the subscriber to which the
mapping has been allocated.
natv2AddressMapInternalAddressType OBJECT-TYPE In the case of DS-Lite (RFC 6333), the indexing realm and
SYNTAX InetAddressType address are those of the IPv6 encapsulation rather than the
MAX-ACCESS not-accessible IPv4 inner packet."
STATUS current REFERENCE
DESCRIPTION "RFC 7659, Section 3.3.8. DS-Lite: RFC 6333"
"Address type in the header of packets on the ::= { natv2MIBInstanceObjects 5 }
interior side of this mapping. Any value other than ipv4(1)
or ipv6(2) would be unexpected.
In the DS-Lite case, the address type is ipv6(2)." natv2AddressMapEntry OBJECT-TYPE
REFERENCE SYNTAX Natv2AddressMapEntry
"DS-Lite: RFC 6333, Section 5.7 for well-known addresses and MAX-ACCESS not-accessible
Section 6.6 on the need to have the IPv6 tunnel source STATUS current
address in the NAT mapping tables." DESCRIPTION
::= { natv2AddressMapEntry 3 } "Mapping from internal to external address."
INDEX { natv2AddressMapInstanceIndex,
natv2AddressMapInternalRealm,
natv2AddressMapInternalAddressType,
natv2AddressMapInternalAddress,
natv2AddressMapRowIndex }
::= { natv2AddressMapTable 1 }
natv2AddressMapInternalAddress OBJECT-TYPE Natv2AddressMapEntry ::=
SYNTAX InetAddress (SIZE (0..16)) SEQUENCE {
MAX-ACCESS not-accessible natv2AddressMapInstanceIndex Natv2InstanceIndex,
STATUS current natv2AddressMapInternalRealm SnmpAdminString,
DESCRIPTION natv2AddressMapInternalAddressType InetAddressType,
"Source address of packets originating from the interior natv2AddressMapInternalAddress InetAddress,
of the association provided by this mapping. The address natv2AddressMapRowIndex Unsigned32,
type is given by natv2AddressMapInternalAddressType. natv2AddressMapInternalMappedAddressType InetAddressType,
natv2AddressMapInternalMappedAddress InetAddress,
natv2AddressMapExternalRealm SnmpAdminString,
natv2AddressMapExternalAddressType InetAddressType,
natv2AddressMapExternalAddress InetAddress,
natv2AddressMapExternalPoolIndex Natv2PoolIndexOrZero,
natv2AddressMapSubscriberIndex Natv2SubscriberIndexOrZero
}
In the case of DS-Lite [RFC 6333], this is the IPv6 tunnel natv2AddressMapInstanceIndex OBJECT-TYPE
source address. The mapping in this case is considered to SYNTAX Natv2InstanceIndex
be from the combination of the IPv6 tunnel source address MAX-ACCESS not-accessible
natv2AddressMapInternalRealmAddress and the well-known IPv4 STATUS current
inner source address natv2AddressMapInternalMappedAddress to DESCRIPTION
the external address." "Index of the NAT instance that generated this address map."
REFERENCE ::= { natv2AddressMapEntry 1 }
"DS-Lite: RFC 6333, Section 5.7 for well-known addresses and
Section 6.6 on the need to have the IPv6 tunnel address in
the NAT mapping tables."
::= { natv2AddressMapEntry 4 }
natv2AddressMapRowIndex OBJECT-TYPE natv2AddressMapInternalRealm OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX SnmpAdminString (SIZE(0..32))
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Index of a conceptual row corresponding to a mapping of the "Realm to which the internal address belongs. In most cases,
given internal realm and address to a single external realm this is the realm defining the address space of the packet
and address. Multiple rows will be present because of a being translated. However, in the case of DS-Lite (RFC
promiscuous external address selection policy, policies 6333), this realm defines the IPv6 outer header address
associating the same internal address with different address space. It is the combination of that outer header and
pools, or because the same internal realm-address the inner IPv4 packet header that is remapped to the
combination is communicating with multiple external address external address and realm. The corresponding IPv4 realm is
realms." restricted in scope to the tunnel, so there is no point in
::= { natv2AddressMapEntry 5 } identifying it. The mapped IPv4 address will normally be the
well-known value 192.0.0.2, or at least lie in the reserved
192.0.0.0/29 range.
natv2AddressMapInternalMappedAddressType OBJECT-TYPE If natv2AddressMapSubscriberIndex in this table is a valid
SYNTAX InetAddressType subscriber index (i.e., greater than zero), then the value
MAX-ACCESS read-only of natv2AddressMapInternalRealm MUST be identical to the
STATUS current value of natv2SubscriberRealm associated with that index."
DESCRIPTION REFERENCE
"Internal address type actually translated by this mapping. "DS-Lite: RFC 6333, Sections 5.7 (for well-known addresses)
Any value other than ipv4(1) or ipv6(2) would be unexpected. and 6.6 (on the need to have the IPv6 tunnel address in
In the general case, this is the same as given by the NAT mapping tables)."
natv2AddressMapInternalRealmAddressType. In the ::= { natv2AddressMapEntry 2 }
tunneled case it is the address type used in the
encapsulated packet header. In particular, in the DS-Lite
case, the mapped address type is ipv4(1)."
REFERENCE
"DS-Lite: RFC 6333."
::= { natv2AddressMapEntry 6 }
natv2AddressMapInternalMappedAddress OBJECT-TYPE natv2AddressMapInternalAddressType OBJECT-TYPE
SYNTAX InetAddress SYNTAX InetAddressType
MAX-ACCESS read-only MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Internal address actually translated by this mapping. In the "Address type in the header of packets on the
general case, this is the same as interior side of this mapping. Any value other than ipv4(1)
natv2AddressMapInternalRealmAddress. The address type is or ipv6(2) would be unexpected.
given by natv2AddressMapInternalMappedAddressType. In the
case of DS-Lite [RFC 6333], this is the source address of
the encapsulated IPv4 packet, normally lying the well-known
range 192.0.0.0/29. The mapping in this case is considered
to be from the combination of the IPv6 tunnel source address
natv2AddressMapInternalRealmAddress and the well-known IPv4
inner source address natv2AddressMapInternalMappedAddress to
the external address."
REFERENCE
"DS-Lite: RFC 6333, Section 5.7 for well-known addresses and
Section 6.6 on the need to have the IPv6 tunnel address in
the NAT mapping tables."
::= { natv2AddressMapEntry 7 }
natv2AddressMapExternalRealm OBJECT-TYPE In the DS-Lite case, the address type is ipv6(2)."
SYNTAX SnmpAdminString (SIZE(0..32)) REFERENCE
MAX-ACCESS read-only "DS-Lite: RFC 6333, Sections 5.7 (for well-known addresses)
STATUS current and 6.6 (on the need to have the IPv6 tunnel source
DESCRIPTION address in the NAT mapping tables)."
"External address realm to which this mapping maps the ::= { natv2AddressMapEntry 3 }
internal address. This can be the same as the internal realm
in the case of a 'hairpin' connection, but otherwise will be
different."
::= { natv2AddressMapEntry 8 }
natv2AddressMapExternalAddressType OBJECT-TYPE natv2AddressMapInternalAddress OBJECT-TYPE
SYNTAX InetAddressType SYNTAX InetAddress (SIZE (0..16))
MAX-ACCESS read-only MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Address type for the external realm. Any value other than "Source address of packets originating from the interior
ipv4(1) or ipv6(2) would be unexpected." of the association provided by this mapping. The address
::= { natv2AddressMapEntry 9 } type is given by natv2AddressMapInternalAddressType.
natv2AddressMapExternalAddress OBJECT-TYPE In the case of DS-Lite (RFC 6333), this is the IPv6 tunnel
SYNTAX InetAddress source address. The mapping in this case is considered to
MAX-ACCESS read-only be from the combination of the IPv6 tunnel source address
STATUS current natv2AddressMapInternalRealmAddress and the well-known IPv4
DESCRIPTION inner source address natv2AddressMapInternalMappedAddress to
"External address to which the internal address is mapped. the external address."
The address type is given by REFERENCE
natv2AddressMapExternalAddressType. "DS-Lite: RFC 6333, Sections 5.7 (for well-known addresses)
and 6.6 (on the need to have the IPv6 tunnel address in
the NAT mapping tables)."
::= { natv2AddressMapEntry 4 }
In the DS-Lite case, the mapping is from the combination of natv2AddressMapRowIndex OBJECT-TYPE
the internal IPv6 tunnel source address as presented in this SYNTAX Unsigned32
table and the well-known IPv4 source address of the MAX-ACCESS not-accessible
encapsulated IPv4 packet." STATUS current
REFERENCE DESCRIPTION
"DS-Lite: RFC 6333, Section 5.7 for well-known addresses and "Index of a conceptual row corresponding to a mapping of the
Section 6.6 on the need to have the IPv6 tunnel address in given internal realm and address to a single external realm
the NAT mapping tables." and address. Multiple rows will be present because of a
::= { natv2AddressMapEntry 10 } promiscuous external address selection policy, policies
associating the same internal address with different address
pools, or because the same internal realm-address
combination is communicating with multiple external address
realms."
::= { natv2AddressMapEntry 5 }
natv2AddressMapExternalPoolIndex OBJECT-TYPE natv2AddressMapInternalMappedAddressType OBJECT-TYPE
SYNTAX Natv2PoolIndexOrZero SYNTAX InetAddressType
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Index of the address pool in the external realm from which "Internal address type actually translated by this mapping.
the mapped external address given in Any value other than ipv4(1) or ipv6(2) would be unexpected.
natv2AddressMapExternalAddress was taken. Zero if the In the general case, this is the same as given by
implementation does not support address pools but has chosen natv2AddressMapInternalRealmAddressType. In the
to support this object, or if no pool was configured for the tunneled case, it is the address type used in the
given external realm." encapsulated packet header. In particular, in the DS-Lite
::= { natv2AddressMapEntry 11 } case, the mapped address type is ipv4(1)."
REFERENCE
"DS-Lite: RFC 6333."
::= { natv2AddressMapEntry 6 }
natv2AddressMapSubscriberIndex OBJECT-TYPE natv2AddressMapInternalMappedAddress OBJECT-TYPE
SYNTAX Natv2SubscriberIndexOrZero SYNTAX InetAddress
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Index of the subscriber to which this address mapping "Internal address actually translated by this mapping. In the
applies, or zero if no subscribers are configured on general case, this is the same as
this NAT instance." natv2AddressMapInternalRealmAddress. The address type is
::= { natv2AddressMapEntry 12 } given by natv2AddressMapInternalMappedAddressType. In the
case of DS-Lite (RFC 6333), this is the source address of
the encapsulated IPv4 packet, normally lying in the well-known
range 192.0.0.0/29. The mapping in this case is considered
to be from the combination of the IPv6 tunnel source address
natv2AddressMapInternalRealmAddress and the well-known IPv4
inner source address natv2AddressMapInternalMappedAddress to
the external address."
REFERENCE
"DS-Lite: RFC 6333, Sections 5.7 (for well-known addresses)
and 6.6 (on the need to have the IPv6 tunnel address in
the NAT mapping tables)."
::= { natv2AddressMapEntry 7 }
-- natv2PortMapTable natv2AddressMapExternalRealm OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(0..32))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"External address realm to which this mapping maps the
internal address. This can be the same as the internal realm
in the case of a 'hairpin' connection, but otherwise will be
different."
::= { natv2AddressMapEntry 8 }
natv2PortMapTable OBJECT-TYPE natv2AddressMapExternalAddressType OBJECT-TYPE
SYNTAX SEQUENCE OF Natv2PortMapEntry SYNTAX InetAddressType
MAX-ACCESS not-accessible MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Table of port map entries indexed by NAT instance, protocol, "Address type for the external realm. Any value other than
and external realm and address. A port map entry associates ipv4(1) or ipv6(2) would be unexpected."
an internal upper layer protocol endpoint with an endpoint ::= { natv2AddressMapEntry 9 }
for the same protocol in the given external realm. By
definition, this is a snapshot of NAT instance state at a
given moment. The table provides the basic mapping
information.
In the case of DS-Lite [RFC 6333], the table provides the natv2AddressMapExternalAddress OBJECT-TYPE
internal IPv6 tunnel source address in SYNTAX InetAddress
natv2PortMapInternalRealmAddress and the IPv4 source address MAX-ACCESS read-only
of the encapsulated packet that is actually translated in STATUS current
natv2PortMapInternalMappedAddress. In the general (non-DS- DESCRIPTION
Lite) case, those two objects will have the same value." "External address to which the internal address is mapped.
REFERENCE The address type is given by
"RFC yyyy Section 3.3.9. DS-Lite: RFC 6333, Section 5.7 for natv2AddressMapExternalAddressType.
well-known addresses and Section 6.6 on the need to have the
IPv6 tunnel address in the NAT mapping tables."
::= { natv2MIBInstanceObjects 6 }
natv2PortMapEntry OBJECT-TYPE In the DS-Lite case, the mapping is from the combination of
SYNTAX Natv2PortMapEntry the internal IPv6 tunnel source address as presented in this
MAX-ACCESS not-accessible table and the well-known IPv4 source address of the
STATUS current encapsulated IPv4 packet."
DESCRIPTION REFERENCE
"A single NAT mapping." "DS-Lite: RFC 6333, Sections 5.7 (for well-known addresses)
INDEX { natv2PortMapInstanceIndex, and 6.6 (on the need to have the IPv6 tunnel address in
natv2PortMapProtocol, the NAT mapping tables)."
natv2PortMapExternalRealm, ::= { natv2AddressMapEntry 10 }
natv2PortMapExternalAddressType,
natv2PortMapExternalAddress,
natv2PortMapExternalPort }
::= { natv2PortMapTable 1 }
Natv2PortMapEntry ::= natv2AddressMapExternalPoolIndex OBJECT-TYPE
SEQUENCE { SYNTAX Natv2PoolIndexOrZero
natv2PortMapInstanceIndex Natv2InstanceIndex, MAX-ACCESS read-only
natv2PortMapProtocol ProtocolNumber, STATUS current
natv2PortMapExternalRealm SnmpAdminString, DESCRIPTION
natv2PortMapExternalAddressType InetAddressType, "Index of the address pool in the external realm from which
natv2PortMapExternalAddress InetAddress, the mapped external address given in
natv2PortMapExternalPort InetPortNumber, natv2AddressMapExternalAddress was taken. Zero if the
natv2PortMapInternalRealm SnmpAdminString, implementation does not support address pools but has chosen
natv2PortMapInternalAddressType InetAddressType, to support this object or if no pool was configured for the
natv2PortMapInternalAddress InetAddress, given external realm."
natv2PortMapInternalMappedAddressType InetAddressType, ::= { natv2AddressMapEntry 11 }
natv2PortMapInternalMappedAddress InetAddress,
natv2PortMapInternalPort InetPortNumber,
natv2PortMapExternalPoolIndex Natv2PoolIndexOrZero,
natv2PortMapSubscriberIndex Natv2SubscriberIndexOrZero
}
natv2PortMapInstanceIndex OBJECT-TYPE natv2AddressMapSubscriberIndex OBJECT-TYPE
SYNTAX Natv2InstanceIndex SYNTAX Natv2SubscriberIndexOrZero
MAX-ACCESS not-accessible MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Index of the NAT instance that created this port map entry." "Index of the subscriber to which this address mapping
::= { natv2PortMapEntry 1 } applies, or zero if no subscribers are configured on
this NAT instance."
::= { natv2AddressMapEntry 12 }
natv2PortMapProtocol OBJECT-TYPE -- natv2PortMapTable
SYNTAX ProtocolNumber
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The map entry's upper layer protocol number."
::= { natv2PortMapEntry 2 }
natv2PortMapExternalRealm OBJECT-TYPE natv2PortMapTable OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(0..32)) SYNTAX SEQUENCE OF Natv2PortMapEntry
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The realm to which natv2PortMapExternalAddress belongs." "Table of port map entries indexed by the NAT instance,
::= { natv2PortMapEntry 3 } protocol, and external realm and address. A port map entry
associates an internal upper-layer protocol endpoint with an
endpoint for the same protocol in the given external realm.
By definition, this is a snapshot of NAT instance state at
a given moment. The table provides the basic mapping
information.
natv2PortMapExternalAddressType OBJECT-TYPE In the case of DS-Lite (RFC 6333), the table provides the
SYNTAX InetAddressType internal IPv6 tunnel source address in
MAX-ACCESS not-accessible natv2PortMapInternalRealmAddress and the IPv4 source address
STATUS current of the encapsulated packet that is actually translated in
DESCRIPTION natv2PortMapInternalMappedAddress. In the general (non-DS-
"Address type for the external realm. A value other Lite) case, those two objects will have the same value."
than ipv4(1) or ipv6(2) would be unexpected." REFERENCE
::= { natv2PortMapEntry 4 } "RFC 7659, Section 3.3.9.
DS-Lite: RFC 6333, Sections 5.7
(for well-known addresses) and 6.6 (on the need to have the
IPv6 tunnel address in the NAT mapping tables)."
::= { natv2MIBInstanceObjects 6 }
natv2PortMapExternalAddress OBJECT-TYPE natv2PortMapEntry OBJECT-TYPE
SYNTAX InetAddress (SIZE (0..16)) SYNTAX Natv2PortMapEntry
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The mapping's assigned external address. (This address is "A single NAT mapping."
taken from the address pool identified by INDEX { natv2PortMapInstanceIndex,
natv2PortMapExternalPoolIndex, if the implementation natv2PortMapProtocol,
supports address pools and pools are configured for the natv2PortMapExternalRealm,
given external realm.) This is the source address for natv2PortMapExternalAddressType,
translated outgoing packets. The address type is given natv2PortMapExternalAddress,
by natv2PortMapExternalAddressType." natv2PortMapExternalPort }
::= { natv2PortMapTable 1 }
::= { natv2PortMapEntry 5 } Natv2PortMapEntry ::=
SEQUENCE {
natv2PortMapInstanceIndex Natv2InstanceIndex,
natv2PortMapProtocol ProtocolNumber,
natv2PortMapExternalRealm SnmpAdminString,
natv2PortMapExternalAddressType InetAddressType,
natv2PortMapExternalAddress InetAddress,
natv2PortMapExternalPort InetPortNumber,
natv2PortMapInternalRealm SnmpAdminString,
natv2PortMapInternalAddressType InetAddressType,
natv2PortMapInternalAddress InetAddress,
natv2PortMapInternalMappedAddressType InetAddressType,
natv2PortMapInternalMappedAddress InetAddress,
natv2PortMapInternalPort InetPortNumber,
natv2PortMapExternalPoolIndex Natv2PoolIndexOrZero,
natv2PortMapSubscriberIndex Natv2SubscriberIndexOrZero
}
natv2PortMapExternalPort OBJECT-TYPE natv2PortMapInstanceIndex OBJECT-TYPE
SYNTAX InetPortNumber SYNTAX Natv2InstanceIndex
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The mapping's assigned external port number. This is the "Index of the NAT instance that created this port map entry."
source port for translated outgoing packets. If the internal ::= { natv2PortMapEntry 1 }
port number given by natv2PortMapInternalPort is zero this
value MUST also be zero. Otherwise this MUST be a non-zero
value."
::= { natv2PortMapEntry 6 }
natv2PortMapInternalRealm OBJECT-TYPE natv2PortMapProtocol OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(0..32)) SYNTAX ProtocolNumber
MAX-ACCESS read-only MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The realm to which natv2PortMapInternalRealmAddress belongs. "The map entry's upper-layer protocol number."
In the general case, this realm contains the address that is ::= { natv2PortMapEntry 2 }
being translated. In the DS-Lite [RFC 6333] case, this realm
defines the IPv6 address space from which the tunnel source
address is taken. The realm of the encapsulated IPv4 address
is restricted in scope to the tunnel, so there is no point
in identifying it separately."
REFERENCE
"RFC 6333 DS-Lite."
::= { natv2PortMapEntry 7 }
natv2PortMapInternalAddressType OBJECT-TYPE natv2PortMapExternalRealm OBJECT-TYPE
SYNTAX InetAddressType SYNTAX SnmpAdminString (SIZE(0..32))
MAX-ACCESS read-only MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Address type for addresses in the realm identified by "The realm to which natv2PortMapExternalAddress belongs."
natv2PortMapInternalRealm." ::= { natv2PortMapEntry 3 }
::= { natv2PortMapEntry 8 }
natv2PortMapInternalAddress OBJECT-TYPE natv2PortMapExternalAddressType OBJECT-TYPE
SYNTAX InetAddress SYNTAX InetAddressType
MAX-ACCESS read-only MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Source address for packets received under this mapping on "Address type for the external realm. A value other
the internal side of the NAT instance. In the general case than ipv4(1) or ipv6(2) would be unexpected."
this address is the same as the address given in ::= { natv2PortMapEntry 4 }
natv2PortMapInternalMappedAddress. In the DS-Lite case,
natv2PortMapInternalAddress is the IPv6 tunnel source
address. The address type is given
by natv2PortMapInternalAddressType."
REFERENCE
"DS-Lite: RFC 6333, Section 5.7 for well-known addresses and
Section 6.6 on the need to have the IPv6 tunnel address in
the NAT mapping tables."
::= { natv2PortMapEntry 9 }
natv2PortMapInternalMappedAddressType OBJECT-TYPE natv2PortMapExternalAddress OBJECT-TYPE
SYNTAX InetAddressType SYNTAX InetAddress (SIZE (0..16))
MAX-ACCESS read-only MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Internal address type actually translated by this mapping. "The mapping's assigned external address. (This address is
Any value other than ipv4(1) or ipv6(2) would be unexpected. taken from the address pool identified by
In the general case, this is the same as given by natv2PortMapExternalPoolIndex, if the implementation
natv2AddressMapInternalAddressType. In the DS-Lite supports address pools and pools are configured for the
case, the address type is ipv4(1)." given external realm.) This is the source address for
REFERENCE translated outgoing packets. The address type is given
"DS-Lite: RFC 6333." by natv2PortMapExternalAddressType."
::= { natv2PortMapEntry 10 }
natv2PortMapInternalMappedAddress OBJECT-TYPE ::= { natv2PortMapEntry 5 }
SYNTAX InetAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Internal address actually translated by this mapping. In the
general case, this is the same as
natv2PortMapInternalRealmAddress. The address type is given
by natv2PortMapInternalMappedAddressType.
In the case of DS-Lite [RFC 6333], this is the source natv2PortMapExternalPort OBJECT-TYPE
address of the encapsulated IPv4 packet, normally selected SYNTAX InetPortNumber
from the well-known range 192.0.0.0/29. The mapping in this MAX-ACCESS not-accessible
case is considered to be from the external address to the STATUS current
combination of the IPv6 tunnel source address DESCRIPTION
natv2PortMapInternalRealmAddress and the well-known IPv4 "The mapping's assigned external port number. This is the
inner source address natv2PortMapInternalMappedAddress." source port for translated outgoing packets. If the internal
REFERENCE port number given by natv2PortMapInternalPort is zero, this
"DS-Lite: RFC 6333, Section 5.7 for well-known addresses and value MUST also be zero. Otherwise, this MUST be a non-zero
Section 6.6 on the need to have the IPv6 tunnel address in value."
the NAT mapping tables." ::= { natv2PortMapEntry 6 }
::= { natv2PortMapEntry 11 }
natv2PortMapInternalPort OBJECT-TYPE natv2PortMapInternalRealm OBJECT-TYPE
SYNTAX InetPortNumber SYNTAX SnmpAdminString (SIZE(0..32))
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The mapping's internal port number. If this is zero, ports "The realm to which natv2PortMapInternalRealmAddress belongs.
are not translated (i.e., the NAT instance is a pure NAT In the general case, this realm contains the address that is
rather than a NAPT)." being translated. In the DS-Lite (RFC 6333) case, this realm
::= { natv2PortMapEntry 12 } defines the IPv6 address space from which the tunnel source
address is taken. The realm of the encapsulated IPv4 address
is restricted in scope to the tunnel, so there is no point
in identifying it separately."
REFERENCE
"DS-Lite: RFC 6333."
natv2PortMapExternalPoolIndex OBJECT-TYPE ::= { natv2PortMapEntry 7 }
SYNTAX Natv2PoolIndexOrZero
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Identifies the address pool from which the external address
in this port map entry was taken. Zero if the implementation
does not support address pools but has chosen to support
this object, or if no pools are configured for the given
external realm."
::= { natv2PortMapEntry 13 }
natv2PortMapSubscriberIndex OBJECT-TYPE natv2PortMapInternalAddressType OBJECT-TYPE
SYNTAX Natv2SubscriberIndexOrZero SYNTAX InetAddressType
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Subscriber using this map entry. Zero if the implementation "Address type for addresses in the realm identified by
does not support subscribers but has chosen to support natv2PortMapInternalRealm."
this object." ::= { natv2PortMapEntry 8 }
::= { natv2PortMapEntry 14 }
-- Conformance section. Specifies three cumulatively more extensive natv2PortMapInternalAddress OBJECT-TYPE
-- applications: basic NAT, pooled NAT, and carrier grade NAT SYNTAX InetAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Source address for packets received under this mapping on
the internal side of the NAT instance. In the general case,
this address is the same as the address given in
natv2PortMapInternalMappedAddress. In the DS-Lite case,
natv2PortMapInternalAddress is the IPv6 tunnel source
address. The address type is given
by natv2PortMapInternalAddressType."
REFERENCE
"DS-Lite: RFC 6333, Sections 5.7 (for well-known addresses)
and 6.6 (on the need to have the IPv6 tunnel address in
the NAT mapping tables)."
::= { natv2PortMapEntry 9 }
natv2MIBConformance OBJECT IDENTIFIER ::= { natv2MIB 3 } natv2PortMapInternalMappedAddressType OBJECT-TYPE
SYNTAX InetAddressType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Internal address type actually translated by this mapping.
Any value other than ipv4(1) or ipv6(2) would be unexpected.
In the general case, this is the same as given by
natv2AddressMapInternalAddressType. In the DS-Lite
case, the address type is ipv4(1)."
REFERENCE
"DS-Lite: RFC 6333."
::= { natv2PortMapEntry 10 }
natv2MIBCompliances OBJECT IDENTIFIER ::= { natv2MIBConformance 1 } natv2PortMapInternalMappedAddress OBJECT-TYPE
natv2MIBGroups OBJECT IDENTIFIER ::= { natv2MIBConformance 2 } SYNTAX InetAddress
natv2MIBBasicCompliance MODULE-COMPLIANCE MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Describes the requirements for conformance to the basic NAT "Internal address actually translated by this mapping. In the
application of NATv2 MIB." general case, this is the same as
MODULE -- this module natv2PortMapInternalRealmAddress. The address type is given
MANDATORY-GROUPS { natv2BasicNotificationGroup, by natv2PortMapInternalMappedAddressType.
natv2BasicInstanceLevelGroup
}
GROUP natv2BasicNotificationGroup
DESCRIPTION
"The natv2BasicNotificationGroup is mandatory for all
NAT applications."
GROUP natv2BasicInstanceLevelGroup
DESCRIPTION
"The natv2BasicInstanceLevelGroup is mandatory for all
NAT applications."
::= { natv2MIBCompliances 1 }
natv2MIBPooledNATCompliance MODULE-COMPLIANCE In the case of DS-Lite (RFC 6333), this is the source
STATUS current address of the encapsulated IPv4 packet, normally selected
DESCRIPTION from the well-known range 192.0.0.0/29. The mapping in this
"Describes the requirements for conformance to the pooled NAT case is considered to be from the external address to the
application of NATv2-MIB." combination of the IPv6 tunnel source address
MODULE -- this module natv2PortMapInternalRealmAddress and the well-known IPv4
MANDATORY-GROUPS { natv2BasicNotificationGroup, inner source address natv2PortMapInternalMappedAddress."
natv2BasicInstanceLevelGroup, REFERENCE
natv2PooledNotificationGroup, "DS-Lite: RFC 6333, Sections 5.7 (for well-known addresses)
natv2PooledInstanceLevelGroup and 6.6 (on the need to have the IPv6 tunnel address in
} the NAT mapping tables)."
GROUP natv2BasicNotificationGroup ::= { natv2PortMapEntry 11 }
DESCRIPTION
"The natv2BasicNotificationGroup is mandatory for all
NAT applications."
GROUP natv2BasicInstanceLevelGroup
DESCRIPTION
"The natv2BasicInstanceLevelGroup is mandatory for all
NAT applications."
GROUP natv2PooledNotificationGroup
DESCRIPTION
"The natv2PooledNotificationGroup is mandatory for
the pooled and CGN applications."
GROUP natv2PooledInstanceLevelGroup
DESCRIPTION
"The natv2PooledInstanceLevelGroup is mandatory for
the pooled and CGN applications."
::= { natv2MIBCompliances 2 }
natv2MIBCGNCompliance MODULE-COMPLIANCE natv2PortMapInternalPort OBJECT-TYPE
STATUS current SYNTAX InetPortNumber
DESCRIPTION MAX-ACCESS read-only
"Describes the requirements for conformance to the STATUS current
carrier grade NAT application of NATv2-MIB." DESCRIPTION
MODULE -- this module "The mapping's internal port number. If this is zero, ports
MANDATORY-GROUPS { natv2BasicNotificationGroup, are not translated (i.e., the NAT instance is a pure NAT
natv2BasicInstanceLevelGroup, rather than a Network Address and Port Translator (NAPT))."
natv2PooledNotificationGroup, ::= { natv2PortMapEntry 12 }
natv2PooledInstanceLevelGroup,
natv2CGNNotificationGroup,
natv2CGNDeviceLevelGroup,
natv2CGNInstanceLevelGroup
}
GROUP natv2BasicNotificationGroup
DESCRIPTION
"The natv2BasicNotificationGroup is mandatory for all
NAT applications."
GROUP natv2BasicInstanceLevelGroup
DESCRIPTION
"The natv2BasicInstanceLevelGroup is mandatory for all
NAT applications."
GROUP natv2PooledNotificationGroup
DESCRIPTION
"The natv2PooledNotificationGroup is mandatory for
the pooled and CGN applications."
GROUP natv2PooledInstanceLevelGroup
DESCRIPTION
"The natv2PooledInstanceLevelGroup is mandatory for
the pooled and CGN applications."
GROUP natv2CGNNotificationGroup
DESCRIPTION
"The natv2CGNNotificationGroup is mandatory
for the carrier grade NAT application."
GROUP natv2CGNDeviceLevelGroup
DESCRIPTION
"The natv2CGNDeviceLevelGroup is mandatory
for the carrier grade NAT application."
GROUP natv2CGNInstanceLevelGroup
DESCRIPTION
"The natv2CGNInstanceLevelGroup is mandatory
for the carrier grade NAT application."
::= { natv2MIBCompliances 3 }
-- Groups natv2PortMapExternalPoolIndex OBJECT-TYPE
SYNTAX Natv2PoolIndexOrZero
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Identifies the address pool from which the external address
in this port map entry was taken. Zero if the implementation
does not support address pools but has chosen to support
this object or if no pools are configured for the given
external realm."
::= { natv2PortMapEntry 13 }
natv2BasicNotificationGroup NOTIFICATION-GROUP natv2PortMapSubscriberIndex OBJECT-TYPE
NOTIFICATIONS { SYNTAX Natv2SubscriberIndexOrZero
natv2NotificationInstanceAddressMapEntriesHigh, MAX-ACCESS read-only
natv2NotificationInstancePortMapEntriesHigh STATUS current
} DESCRIPTION
STATUS current "Subscriber using this map entry. Zero if the implementation
DESCRIPTION does not support subscribers but has chosen to support
"Notifications that MUST be supported by all NAT this object."
applications."
::= { natv2MIBGroups 1 }
natv2BasicInstanceLevelGroup OBJECT-GROUP ::= { natv2PortMapEntry 14 }
OBJECTS {
-- from natv2InstanceTable
natv2InstanceAlias,
natv2InstancePortMappingBehavior,
natv2InstanceFilteringBehavior,
natv2InstanceFragmentBehavior,
natv2InstanceAddressMapEntries,
natv2InstancePortMapEntries,
natv2InstanceTranslations,
natv2InstanceAddressMapCreations,
natv2InstanceAddressMapEntryLimitDrops,
natv2InstanceAddressMapFailureDrops,
natv2InstancePortMapCreations,
natv2InstancePortMapEntryLimitDrops,
natv2InstancePortMapFailureDrops,
natv2InstanceFragmentDrops,
natv2InstanceOtherResourceFailureDrops,
natv2InstanceDiscontinuityTime,
natv2InstanceThresholdAddressMapEntriesHigh,
natv2InstanceThresholdPortMapEntriesHigh,
natv2InstanceNotificationInterval,
natv2InstanceLimitAddressMapEntries,
natv2InstanceLimitPortMapEntries,
natv2InstanceLimitPendingFragments,
-- from natv2ProtocolTable
natv2ProtocolPortMapEntries,
natv2ProtocolTranslations,
natv2ProtocolPortMapCreations,
natv2ProtocolPortMapFailureDrops,
-- from natv2AddressMapTable
natv2AddressMapExternalRealm,
natv2AddressMapExternalAddressType,
natv2AddressMapExternalAddress,
-- from natv2PortMapTable
natv2PortMapInternalRealm,
natv2PortMapInternalAddressType,
natv2PortMapInternalAddress,
natv2PortMapInternalPort
}
STATUS current
DESCRIPTION
"Per-instance objects that MUST be supported by
implementations of all NAT applications."
::= { natv2MIBGroups 2 }
natv2PooledNotificationGroup NOTIFICATION-GROUP -- Conformance section. Specifies three cumulatively more extensive
NOTIFICATIONS { -- applications: basic NAT, pooled NAT, and carrier-grade NAT.
natv2NotificationPoolUsageLow,
natv2NotificationPoolUsageHigh
}
STATUS current
DESCRIPTION
"Notifications that MUST be supported by pooled and
carrier-grade NAT applications."
::= { natv2MIBGroups 3 }
natv2PooledInstanceLevelGroup OBJECT-GROUP natv2MIBConformance OBJECT IDENTIFIER ::= { natv2MIB 3 }
OBJECTS {
-- from natv2InstanceTable
natv2InstancePoolingBehavior,
-- from natv2PoolTable
natv2PoolRealm,
natv2PoolAddressType,
natv2PoolMinimumPort,
natv2PoolMaximumPort,
natv2PoolAddressMapEntries,
natv2PoolPortMapEntries,
natv2PoolAddressMapCreations,
natv2PoolPortMapCreations,
natv2PoolAddressMapFailureDrops,
natv2PoolPortMapFailureDrops,
natv2PoolDiscontinuityTime,
natv2PoolThresholdUsageLow,
natv2PoolThresholdUsageHigh,
natv2PoolNotifiedPortMapEntries,
natv2PoolNotifiedPortMapProtocol,
natv2PoolNotificationInterval,
-- from natv2PoolRangeTable
natv2PoolRangeBegin,
natv2PoolRangeEnd,
-- from natv2AddressMapTable
natv2AddressMapExternalPoolIndex,
-- from natv2PortMapTable
natv2PortMapExternalPoolIndex
}
STATUS current natv2MIBCompliances OBJECT IDENTIFIER ::= { natv2MIBConformance 1 }
DESCRIPTION natv2MIBGroups OBJECT IDENTIFIER ::= { natv2MIBConformance 2 }
"Per-instance objects that MUST be supported by
implementations of the pooled and carrier grade
NAT applications."
::= { natv2MIBGroups 4 }
natv2CGNNotificationGroup NOTIFICATION-GROUP natv2MIBBasicCompliance MODULE-COMPLIANCE
NOTIFICATIONS { STATUS current
natv2NotificationSubscriberPortMappingEntriesHigh DESCRIPTION
} "Describes the requirements for conformance to the basic NAT
STATUS current application of NATV2-MIB."
DESCRIPTION MODULE -- this module
"Notification that MUST be supported by implementations MANDATORY-GROUPS { natv2BasicNotificationGroup,
of the carrier grade NAT application." natv2BasicInstanceLevelGroup
::= { natv2MIBGroups 5 } }
::= { natv2MIBCompliances 1 }
natv2CGNDeviceLevelGroup OBJECT-GROUP natv2MIBPooledNATCompliance MODULE-COMPLIANCE
OBJECTS { STATUS current
-- from table natv2SubscriberTable DESCRIPTION
natv2SubscriberInternalRealm, "Describes the requirements for conformance to the pooled NAT
natv2SubscriberInternalPrefixType, application of NATV2-MIB."
natv2SubscriberInternalPrefix, MODULE -- this module
natv2SubscriberInternalPrefixLength, MANDATORY-GROUPS { natv2BasicNotificationGroup,
natv2SubscriberAddressMapEntries, natv2BasicInstanceLevelGroup,
natv2SubscriberPortMapEntries, natv2PooledNotificationGroup,
natv2SubscriberTranslations, natv2PooledInstanceLevelGroup
natv2SubscriberAddressMapCreations, }
natv2SubscriberPortMapCreations, ::= { natv2MIBCompliances 2 }
natv2SubscriberAddressMapFailureDrops,
natv2SubscriberPortMapFailureDrops,
natv2SubscriberDiscontinuityTime,
natv2SubscriberLimitPortMapEntries,
natv2SubscriberThresholdPortMapEntriesHigh,
natv2SubscriberNotificationInterval
}
STATUS current
DESCRIPTION
"Device-level objects that MUST be supported by the
carrier-grade NAT application."
::= { natv2MIBGroups 6 }
natv2CGNInstanceLevelGroup OBJECT-GROUP natv2MIBCGNCompliance MODULE-COMPLIANCE
OBJECTS { STATUS current
-- from natv2InstanceTable DESCRIPTION