Subject: [BEHAVE] REQ-5, RFC5508

From: WashamFan <[email-masked]>
Date: Fri, 05 Feb 2010 14:49:50 +0800

Hi,

THe text says

   REQ-5: If a NAT device receives an ICMP Error packet from the private
          realm, and the NAT does not have an active mapping for the
          embedded payload, the NAT SHOULD silently drop the ICMP Error
          packet.  If the NAT has active mapping for the embedded
          payload, then the NAT MUST do the following prior to
          forwarding the packet, unless explicitly overridden by local
          policy:

          a) Revert the IP and transport headers of the embedded IP
             packet to their original form, using the matching mapping;
             and

          b) Leave the ICMP Error type and code unchanged; and

          c) If the NAT enforces Basic NAT function ([NAT-TRAD]), and
             the NAT has active mapping for the IP address that sent the
             ICMP Error, translate the source IP address of the ICMP
             Error packet with the public IP address in the mapping.  In   | 
             all other cases, translate the source IP address of the         |
             ICMP Error packet with its own public IP address.                |

I have a comment on the last sentence. 

Please note that NAPT can have a address pool either. If the ICMP
Error message generated by an intermediate node in the interal realm,
and NAPT has no corresponding active mapping for this node. The
last sentence applies in this case, but which one should be picked up
for mapping if the NAPT has multiple external addresses.

Thanks,
washam

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Fri, 5 Feb 2010 05:10:38 -0800

The NAT box itself has a public IP address assigned to its outgoing
interface/port which can be used instead of allocating one from the
address pool but it is upto the implementation. 

Senthil

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of WashamFan
Sent: Friday, February 05, 2010 1:50 AM
To: [email-masked]
Subject: [BEHAVE] REQ-5, RFC5508

Hi,

THe text says

          c) If the NAT enforces Basic NAT function ([NAT-TRAD]), and
             the NAT has active mapping for the IP address that sent the
             ICMP Error, translate the source IP address of the ICMP
             Error packet with the public IP address in the mapping.  In
| 
             all other cases, translate the source IP address of the
|
             ICMP Error packet with its own public IP address.
|

Please note that NAPT can have a address pool either. If the ICMP Error
message generated by an intermediate node in the interal realm, and NAPT
has no corresponding active mapping for this node. The last sentence
applies in this case, but which one should be picked up for mapping if
the NAPT has multiple external addresses.

Thanks,
washam

_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave