Subject: [BEHAVE] Action items: draft-..-syslog-nat-logging

From: Tom Taylor <[email-masked]>
Date: Sun, 08 Sep 2013 15:28:24 -0400

Sorry to be slow on this: I've spent a lot of time sleeping since the 
meeting, while my new immune system takes hold.

Comments welcome on the proposed actions and especially on the issues.

Tom Taylor

Prior to the meeting we had Dave Thaler's comments:
http://www.ietf.org/mail-archive/web/behave/current/msg11043.html

He raised the following points:

1. Logging/MIB reconciliation regarding quotas vs. high-water-marks. 
Discussed further in the meeting (Issue 4). See below.

2. Use of UTF-8 strings for identifiers.

Action: Should probably revert to ASCII -- will check with operators.

3. Use of single "internal" and "external" realm. Outcome covered by 
meeting discussion (Issue 2). See below.

4. Device type registry. Outcome covered by meeting discussion (Issue 
3). See below.

5. Mechanism should not be limited to cases where external address is IPv4.

Action: make consistent with capabilities of PCP (as most general known 
case).

The following actions and issues arise out of the meeting. These are 
organized by issue number in the presentation charts, which are at
http://www.ietf.org/proceedings/87/slides/slides-87-behave-0.pdf.

Issue 1: Destination logging
----------------------------

Agreed on list that destination logging would be restored as an optional 
capability.

Action: update the session create/delete event. Update the earlier text 
in Section 3.1.1 discussing the issue.

Issue: does this mean the BIB entry create/delete event needs to be 
restored? Note that when destination logging is not enabled there is 
still no difference between BIB entry creation and session creation.

Issue: definition of configuration needed to enable/disable destination 
logging. Propose to add a Management Considerations section that 
discusses configuration for this and other aspects of logging.

Issue 2: Subscriber site identifier
-----------------------------------

Simon Perrault pointed out that the MIB uses the realm as an identifier. 
Further, both the internal and external realms should be logged. This 
ties in with Dave Thaler's point 3 above. Dave pointed out that realm 
and address are separate pieces of information, both of which are 
needed. (But things get a little confused at the subscriber site as 
opposed to an external address.) Agreed that there should be a mapping 
table between internal realm ID (which can be per subscriber site), and 
details such as VLAN ID. Above all, Dave seeks consistency between the 
SYSLOG, IPFIX, and MIB drafts.

Action: update the SYSLOG and IPFIX drafts to include internal and 
external realm identifiers. In the SYSLOG draft (and perhaps in IPFIX), 
the internal realm identifier takes the place of the subscriber site ID. 
Add cross-reference to mapping table in the MIB document.

Action: add mapping table to the MIB document, providing per-subscriber 
mapping of realm ID to provisioned IPv4 address, IPv6 prefix, 
Gateway-initiated DS-Lite CID/SWID combination.

Issue: Where do VLANId/VRFId fit in? Additional item(s) in the mapping 
table?

Issue 3: Device Type
--------------------

Agreed this should be a non-registered free-form field for optional 
operator use. Corresponds to Dave Thaler's point 4 above.

Action: delete proposed registry and proposed values. Update definition. 
Rename the field. Proposal: NAT Type? Provide for enabling/disabling of 
field in Management Considerations section.

Issue: the same device may provide multiple types of NAT. Perhaps the 
value of the string will be implementation-dependent, determined by the 
processing logic for the triggering packet. Comments?

Issue 4: Warning levels
-----------------------

Agreed that high/low-water-mark threshold crossings as defined by the 
MIB should be logged. Related to Dave Thaler's point 1 above.

Action: add high/low-water mark threshold crossing event. 
Cross-reference to MIB entry. In MIB, add cross-reference to logging 
document(s).

Issue: Dave Thaler prefers not to have both MIB notifications and 
logging. Need to consult operators.

Issue 5: Complexity of quota violation event
--------------------------------------------

Simon Perrault made the point that quotas are very 
implementation-dependent. Agreed that log should only identify the quota 
and details of the triggering packet. Interpretation depends on the 
implementation.

Action: update the quota violation event per agreement. Identify the 
quota by its entry in the MIB?

Issue 6: Reporting port allocation/deallocation
-----------------------------------------------

Preference for single encoding. IPFIX approach much more compact for 
large ranges, should use it.

Action: revise SYSLOG to use IPFIX encoding. Provide clear explanation 
of the encoding for the two cases: single contiguous range, sequence of 
equally-spaced equal-length contiguous ranges.

Issue: should port allocation events report cumulative allocations (as 
in syslog-nat-logging-02) or incremental allocations (as in IPFIX)? If 
cumulative, should probably allow for reporting of multiple allocated 
port sets.

Issue 7: Invalid port event
---------------------------

Replace with per-subscriber counters in the MIB.

Action: delete event from SYSLOG. Add to MIB.

---

From: Tina TSOU <[email-masked]>
Date: Sun, 8 Sep 2013 20:12:29 +0000

Dear Tom,
Thank you for putting these together.
The actions look good to me.

Thank you,
Tina

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Tom Taylor
> Sent: 2013年9月8日 12:28
> To: [email-masked]
> Cc: Co-authors
> Subject: [BEHAVE] Action items: draft-..-syslog-nat-logging
> 
> 4. Device type registry. Outcome covered by meeting discussion (Issue 3).
> See below.
> 
> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/behave