Subject: [BEHAVE] Comments on the NAT MIB

From: Tom Taylor <[email-masked]>
Date: Thu, 12 Sep 2013 16:50:49 -0400

1. The descriptions for some of the notifications say that they are 
triggered when the value is <= or >= the threshold, where for others 
they only talk about when the threshold is exceeded. Should this be made 
consistent?

2. Should the descriptions for natResourceError, 
natProtocolResourceErrors and natSubscriberResourceErrors exclude quota 
drops as well as out-of-port errors?

3. There is a major discrepancy between the pool watermark notification 
descriptions (which talk about addresses) and the objects in 
natPoolEntry, which talk about ports. I imagine the latter descriptions 
need updating.

4. The contents of natMapIntAddrEntry include only one address type. 
What if the external address type is different from the internal one?

5. For logging purposes, it would be good to have a quota identifier. 
 From the MIB point of view, would it make sense to have a quota table 
presenting an SnmpAdminString identifier and a counter for the quota 
violations?

Tom Taylor

---

From: Dave Thaler <[email-masked]>
Date: Fri, 13 Sep 2013 00:55:36 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Tom Taylor
> Sent: Thursday, September 12, 2013 1:51 PM
> To: [email-masked]; Senthil Sivakumar; 'Simon Perreault'
> Subject: [BEHAVE] Comments on the NAT MIB
> 
> 1. The descriptions for some of the notifications say that they are triggered
> when the value is <= or >= the threshold, where for others they only talk
> about when the threshold is exceeded. Should this be made consistent?
> 
> 2. Should the descriptions for natResourceError, natProtocolResourceErrors
> and natSubscriberResourceErrors exclude quota drops as well as out-of-port
> errors?
> 
> descriptions (which talk about addresses) and the objects in natPoolEntry,
> which talk about ports. I imagine the latter descriptions need updating.
> 

As with the ipfix vs syslog discussion, if the MIB is going to include any
notifications at all (I'm not sure it's a requirement to have any), then it
either needs to be consistent with the ipfix and syslog docs, or get
WG consensus on any difference.

-Dave

---

From: Simon Perreault <[email-masked]>
Date: Fri, 13 Sep 2013 14:47:00 +0200

> WG consensus on any difference.

Unless anyone steps up with a need for SNMP notifications, they will be 
removed in the next revision.

Simon
-- 
DTN made easy, lean, and smart --> http://postellation.viagenie.ca
NAT64/DNS64 open-source        --> http://ecdysis.viagenie.ca
STUN/TURN server               --> http://numb.viagenie.ca

---

From: Tom Taylor <[email-masked]>
Date: Fri, 13 Sep 2013 09:27:45 -0400

> removed in the next revision.

I was going to pass this by OPSAWG to see if operators wanted a choice. 
Guess I'd better hurry up.

Tom Taylor

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Fri, 13 Sep 2013 13:45:28 +0000

I believe the notifications have value and use in real deployments. A lot
of times our customers ask for
Setting thresholds and getting notified when the threshold is hit. The
usual requests are:
- I want to know when would I need to add more addresses in the nat pool.
- I want to know when a single user uses excessive resources (excessive is
subject to change and configurable).
  Resources here can be addresses, ports, memory, bandwidth etc

I am fine if the answer is MIB is not the right place to add this, but
would like to understand what would be the right place to do this.
I assume to leave the notifications in if the logging drafts are in line
with the MIB?

Thanks
Senthil

---

From: Simon Perreault <[email-masked]>
Date: Fri, 27 Sep 2013 17:11:38 +0200

> they only talk about when the threshold is exceeded. Should this be made

I think we need to send a trap whenever the threshold is crossed, no 
matter what direction we're going.

> drops as well as out-of-port errors?

Yes!

> natPoolEntry, which talk about ports. I imagine the latter descriptions

I updated the former (the notification description) to read:

         "This notification is generated when the specified pool's
          usage percentage becomes lower than or equal to the
          specified threshold. The threshold is specified by the
          natPoolWatermarkLow object"

> What if the external address type is different from the internal one?

You're absolutely right. Fixed.

> presenting an SnmpAdminString identifier and a counter for the quota

Maybe. Can you describe a little bit what those "quota identifiers" are? 
Maybe give an example?

Thanks,
Simon

---

From: Tom Taylor <[email-masked]>
Date: Fri, 27 Sep 2013 12:00:27 -0400

> matter what direction we're going.

[PTT] Just to be clear: I take those "=" above to mean that a 
notification/log is generated when the high- or low- water-mark is EQUAL 
to the threshold. Is this the intent? "Exceed" is used exclusively for 
high-water-mark thresholds, and to me implies a strict greater-than 
relationship. That is, no notification/log is generated if the value is 
simply equal to the threshold. We need to be clear on the intent.

FYI I've spelled out >= or <= relationships for all the thresholds in 
the relevant event descriptions of syslog-03.
...
> Maybe. Can you describe a little bit what those "quota identifiers" are?

[PTT] Here's the text describing this in syslog-03, Section 3.13:

    Table [proposed] in the
    NAT MIB lists quota identifiers and corresponding total counts of
    packets dropped because of quota violations.  This table may be
    extended to provide information on the configuration of the
    particular quota, depending on the implementation.

Here's a sketch of the table as I envision it, based on cut-and-paste 
from the existing natPool table in the MIB. Maybe it would be useful to 
have an additional SnmpAdminString quota identifier for more 
human-friendly presentation. If we do have the drops counter, the global 
counter natQuotaDrops is redundant and should be dropped itself. Number 
of administrative denials is a new idea, providing a check on PCP 
requests, maybe.

BTW I note that natPoolIndex id read-only rather than not-accessible. Is 
this correct? I copied it for natQuotaIndex.

    -- textual conventions

    NatQuotaId ::= TEXTUAL-CONVENTION
        DISPLAY-HINT "d"
        STATUS current
        DESCRIPTION
            "A unique ID that is assigned to each quota."
        SYNTAX Unsigned32 (1..4294967295)

-- quotas

    natQuotaObjects OBJECT IDENTIFIER ::= { natMIBObjects xx }

    natQuotaTable OBJECT-TYPE
        SYNTAX SEQUENCE OF NatQuotaEntry
        MAX-ACCESS not-accessible
        STATUS current
        DESCRIPTION
            "Table of quotas. May be extended by the implementation
             to include objects related to configuration."
        ::= { natQuotaObjects 1 }

    natQuotaEntry OBJECT-TYPE
        SYNTAX NatQuotaEntry
        MAX-ACCESS not-accessible
        STATUS current
        DESCRIPTION
            "Entry in the table of quotas."
        INDEX { natQuotaIndex }
        ::= { natQuotaTable 1 }

    NatQuotaEntry ::=
        SEQUENCE {
            natQuotaIndex        NatQuotaId,
            natQuotaDrops        Integer32,
            natQuotaDenies       Integer32
        }

    natQuotaIndex OBJECT-TYPE
        SYNTAX NatQuotaId
        MAX-ACCESS read-only
        STATUS current
        DESCRIPTION
            "Index of a quota."
        ::= { natQuotaEntry 1 }

    natQuotaDrops OBJECT-TYPE
        SYNTAX Counter64
        MAX-ACCESS read-only
        STATUS current
        DESCRIPTION
            "Number of packets dropped due to application of this quota."
        ::= { natQuotalEntry 2 }

    natQuotaDenies OBJECT-TYPE
        SYNTAX Counter64
        MAX-ACCESS read-only
        STATUS current
        DESCRIPTION
            "Number of administrative requests denied due to
             application of this quota."
        ::= { natQuotaEntry 3 }

---

From: Tom Taylor <[email-masked]>
Date: Fri, 27 Sep 2013 12:19:54 -0400

>         ::= { natQuotaObjects 1 }

[PTT2] Thinking this through a bit further, I realize that the 
configuration table would be a separate table in which the index value 
would be created. This table just quotes the created value.