Subject: [Int-area] ISP CGN logging inc. Destination ??

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Thu, 3 May 2018 21:50:18 +0000

Is there an RFC (besides 6269) that encourages / discourages CGN logging of destination IP+Port if source IP+port is already logged?

RFC6269 does mention the below, as compared to the server side logging of source IP+port -

// logging the destination address on the NAT is inferior
   to logging the source port at the server.
https://tools.ietf.org/html/rfc6269
//

(BTW, having both source+destination in the NAT log implicitly means no bulk allocation of source ports possible)

Separately, this prohibits using stateless NAT based solutions such as MAP or using deterministic NAT, since there is no logging in such solutions. If such a guideline was also mandated for native IPv6, then it would pose an interesting deployment issue.

--
Cheers,
Rajiv Asati
Distinguished Engineer, Cisco

PS: Few may be aware of Govt. of India’s mandate* to log both source and destination IP+port pair.
Click on “Parameter to be stored in SYS Log of Network Address Translation (NAT) for Internet Access” on this page - https://www.corestack.io/blog/the-log-mandate-enabling-indian-isps-to-adhere-to-dot-compliance-rules/

PS:
https://tools.ietf.org/html/rfc6302
https://tools.ietf.org/html/rfc7422

Session and service continuity

---

From: Dave O'Reilly <[email-masked]>
Date: Fri, 4 May 2018 01:53:57 +0100

Hi Rajiv,

For what it’s worth, my Internet draft also discourages connection/destination logging - draft-daveor-cgn-logging-04 (see section 3). 

Re the Indian government mandated connection logging that you mentioned - I was not aware of this but it is a piece of strong supporting evidence for exactly the point I was making in an email earlier this week (https://www.ietf.org/mail-archive/web/int-area/current/msg06442.html) where I outlined the regulatory alternatives that are the only options left for dealing with CGN crime attribution (if source port logging at internet facing servers does not become routine) - one of which was this form of connection logging. 

As I said at the time, the crime attribution information gap introduced by CGN is a problem right now, and something is going to have be done about it, either by the “internet” (as I’m trying to advocate for), or if not, then by regulatory action that will be introduced in individual jurisdictions in due course. I reiterate the point I made at the time: when ISP regulators get their hands on a problem, they come up with ISP-centric solutions, all of which are far worse from a privacy point of view than source port logging.

I predict that many other national ISP regulators will be forced to act on this problem in the coming years, and in the absence of meaningful alternatives will mandate similar logging.

daveor

> On 3 May 2018, at 22:50, Rajiv Asati (rajiva) <[email-masked]> wrote:
> 
> _______________________________________________
> Int-area mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/int-area

---

From: [email-masked]
Date: Fri, 4 May 2018 10:16:37 +0200

Hi,

As another data point on this topic, the storing of A+P data is also mandated in Hungary. From the Hungary paragraph of the 2016 EU report into implementation of the Data Retention Directive (http://fra.europa.eu/en/theme/information-society-privacy-and-data-protection/data-retention):

"The new law obliges electronic and IT service providers that allow encrypted communication through their services to store all metadata related to such communications for one year. It thus widens the scope of data retention."

Translated: A+P retention.

Cheers,
Ian

> Click on “Parameter to be stored in SYS Log of Network Address Translation (NAT) for Internet Access” on this page - https://www.corestack.io/blog/the-log-mandate-enabling-indian-isps-to-adhere-to-dot-compliance-rules/ <https://www.corestack.io/blog/the-log-mandate-enabling-indian-isps-to-adhere-to-dot-compliance-rules/>
>  
> PS: 
> https://tools.ietf.org/html/rfc6302 <https://tools.ietf.org/html/rfc6302>
> https://tools.ietf.org/html/rfc7422 <https://tools.ietf.org/html/rfc7422>
>  
>  
> Softwires mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/softwires <https://www.ietf.org/mailman/listinfo/softwires>

---

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Fri, 4 May 2018 10:01:49 +0000

Ian,

Thanks for sharing the URL. While not explicit, “all metadata” would include both source and destination A+P. Is that the right interpretation?

If an ISP were to use “binding” mode on the BR, then without using net flow/IPFIX, How could the compliance be achieved ?

Cheers,
Rajiv Asati
Distinguished Engineer, Cisco Services

On May 4, 2018, at 4:16 AM, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>> wrote:

Hi,

Cheers,
Ian

PS:

Session and service continuity
_______________________________________________
Softwires mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/softwires

---

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Fri, 4 May 2018 10:36:00 +0000

Dave,

Thanks. Pls see inline,

Besides the size of the log data, the CGN implementations may take a performance hit if destination A+P also needs to be logged (e.g. connection log), resulting in increased CGN investment.

outlined the regulatory alternatives that are the only options left for dealing with CGN crime attribution (if source port logging at internet facing servers does not become routine) - one of which was this form of connection logging.

The need for connection logging may go beyond the concern of size of logging data - user privacy.  And this carries over to not only A+P techniques, but also IPv6. IOW, this concern may not be limited to address sharing techniques.

Cheers,
Rajiv Asati

On May 3, 2018, at 8:58 PM, Dave O'Reilly <[email-masked]<mailto:[email-masked]>> wrote:

Hi Rajiv,

daveor

On 3 May 2018, at 22:50, Rajiv Asati (rajiva) <[email-masked]<mailto:[email-masked]>> wrote:

PS:

Session and service continuity
_______________________________________________
Int-area mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/int-area

---

From: Dave O'Reilly <[email-masked]>
Date: Fri, 4 May 2018 12:25:03 +0100

Hi Rajiv,

> On 4 May 2018, at 11:36, Rajiv Asati (rajiva) <[email-masked]> wrote:
> 

Good point. Will incorporate in next draft.
> The need for connection logging may go beyond the concern of size of logging data - user privacy.  And this carries over to not only A+P techniques, but also IPv6. IOW, this concern may not be limi…

I completely agree with you. In fact, I have already started to investigate the IPv6 attribution issues. See https://datatracker.ietf.org/doc/draft-daveor-ipv6-crime-attribution/. This document is still preliminary so I would be very interested in any feedback you might have.

Best,
daveor

---

From: [email-masked]
Date: Fri, 4 May 2018 13:58:24 +0200

Hi Rajiv,

Please see inline.

Cheers,
Ian

> On 4. May 2018, at 12:01, Rajiv Asati (rajiva) <[email-masked]> wrote:
> 
> Ian,
> 

[if - My understanding is that per-flow logging is necessary to meet the requirement, but I’m not familiar enough with the legislation to know what exactly needs to be stored.]

> If an ISP were to use “binding” mode on the BR, then without using net flow/IPFIX, How could the compliance be achieved ?

[if - If there’s address sharing and the requirement is to provide an exact match to a data retention request (in some countries, a list of e.g. 16 users is OK), then AFAICS, you have to use IPFIX.

The implementation problem for this is compounded by the lack of state table on most BR implementations (e.g. how do you know when a UDP session has completed without state for that flow?)]

---

From: <[email-masked]>
Date: Mon, 7 May 2018 05:30:05 +0000

Hi Rajiv,

Please check RFC6888 which says the following:

   REQ-12: A CGN SHOULD NOT log destination addresses or ports unless
      required to do so for administrative reasons.

Cheers,
Med

De : Softwires [mailto:[email-masked]] De la part de Rajiv Asati (rajiva)
Envoyé : jeudi 3 mai 2018 23:50
À : Softwires-wg list; [email-masked]
Cc : [email-masked]
Objet : [Softwires] ISP CGN logging inc. Destination ??

PS:

---

From: "Lee, Yiu" <[email-masked]>
Date: Mon, 7 May 2018 11:15:57 +0000

Just a quick thought. Will the dhcpv6 logs help?

Sent from mobile device, pardon possible typo.

> On May 7, 2018, at 7:06 AM, "[email-masked]" <[email-masked]> wrote:
> 
> Dear Ian,  thanks for clarifications.
> 
> Regulator in India mandated to preserve the following details for each flow.
> 1.    Source IP + Port (private for end subscriber device)
> 2.    Destination IP + Port (public)
> 3.    Translated IP + port (public)
> 4.    Date and time
> 
> There is no brainer and all this is available in NAT44. MAP being stateless, no such data available from MAP-BR. We are exploring alternate option on BR to create this data in MAP.
> 
> Pls advise.
> 
> Regds
> ramesh 
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> Sent: 04 May 2018 17:28
> To: Rajiv Asati (rajiva)
> Cc: Softwires-wg list; [email-masked]; Ramesh R Chandra
> Subject: Re: [Softwires] ISP CGN logging inc. Destination ??
> 
> Hi Rajiv,
> 
> Please see inline.
> 
> Cheers,
> Ian
> 
> "Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s). 
> are confidential and may be privileged. If you are not the intended recipient. you are hereby notified that any 
> review. re-transmission. conversion to hard copy. copying. circulation or other use of this message and any attachments is 
> strictly prohibited. If you are not the intended recipient. please notify the sender immediately by return email. 
> and delete this message and any attachments from your system.
> 
> Virus Warning: Although the company has taken reasonable precautions to ensure no viruses are present in this email. 
> The company cannot accept responsibility for any loss or damage arising from the use of this email or attachment."
> [email-masked]

---

From: <[email-masked]>
Date: Mon, 7 May 2018 11:19:12 +0000

Dear Ramesh,

Please see inline. 

Cheers,
Med

> -----Message d'origine-----
> De : Softwires [mailto:[email-masked]] De la part de
> [email-masked]
> Envoyé : vendredi 4 mai 2018 17:26
> À : [email-masked]; [email-masked]
> Cc : [email-masked]; [email-masked]
> Objet : Re: [Softwires] ISP CGN logging inc. Destination ??
> 

[Med] Please note that this one may be overlapping among multiple subscribers if DS-Lite is used. 

> 2.	Destination IP + Port (public)

[Med] Does the regulator require to preserve "Destination IP + Port" even if a public IP address is assigned to a subscriber?

> There is no brainer and all this is available in NAT44. MAP being stateless,
> no such data available from MAP-BR. We are exploring alternate option on BR
> to create this data in MAP.
> 
> Pls advise.
> 
> Regds
> ramesh
> > Thanks for sharing the URL. While not explicit, “all metadata” would
> include both source and destination A+P. Is that the right interpretation?
> 
> [if - My understanding is that per-flow logging is necessary to meet the
> requirement, but I’m not familiar enough with the legislation to know what
> exactly needs to be stored.]
> 
> >
> > If an ISP were to use “binding” mode on the BR, then without using net
> flow/IPFIX, How could the compliance be achieved ?
> 
> [if - If there’s address sharing and the requirement is to provide an exact
> match to a data retention request (in some countries, a list of e.g. 16 users
> is OK), then AFAICS, you have to use IPFIX.
> 
> The implementation problem for this is compounded by the lack of state table
> on most BR implementations (e.g. how do you know when a UDP session has
> completed without state for that flow?)]
> 
> 
> "Confidentiality Warning: This message and any attachments are intended only
> for the use of the intended recipient(s).
> are confidential and may be privileged. If you are not the intended
> recipient. you are hereby notified that any
> review. re-transmission. conversion to hard copy. copying. circulation or
> other use of this message and any attachments is
> Virus Warning: Although the company has taken reasonable precautions to
> ensure no viruses are present in this email.

---

From: <[email-masked]>
Date: Mon, 7 May 2018 11:27:53 +0000

Hi Yiu, 

This may help but this is not sufficient if supplying "Destination IP + Port (public)" is required. 

Technically the BR may extract and record the destination IPv4 address/port and source IPv6 prefix when doing its stateless decapsulation/translation, but this is not a "native" feature of a BR/lwAFTR. 

Cheers,
Med

> De : Int-area [mailto:[email-masked]] De la part de Lee, Yiu
> Envoyé : lundi 7 mai 2018 13:16
> À : [email-masked]
> Cc : [email-masked]; [email-masked]; [email-masked]
> Objet : Re: [Int-area] [EXTERNAL] Re: [Softwires] ISP CGN logging inc.
> Destination ??
> 
> > There is no brainer and all this is available in NAT44. MAP being
> stateless, no such data available from MAP-BR. We are exploring alternate
> option on BR to create this data in MAP.
> >
> > Pls advise.
> >
> > Regds
> > ramesh
> > The implementation problem for this is compounded by the lack of state
> table on most BR implementations (e.g. how do you know when a UDP session has
> > "Confidentiality Warning: This message and any attachments are intended
> only for the use of the intended recipient(s).
> > The company cannot accept responsibility for any loss or damage arising
> from the use of this email or attachment."

---

From: "Lee, Yiu" <[email-masked]>
Date: Mon, 7 May 2018 11:45:48 +0000

I expect Ramesh has already had a way to log dst IP and port if this is required by regulators.

> On May 7, 2018, at 7:28 AM, "[email-masked]" <[email-masked]> wrote:
> 
> Hi Yiu, 
>

---

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Tue, 8 May 2018 21:42:36 +0000

Thanks, Med. This makes it very explicit.

--
Cheers,
Rajiv

From: "[email-masked]" <[email-masked]>
Date: Monday, May 7, 2018 at 1:30 AM
To: Rajiv Asati <[email-masked]>, Softwires-wg list <[email-masked]>, "[email-masked]" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: RE: ISP CGN logging inc. Destination ??

Hi Rajiv,

Cheers,
Med

PS:

---

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Tue, 8 May 2018 21:42:58 +0000

Agree with Ramesh. DHCP(v6) helps with logging source IP assignment, but that’s it.

The requirement here is about keeping track of not only source IP+port, but also destination IP+port per connection. DHCP(v6) doesn’t apply here.

--
Cheers,
Rajiv

From: "[email-masked]" <[email-masked]>
Date: Tuesday, May 8, 2018 at 1:15 AM
To: "[email-masked]" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, Rajiv Asati <[email-masked]>, Softwires-wg list <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: RE: [EXTERNAL] Re: [Softwires] ISP CGN logging inc. Destination ??

Not really. Need IPv4 because desitination IP is on IPv4.

Regds
ramesh chandra
M#: +91 90829 61303
O#: +91 22 7965 9762

-----Original Message-----
From: Lee, Yiu [mailto:[email-masked]]
Sent: 07 May 2018 16:46
To: Ramesh R Chandra
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [EXTERNAL] Re: [Softwires] ISP CGN logging inc. Destination ??

On May 7, 2018, at 7:06 AM, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>> wrote:
-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]
Sent: 04 May 2018 17:28
To: Rajiv Asati (rajiva)
Cc: Softwires-wg list; [email-masked]<mailto:[email-masked]>; Ramesh R Chandra
Subject: Re: [Softwires] ISP CGN logging inc. Destination ??
Hi Rajiv,
Please see inline.
Cheers,
Ian
On 4. May 2018, at 12:01, Rajiv Asati (rajiva) <[email-masked]<mailto:[email-masked]>> wrote:
Ian,
Thanks for sharing the URL. While not explicit, “all metadata” would include both source and destination A+P. Is that the right interpretation?
[if - My understanding is that per-flow logging is necessary to meet
the requirement, but I’m not familiar enough with the legislation to
know what exactly needs to be stored.]
If an ISP were to use “binding” mode on the BR, then without using net flow/IPFIX, How could the compliance be achieved ?
[if - If there’s address sharing and the requirement is to provide an exact match to a data retention request (in some countries, a list of e.g. 16 users is OK), then AFAICS, you have to use IPFIX.
The implementation problem for this is compounded by the lack of state
table on most BR implementations (e.g. how do you know when a UDP
session has completed without state for that flow?)]
"Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s).
are confidential and may be privileged. If you are not the intended
recipient. you are hereby notified that any review. re-transmission.
conversion to hard copy. copying. circulation or other use of this message and any attachments is strictly prohibited. If you are not the intended recipient. please notify the sender immediately by return email.
and delete this message and any attachments from your system.
Virus Warning: Although the company has taken reasonable precautions to ensure no viruses are present in this email.
The company cannot accept responsibility for any loss or damage arising from the use of this email or attachment."
_______________________________________________
Softwires mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/softwires
"Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s).
are confidential and may be privileged. If you are not the intended recipient. you are hereby notified that any
review. re-transmission. conversion to hard copy. copying. circulation or other use of this message and any attachments is
strictly prohibited. If you are not the intended recipient. please notify the sender immediately by return email.
and delete this message and any attachments from your system.

---

From: "Lee, Yiu" <[email-masked]>
Date: Wed, 9 May 2018 03:05:06 +0000

Let’s me be precise. This regulation must exist today. So there must exist a way to log the five-IPv4-tuple. If Ramesh combines the dhcpv6 logs with the current five-IPv4-tuple logs, will this be enough? 

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Tuesday, May 8, 2018 at 5:42 PM
To: "[email-masked]" <[email-masked]>, "Lee, Yiu" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [EXTERNAL] Re: [Softwires] ISP CGN logging inc. Destination ??

-- 

Cheers,

Rajiv  

Regds

ramesh chandra

M#: +91 90829 61303

O#: +91 22 7965 9762

-----Original Message-----

Sent: 07 May 2018 16:46

To: Ramesh R Chandra

Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]

4.    Date and time

Pls advise.

Regds

ramesh

-----Original Message-----

Sent: 04 May 2018 17:28

To: Rajiv Asati (rajiva)

Hi Rajiv,

Please see inline.

Cheers,

Ian

Ian,

Softwires mailing list

[email-masked]

---

From: <[email-masked]>
Date: Wed, 9 May 2018 07:30:39 +0000

Hi Rajiv,

What concerns me with this requirement is that it nullifies one of the motivations for stateless address sharing:
https://tools.ietf.org/html/draft-ietf-softwire-stateless-4v6-motivation-05#section-3.1.3 (Logging - No Need for Dynamic Binding Notifications)

especially, this part:

   Some Service Providers have a requirement to use only existing
   logging systems and to avoid introducing new ones (mainly because of
   Capital Expenditure (CAPEX) considerations).  This requirement is
   easily met with stateless solutions.

Cheers,
Med

De : Softwires [mailto:[email-masked]] De la part de Rajiv Asati (rajiva)
Envoyé : mardi 8 mai 2018 23:43
À : [email-masked]; [email-masked]
Cc : [email-masked]; [email-masked]
Objet : Re: [Softwires] [EXTERNAL] Re: ISP CGN logging inc. Destination ??

--
Cheers,
Rajiv

From: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, May 8, 2018 at 1:15 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Rajiv Asati <[email-masked]<mailto:[email-masked]>>, Softwires-wg list <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: RE: [EXTERNAL] Re: [Softwires] ISP CGN logging inc. Destination ??

Regds
ramesh chandra
M#: +91 90829 61303
O#: +91 22 7965 9762

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]
Sent: 04 May 2018 17:28
To: Rajiv Asati (rajiva)
Cc: Softwires-wg list; [email-masked]<mailto:[email-masked]>; Ramesh R Chandra
Subject: Re: [Softwires] ISP CGN logging inc. Destination ??
Hi Rajiv,
Please see inline.
Cheers,
Ian

---

From: <[email-masked]>
Date: Wed, 9 May 2018 07:25:50 +0000

Hi Lee,  good thought. If we enable 5 tuple on BR for IPv4, required DA+P shall meet DA+P requirement. Using SA+P from 5-tuple should help to correlate with user IP based on DHCP assignment.

Key here is on BR to do 5-tuple after de-encapsulation of IPv6. Rajiv, pls check if we can do this on ASR9k as BNG.

Regds
Ramesh

From: Lee, Yiu [mailto:[email-masked]]
Sent: 09 May 2018 08:35
To: Rajiv Asati (rajiva); Ramesh R Chandra
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [EXTERNAL] Re: [Softwires] ISP CGN logging inc. Destination ??

From: "Rajiv Asati (rajiva)" <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, May 8, 2018 at 5:42 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "Lee, Yiu" <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [EXTERNAL] Re: [Softwires] ISP CGN logging inc. Destination ??

--
Cheers,
Rajiv

Regds
ramesh chandra
M#: +91 90829 61303
O#: +91 22 7965 9762

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]
Sent: 04 May 2018 17:28
To: Rajiv Asati (rajiva)
Cc: Softwires-wg list; [email-masked]<mailto:[email-masked]>; Ramesh R Chandra
Subject: Re: [Softwires] ISP CGN logging inc. Destination ??
Hi Rajiv,
Please see inline.
Cheers,
Ian

---

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Wed, 9 May 2018 11:22:30 +0000

Hi Med,

I share the same concern. While such a requirement may be deemed reasonable, it does not warrant nullifying the very advantage stateless 4o6 techniques such as MAP bring to bear.

If such a requirement carries over to native IPv6 communication (involving no address translation), then it would warrant a solution such as IPFIX anyway, in which case, it would also implicitly solve for the stateless 4o6 techniques.

--
Cheers,
Rajiv

From: "[email-masked]" <[email-masked]>
Date: Wednesday, May 9, 2018 at 3:30 AM
To: Rajiv Asati <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Cc: Softwires-wg list <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: RE: [Softwires] Re: ISP CGN logging inc. Destination ??

Hi Rajiv,

especially, this part:

Cheers,
Med

--
Cheers,
Rajiv

Regds
ramesh chandra
M#: +91 90829 61303
O#: +91 22 7965 9762

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]
Sent: 04 May 2018 17:28
To: Rajiv Asati (rajiva)
Cc: Softwires-wg list; [email-masked]<mailto:[email-masked]>; Ramesh R Chandra
Subject: Re: [Softwires] ISP CGN logging inc. Destination ??
Hi Rajiv,
Please see inline.
Cheers,
Ian

---

From: "Gottlieb, Jordan J" <[email-masked]>
Date: Wed, 9 May 2018 19:38:06 +0000

If I understand this correctly it appears that requirement #1 would dictate the capability must be deployed on the CE.  The way I read it you are attempting to retain the pre-NAPT client address and port.  For the particular use case, is the CPE managed by the service provider?  If so, why not originate the logging from the CPE as it has the necessary visibility and state maintenance to meet all the requirements?

There was also a comment in this thread regarding UDP and session completion.  I don’t think this is practical on the BR as support for asymmetrical routing could result in incomplete session information on a particular BR (you would have to piece it together) as exit transit BR could be different from the return transit BR.  The only device with a complete view of the flow is the CE in this case as well.

Assuming CPE is not an option, MAP-T , and that requirement #1 is not the privately addressed customer endpoint (laptop, tablet, smartphone, etc..) one could use netflow pre-BR (IPv6) and some simple program to convert to the required metadata.  Destination address is trivial as it is a fixed set of bits within the DMR(s).  Source address is not hard as long as the conversion program has an accurate list of active mapping rules.  Obviously sampling rate comes into play but I believe we have the same issue with IPFIX.

Cheers,

Jordan

From: Softwires [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, May 09, 2018 1:31 AM
To: Rajiv Asati (rajiva); [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: [Softwires] ISP CGN logging inc. Destination ??

Hi Rajiv,

especially, this part:

Cheers,
Med

--
Cheers,
Rajiv

Regds
ramesh chandra
M#: +91 90829 61303
O#: +91 22 7965 9762

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]
Sent: 04 May 2018 17:28
To: Rajiv Asati (rajiva)
Cc: Softwires-wg list; [email-masked]<mailto:[email-masked]>; Ramesh R Chandra
Subject: Re: [Softwires] ISP CGN logging inc. Destination ??
Hi Rajiv,
Please see inline.
Cheers,
Ian

E-MAIL CONFIDENTIALITY NOTICE: 
The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

---

From: [email-masked]
Date: Fri, 11 May 2018 10:28:19 +0200

Hi Jordan,

Please see inline below.

Thanks,
Ian

> On 9. May 2018, at 21:38, Gottlieb, Jordan J <[email-masked]> wrote:
> 

[if – This is a possibility in some networks, but in many countries (most of Europe AFIAK], SP’s must allow customers to attach their own equipment so this can’t be considered a secure device for meeting data retention regulations.]

> There was also a comment in this thread regarding UDP and session completion.  I don’t think this is practical on the BR as support for asymmetrical routing could result in incomplete session infor…

[if – I agree that the collection is complicated if you have multiple BRs, but as stated above, I don’t see the CE being a viable solution for many deployments.]

> Assuming CPE is not an option, MAP-T , and that requirement #1 is not the privately addressed customer endpoint (laptop, tablet, smartphone, etc..) one could use netflow pre-BR (IPv6) and some simp…

[if - I’m not sure I follow this proposal. Would the pre-BR device still identify flows, just at a different offset within the header? Would the metadata conversion take place on the same device?]

>  
> Cheers,
>  
> Jordan
>  
> From: Softwires [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of [email-masked] <mailto:[email-masked]>
> To: Rajiv Asati (rajiva); [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
> Cc: [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
> https://tools.ietf.org/html/draft-ietf-softwire-stateless-4v6-motivation-05#section-3.1.3 <https://tools.ietf.org/html/draft-ietf-softwire-stateless-4v6-motivation-05#section-3.1.3>(Logging - No Need for Dynamic Binding Notifications)
>  
> especially, this part:
>  
> De : Softwires [mailto:[email-masked] <mailto:[email-masked]>] De la part de Rajiv Asati (rajiva)
> À : [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
> Cc : [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
> From: "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>
> To: "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>
> Cc: "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>, Rajiv Asati <[email-masked] <mailto:[email-masked]>>, Softwires-wg list <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>
> Not really. Need IPv4 because desitination IP is on IPv4. <>
>  
> Regds
> ramesh chandra
> M#: +91 90829 61303
> O#: +91 22 7965 9762
>  
> From: Lee, Yiu [mailto:[email-masked] <mailto:[email-masked]>]
> Sent: 07 May 2018 16:46
> To: Ramesh R Chandra
> Cc: [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
> On May 7, 2018, at 7:06 AM, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>> wrote:
> From: [email-masked] <mailto:[email-masked]> [mailto:[email-masked] <mailto:[email-masked]>]
> Sent: 04 May 2018 17:28
> To: Rajiv Asati (rajiva)
> Cc: Softwires-wg list; [email-masked] <mailto:[email-masked]>; Ramesh R Chandra
> On 4. May 2018, at 12:01, Rajiv Asati (rajiva) <[email-masked] <mailto:[email-masked]>> wrote:
> Ian,
> The contents of this e-mail message and 
> any attachments are intended solely for the 
> addressee(s) and may contain confidential 
> and/or legally privileged information. If you
> are not the intended recipient of this message
> or if this message has been addressed to you 
> in error, please immediately alert the sender
> by reply e-mail and then delete this message 
> and any attachments. If you are not the 
> intended recipient, you are notified that 
> any use, dissemination, distribution, copying,
> or storage of this message or any attachment 
> is strictly prohibited. _______________________________________________
> Softwires mailing list

---

From: "Gottlieb, Jordan J" <[email-masked]>
Date: Fri, 11 May 2018 17:37:27 +0000

Hi Ian,

Agree and understand why CE is not always managed by the provider.  I suggested this as I have heard that there is a provider out there that was using MAP-T for public WiFi and who had full management access to the CE.  Without managing the CE there is no differentiate device (other than attempting to fingerprint which is not likely to result with the desired source IP/port)  behind a NAPT device without some additional layer on a per-client-device basis.

Quick answers to your questions:
Would the pre-BR device still identify flows, just at a different offset within the header?
Yes pre-BR device(s) Netflow data will have applicable src/dst port information and src/dst IPv4 information embedded within the IPv6 addresses.  You are just using plain old IPv6 Netflow data and extracting the IPv4 addresses that MAP-T bit-offsets within the IPv6 address.

Would the metadata conversion take place on the same device?
This should occur as augment to the SPs existing Netflow collection infrastructure.  I see no reason to add these use cases to generic SP routing infrastructure.

I would like to clarify a couple of items regarding my Netflow suggestion.  First, I am suggesting Netflow as it is typically already in use in most service provider networks and could be leveraged without significant investment.  Netflow records are processed off the device as the provider is probably already doing this with their existing Netflow collector.

Another approach would be to take the Netflow records north of the BR in pure IPv4 form.  There is no conversion required here to obtain the source IPv4/port and destination IPv4/port.  Tying it to the subscriber requires is a little more work using the mapping rules to derive the originating subscriber by their IPv6 prefix allocations.  The drawback to this approach is that you could possibly miss some peer-to-peer traffic in the case where the BR is hairpinning all traffic (no FMRs).  Benefit to this approach is that it supports a MAP-E implementation where the pre-BR does not.

Both approaches will get you all the source/destination address and port metadata as well as the IPv6 unique identifier for the subscriber.  What you don’t get is any visibility to the addressing/port utilization for each subscriber device residing behind their gateway.

A while back I hacked (not the prettiest Python) together some tools that I built in Python3 that can do all the described bit manipulations (https://github.com/ejordangottlieb/pyswmap).  I have examples that demonstrate some of what I have described for extracting and doing some of the MAP calculations.

Thanks,

Jordan

From: [email-masked] [mailto:[email-masked]]
Sent: Friday, May 11, 2018 2:28 AM
To: Gottlieb, Jordan J
Cc: [email-masked]; Rajiv Asati (rajiva); [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Softwires] ISP CGN logging inc. Destination ??

Hi Jordan,

Please see inline below.

Thanks,
Ian

On 9. May 2018, at 21:38, Gottlieb, Jordan J <[email-masked]<mailto:[email-masked]>> wrote:

Cheers,

Jordan

From: Softwires [mailto:[email-masked]] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Wednesday, May 09, 2018 1:31 AM
To: Rajiv Asati (rajiva); [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Softwires] ISP CGN logging inc. Destination ??

Hi Rajiv,

What concerns me with this requirement is that it nullifies one of the motivations for stateless address sharing:
https://tools.ietf.org/html/draft-ietf-softwire-stateless-4v6-motivation-05#section-3.1.3(Logging - No Need for Dynamic Binding Notifications)

especially, this part:

Cheers,
Med

De : Softwires [mailto:[email-masked]] De la part de Rajiv Asati (rajiva)
Envoyé : mardi 8 mai 2018 23:43
À : [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Cc : [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Objet : Re: [Softwires] [EXTERNAL] Re: ISP CGN logging inc. Destination ??

--
Cheers,
Rajiv

Regds
ramesh chandra
M#: +91 90829 61303
O#: +91 22 7965 9762

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]
Sent: 04 May 2018 17:28
To: Rajiv Asati (rajiva)
Cc: Softwires-wg list; [email-masked]<mailto:[email-masked]>; Ramesh R Chandra
Subject: Re: [Softwires] ISP CGN logging inc. Destination ??
Hi Rajiv,
Please see inline.
Cheers,
Ian