Definitions of Managed Objects for Network Address Translators (NAT)
obsoleted by
- rfc-7658 — Deprecation of MIB Module NAT-MIB: Managed Objects for Network Address Translators (NATs)
Extracted elements (28)
Address map entries are applied in ascending order of natAddrMapIndex, giving operators deterministic control over translation rule precedence. This ordered lookup is fundamental to correct NAT behavior when multiple overlapping map entries exist on the same interface.
Symmetric NAT has no entries in natAddrBindTable or natAddrPortBindTable because it does not maintain a consistent port bind across multiple sessions sharing the same private endpoint; instead each new session receives a fresh public port. The natSessionPrivateSrcEPBindId is set to zero to signal this behavior.
The MIB explicitly does not address firewall functions and must not be used for configuring or monitoring them. This scoping decision keeps the NAT MIB focused on address and port translation and avoids overlap with firewall management MIBs.
The NatTranslationEntity BITS type combines session orientation (inbound/outbound) and endpoint role (source/destination) into a single object. This design choice captures the essential characteristic of an address map entry—determining which end-point of which direction of session is subject to translation—in a compact, composable bitmask that supports TwiceNAT (both source and destination translation) without separate objects.
Full Cone NAT may be identified when UDP NAT sessions have zero values for PrivateDstAddr, PrivateDstPort, PublicDstAddr, and PublicDstPort (wildcard match), or when the natSessionPrivateSrcEPBindId TranslationEntity is set bidirectionally. Port Restricted Cone NAT has all four address/port objects non-zero with no wildcard matches.
RFC 3489 defines four NAPT variations (Full Cone, Restricted Cone, Port Restricted Cone, Symmetric NAT) which the NAT MIB does not distinguish via a type field. Instead, implementations are differentiated by observing the pattern of zero vs. non-zero address/port fields in natSessionTable and the presence or absence of entries in the bind tables.
The NAT MIB depends on the IF-MIB (RFC 2863) for interface indexing via ifIndex; natInterfaceTable is indexed by ifIndex. Counter discontinuity detection reuses ifCounterDiscontinuityTime from the IF-MIB for all Counter64 objects in interface, address map, bind, and session tables.
A natInterfaceTable row cannot be made active until the corresponding natInterfaceServiceType instance has been set; until then the row status MUST remain 'notReady'. None of the objects in the row may be modified while the row status is active(1).
All address map entries sharing the same ifIndex MUST have the same natAddrMapName. This enforces a single logical map name per interface across all map entries.
An Address Bind or Address Port Bind entry MUST NOT exist without an associated entry in the Address Map table, since binds are derived from address maps.
For a Basic NAT address map entry, the port objects natAddrMapLocalPortFrom, natAddrMapLocalPortTo, natAddrMapGlobalPortFrom, and natAddrMapGlobalPortTo MUST all be zero. Non-zero port values are only valid for NAPT entries.
For a static NAT address map, the number of addresses in the local range (natAddrMapLocalAddrFrom to natAddrMapLocalAddrTo) MUST equal the number of addresses in the global range (natAddrMapGlobalAddrFrom to natAddrMapGlobalAddrTo).
If natNotifThrottlingInterval is non-zero, the agent MUST NOT generate more than one natPacketDiscard notification-event in the indicated period. If set to zero, no natPacketDiscard notifications are transmitted. The default value is 0 (disabled); the suggested default when enabled is 60 seconds.
If the agent is capable of storing non-volatile configuration, the values of timeout objects (natBindDefIdleTimeout, natUdpDefIdleTimeout, natIcmpDefIdleTimeout, natOtherDefIdleTimeout, natTcpDefIdleTimeout, natTcpDefNegTimeout, natNotifThrottlingInterval) MUST be restored after re-initialization of the management system.
Implementers of natAddrBindTable and natAddrPortBindTable must be careful not to create entries with index OIDs exceeding 128 subidentifiers, as such entries cannot be accessed using SNMPv1, SNMPv2c, or SNMPv3.
With the exception of Symmetric NAT, a NAT session entry MUST NOT exist in natSessionTable without a corresponding bind entry. Symmetric NAT derives translation parameters directly from an address map entry, bypassing the bind tables.
natAddrBindTable holds active address binds (Basic NAT), indexed by (ifIndex, LocalAddrType, LocalAddr). natAddrPortBindTable holds active NAPT binds, indexed by (ifIndex, LocalAddrType, LocalAddr, LocalPort, Protocol). Both are read-only, derived from the address map table, and lost upon agent restart.
natAddrMapTable is indexed by (ifIndex, natAddrMapIndex) and configures address maps for NAT translation. Each entry specifies local/global address ranges, port ranges, protocol bitmap, entry type (static/dynamic), and the NatTranslationEntity indicating session direction and endpoint subject to translation.
natInterfaceTable is indexed by ifIndex and configures per-interface NAT attributes including realm type (private or public), NAT service type (basicNat, napt, bidirectionalNat, twiceNat), and interface-level translation statistics (natInterfaceInTranslates, natInterfaceOutTranslates, natInterfaceDiscards as Counter64).
natPacketDiscard is a NOTIFICATION-TYPE that alerts managers when packets are discarded due to lack of address mappings. Its generation rate is governed by natNotifThrottlingInterval (range: 0 or 5..3600 seconds), defaulting to disabled (0).
natProtocolTable maintains per-protocol statistics indexed by NatProtocolType. natAddrBindNumberOfEntries (Gauge32) and natAddrPortBindNumberOfEntries (Gauge32) are scalar objects tracking the current count of Address Bind and Address Port Bind table entries respectively.
natSessionTable is indexed by (ifIndex, natSessionIndex) and holds active NAT sessions. Each entry links private-realm and public-realm session 5-tuples (address, port, protocol) via bind IDs (natSessionPrivateSrcEPBindId, natSessionPrivateDstEPBindId) and includes session direction, up time, and per-session translation counters.
The NAT-MIB module is registered under mib-2 123 (natMIB MODULE-IDENTITY). It defines managed objects for configuration and monitoring of NAT devices, including interface, address map, bind, session, and notification objects.
The NAT MIB contains read-write and read-create objects that allow configuration of NAT address mappings and interface settings. Unauthorized write access could redirect or intercept traffic by altering translation rules. Implementors are directed to the SNMPv3 security model (RFC 3410, RFC 3411) for authentication and privacy protections to prevent unauthorized access.
The natSessionTable and bind tables expose detailed information about active NAT sessions including private and public IP addresses and ports. Read access to these objects by unauthorized parties constitutes a privacy risk, revealing the internal network topology and active communication endpoints behind the NAT device.
NatBindIdOrZero is Unsigned32 (0..4294967295); a value of zero specifically indicates Symmetric NAT where no stable port bind exists. NatBindId is Unsigned32 (1..4294967295) and is unique across both natAddrBindTable and natAddrPortBindTable.
NatProtocolType is an INTEGER enumeration (none=1, other=2, icmp=3, udp=4, tcp=5) used in session and bind entries. NatProtocolMap is a parallel BITS representation (other=0, icmp=1, udp=2, tcp=3) used in address map entries to express a bitmap of applicable protocols.
NatTranslationEntity is a BITS textual convention with four flags: inboundSrcEndPoint(0), outboundDstEndPoint(1), inboundDstEndPoint(2), outboundSrcEndPoint(3). It encodes both session direction and which endpoint (source or destination) is subject to translation, and is used in address map, bind, and session objects.