Deprecation of MIB Module NAT-MIB: Managed Objects for Network Address Translators (NATs)
obsoletes
- rfc-4008 — Definitions of Managed Objects for Network Address Translators (NAT)
Extracted elements (22)
NAT-MIB exposed many configuration parameters (e.g., timeouts) even in read-only mode, but since NAT implementations vary wildly in which parameters they support, few devices could claim even basic compliance. The lesson is that a NAT MIB's purpose is not to expose configuration parameters.
NAT-MIB is deprecated because its writable objects caused incompatibility: NAT algorithms and data structures vary so widely across implementations that few could claim full compliance with the write-capable configuration objects. The lesson learned is that the MIB should be read-only as much as possible.
NAT-MIB's transport protocol set (other, icmp, udp, tcp) used arbitrary numeric values unrelated to standard IANA protocol numbers, preventing NAT implementations from exposing information about DCCP, SCTP, etc. The lesson is to use standard transport protocol numbers.
NAT-MIB tied NAT state to network interfaces (interface table, map entries grouped by interface), but many NAT implementations do not track the interface or associate mappings to sets of interfaces. The lesson is that NAT is a logical function that may be independent of interfaces.
NAT-MIB used four ill-defined NAT service categories (basicNat, napt, bidirectionalNat, twiceNat) that many implementations did not use or used differently. The lesson is to avoid trying to categorize NAT types.
The NATV2-MIB (RFC 7659) was designed to address all five deficiencies of NAT-MIB: excessive writability, configuration parameter exposure, interface coupling, ill-defined service type categories, and non-standard protocol numbers. Section 3.2 notes additional new features in NATV2-MIB not present in NAT-MIB.
All MIB objects defined in RFC 4008 are included in this document unchanged except that STATUS is set to 'deprecated'. New implementations should use NATV2-MIB defined in RFC 7659 instead of NAT-MIB.
natAddrBindEntry and natAddrPortBindEntry rows use index components (InetAddress) that may produce OIDs exceeding 128 subidentifiers; implementers must avoid creating such entries, as they cannot be accessed via SNMPv1, SNMPv2c, or SNMPv3.
All address map entries with the same ifIndex MUST have the same natAddrMapName. This is a constraint on the natAddrMapTable that enforces per-interface name grouping.
Default timeout objects (all deprecated) include: natBindDefIdleTimeout (default 0 s), natUdpDefIdleTimeout (300 s), natIcmpDefIdleTimeout (300 s), natOtherDefIdleTimeout (60 s), natTcpDefIdleTimeout (86400 s), natTcpDefNegTimeout (60 s). Agents with non-volatile storage must restore these values after reinitialization.
natNotifThrottlingInterval (deprecated) controls generation of natPacketDiscard notifications; valid values are 0 (disabled) or 5–3600 seconds. A value of zero disables notifications; the suggested default when enabled is 60 seconds, but notifications should be disabled by default.
NatProtocolMap is a deprecated BITS TEXTUAL-CONVENTION representing the same protocol set as a bitmap: other(0), icmp(1), udp(2), tcp(3). It must be kept in sync with NatProtocolType.
NatProtocolType is a deprecated TEXTUAL-CONVENTION enumerating NAT-supported protocols as INTEGER: none(1), other(2), icmp(3), udp(4), tcp(5). These arbitrary values (not IANA protocol numbers) are one reason for the deprecation.
NatTranslationEntity is a deprecated BITS TEXTUAL-CONVENTION indicating session direction and which endpoint is translated: inboundSrcEndPoint(0), outboundDstEndPoint(1), inboundDstEndPoint(2), outboundSrcEndPoint(3). Used in address map and bind entries.
The NAT-MIB module is identified as natMIB under mib-2 123 (OID { mib-2 123 }). This document updates its LAST-UPDATED to 2015-10-02 and marks all objects deprecated in favor of NATV2-MIB (RFC 7659).
The natAddrBindTable (deprecated) holds active NAT address binds, indexed by ifIndex, natAddrBindLocalAddrType, and natAddrBindLocalAddr. Each entry carries a globally unique bind ID (NatBindId), translation entity, association type, session count, idle timers, and translation counters.
The natAddrMapTable (deprecated) lists address map parameters for NAT, indexed by ifIndex and natAddrMapIndex. Each entry specifies local/global address ranges (InetAddress), port ranges (InetPortNumber), protocol bitmap (NatProtocolMap), association type (static/dynamic), and translation entity.
The natAddrPortBindTable (deprecated) holds active NAPT binds, indexed by ifIndex, local address type/address/port, and protocol. Entries map private (address, port, protocol) tuples to public (address, port) tuples and carry idle timers and per-bind translation counters.
The natInterfaceTable (deprecated) specifies attributes for NAT-capable interfaces, indexed by ifIndex. Its columns include realm (private/public), service type (basicNat/napt/bidirectionalNat/twiceNat), and per-interface translation and discard counters (Counter64).
The natProtocolTable (deprecated) provides per-protocol NAT statistics. The document text was truncated before this table's full definition, but it is present in the MIB module under natMIBObjects.
The natSessionTable (deprecated) holds one entry per active NAT session, indexed by ifIndex and natSessionIndex. Each row records private and public source/destination address and port tuples, session direction (inbound/outbound), uptime, idle timers, and per-session translation counters.
Security considerations for NAT-MIB rely on those specified in RFC 4008 and RFC 7659 (NATV2-MIB). The writable objects in NAT-MIB (now deprecated) represented the primary security exposure; migrating to the read-mostly NATV2-MIB reduces the attack surface.