Definitions of Managed Objects for Network Address Translators (NATs)
Extracted elements (25)
Configuration data in NATV2-MIB was deliberately minimized to only what is needed to provide context for state and statistical information. Writable objects are limited to notification rate controls, thresholds, and resource quotas; the association between mappings and interfaces present in RFC 4008 was removed entirely.
NATV2-MIB replaces NAT-MIB (RFC 4008) because NAT-MIB did not fit well with existing NAT implementations and was not itself much implemented. RFC 7658 provides a detailed analysis of its deficiencies. NATV2-MIB is intentionally not backwards compatible.
Pool usage thresholds are defined in terms of percentage of available port utilization, but the document notes that at configuration time these percentages can be precomputed into absolute port map entry counts, so runtime threshold comparisons require no arithmetic — only a comparison against the current counter value.
The port map table is indexed by external realm, address, and port rather than internal address, so that individual sessions can be traced directly back to the host based on the contents of packets observed in the external realm. This indexing design specifically simplifies operator traceback in CGN deployments.
The subscriber index (Natv2SubscriberIndex) is scoped at the device level rather than the NAT instance level to make it easier to shift subscribers between instances, for example for load balancing purposes.
NATV2-MIB is not backwards compatible with NAT-MIB (RFC 4008) and both may be deployed on the same device during transition. Section 5.2 discusses operational considerations for coexistence. RFC 7658 formally deprecates all objects in NAT-MIB.
A basic NAT MUST support indexing by NAT instance even if it limits itself to one instance. A NAT supporting address pools MUST support more than two realms. A basic NAT is not required to implement the subscriber table, address pool table, or pool address range table.
A CGN (carrier-grade NAT) MUST support the full contents of the NATV2-MIB module, including the subscriber table and the DS-Lite special provisions in the address and port map tables.
All cumulative Counter64 statistics MUST be monotone increasing in the periods between updates of the associated discontinuity time object. A manager SHOULD NOT use the difference between counter values if the discontinuity time has changed since the last sample.
If a subscriber's realm (natv2SubscriberInternalRealm) is reconfigured after initial setup, this MUST be treated as a point of discontinuity requiring an update of natv2SubscriberDiscontinuityTime.
Subscriber, instance, and pool index values MUST remain constant at least from one update of the entity's discontinuity time object until the next. If an entity is deleted, its assigned index MUST NOT be reassigned to another entity of the same type until reinitialization of the management system.
The protocol table MUST include entries for ICMP(1), TCP(6), UDP(17), and ICMPv6(58). Depending on the application, it SHOULD include IPv4 encapsulation(4), IPv6 encapsulation(41), IPsec AH(51), and SCTP(132). Support for PIM(103) is described as highly desirable.
When multiple notifications of the same type are triggered during a single notification rate interval, the agent MUST report only the one containing the highest value of the relevant counter and discard the others.
Address pool usage for notifications is calculated as the percentage of total ports allocated to the pool that are in use, measured for the most-mapped protocol at the time the notification is triggered. natv2PoolNotifiedPortMapProtocol identifies that protocol; natv2PoolNotifiedPortMapEntries gives the current count.
NATV2-MIB defines five notifications: natv2NotificationPoolUsageLow, natv2NotificationPoolUsageHigh, natv2NotificationInstanceAddressMapEntriesHigh, natv2NotificationInstancePortMapEntriesHigh, and natv2NotificationSubscriberPortMappingEntriesHigh. All notifications are disabled by default (threshold set to -1).
NATV2-MIB defines four key textual conventions: ProtocolNumber (a Unsigned32 0..255 based on the IANA Protocol Numbers registry), Natv2SubscriberIndex (Unsigned32 1..4294967295), Natv2InstanceIndex (Unsigned32 1..4294967295), and Natv2PoolIndex (Unsigned32 1..4294967295). All index types are administered values intended to be permanently associated with their respective entities.
natv2AddressMapTable is indexed by NAT instance, internal realm (SnmpAdminString), internal address type (InetAddressType), internal address (InetAddress), and a conceptual row index. For DS-Lite, the index uses the IPv6 outer header address; the inner IPv4 address in 192.0.0.0/29 is captured in natv2AddressMapInternalMappedAddress.
natv2InstanceTable records four configurable NAT behaviors per instance: port mapping behavior (endpointIndependent/addressDependent/addressAndPortDependent), filtering behavior (same three options per RFC 4787), pooling behavior (arbitrary/paired), and fragment behavior (fragmentNone/fragmentInOrder/fragmentOutOfOrder).
natv2PoolRangeTable expresses address ranges as lowest-to-highest address pairs rather than prefix notation, providing maximum flexibility for non-contiguous or arbitrarily bounded external address pools. It is indexed by NAT instance, pool index, and a conceptual row index.
natv2PortMapTable is indexed by NAT instance index, protocol number (ProtocolNumber), external realm (SnmpAdminString), external address type (InetAddressType), external address (InetAddress), and external port (InetPortNumber). No additional row index is needed because the external {realm, address, port} tuple uniquely identifies a mapping.
Resource limits are configurable via read-write objects per NAT instance (natv2InstanceLimitAddressMapEntries, natv2InstanceLimitPortMapEntries, natv2InstanceLimitPendingFragments, natv2InstanceLimitSubscriberActives) and per subscriber (natv2SubscriberLimitPortMapEntries). Packets exceeding a limit are dropped and counted in dedicated drop counters.
Statistics are provided at four levels of granularity: per NAT instance, per protocol, per address pool, and per subscriber, where applicable. Each counter is cumulative from the associated last-discontinuity-time timestamp. Table 1 in Section 3.1.4 specifies which statistics are available at each granularity level.
IANA assigned the object identifier natv2MIB ::= { mib-2 234 } to the NATV2-MIB module. The module is organized under four sub-trees: natv2MIBNotifications(0), natv2MIBDeviceObjects(1), natv2MIBInstanceObjects(2), and natv2MIBConformance(3).
NATV2-MIB contains read-write objects (resource limits and notification thresholds) that are security-sensitive: an attacker with write access could set address/port map entry limits to zero, causing all new NAT sessions to be dropped. SNMPv3 with authentication and privacy is required for access to these objects.
The address and port map tables expose sensitive subscriber session data including internal network addresses, protocols, and port numbers. This information can be used to track individual subscriber activity or identify targets for attacks. Access to these read-only tables must be strictly controlled.