Dual-Stack Lite (DS-Lite) Management Information Base (MIB) for Address Family Transition Routers (AFTRs)
Extracted elements (23)
The DS-Lite MIB only supports IP-in-IP (IPv4-in-IPv6) encapsulation because RFC 6333 Section 5.2 currently defines only this tunnel type for DS-Lite. If a future RFC defines other tunnel types, the DS-Lite MIB will be updated accordingly.
The dsliteTunnel subtree redefines local and remote address objects because tunnelInetConfigLocalAddress and tunnelInetConfigRemoteAddress defined in the IP Tunnel MIB are not readable, necessitating new readable objects in the DS-Lite MIB.
The DS-Lite MIB requires an implementation of the IP Tunnel MIB (RFC 4087). Since DS-Lite tunnels are point-to-multipoint, tunnelIfEncapsMethod must be set to dsLite(17) and tunnelIfRemoteInetAddress must be set to '::' (not a specific remote address).
The NATV2-MIB and IP Tunnel MIB together are not sufficient for DS-Lite management because the AFTR's NAT binding table must be extended with the B4's IPv6 tunnel source address, requiring a combined DS-Lite MIB.
Implementations claiming SNMPv3 compliance MUST include full support for authentication and privacy via the User-based Security Model (USM) with the AES cipher algorithm. Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED.
Implementations SHOULD provide the security features described by the SNMPv3 framework, and it is RECOMMENDED to deploy SNMPv3 with cryptographic security enabled.
The dsliteNATBindMappingExtAddressType object MUST be set to iPv4(1); values of ipv6(2), ipv4z(3), and ipv6z(4) are not allowed for the NAT binding's external address type.
The dsliteNATBindMappingExtPort and dsliteNATBindMappingIntPort MUST be non-zero values, representing the external and internal port numbers respectively in NAT bind entries.
The dsliteNATBindMappingIntAddressType MUST be set to iPv4z(3); values of ipv4(1), ipv6(2), and ipv6z(4) are not allowed. This reflects that the internal address is an IPv6 tunnel source address with zone ID.
The dsliteTunnelAddressType object MUST be set to ipv6(2), describing the address type of the IPv4-in-IPv6 tunnel initiator and endpoint.
The DSLite-MIB module is assigned OID { mib-2 240 } and defines three main subtrees: dsliteTunnel (tunnel management), dsliteNAT (NAT binding management), and dsliteInfo (statistical information and alarms).
The dsliteAFTRAlarmConnectNumber object (read-write, Integer32 range 60..90, default 60) sets the notification threshold for the number of active DS-Lite tunnels on the AFTR device.
The dsliteNATBindMappingAddressPooling object encodes address pooling behavior: arbitrary(0) or paired(1). RFC 4787 REQ-2 recommends paired(1) pooling, where a given internal address always maps to the same pool member.
The dsliteNATBindMappingFilterBehavior object encodes NAT filtering behavior per RFC 4787 Section 5: endpointIndependent(0), addressDependent(1), or addressAndPortDependent(2). For DS-Lite, it must be addressAndPortDependent(2).
The dsliteNATBindMappingMapBehavior object encodes NAT mapping behavior per RFC 4787: endpointIndependent(0), addressDependent(1), or addressAndPortDependent(2). For DS-Lite, it must be addressAndPortDependent(2).
The dsliteNATBindTable extends the NATV2-MIB natv2PortMapTable by adding the IPv6 address of the B4 (dsliteTunnelStartAddress) to NAT binding entries. It is indexed by NAT instance, protocol, external realm, external address/port, ifIndex, and B4 tunnel start address.
The dsliteStatisticsTable provides per-subscriber counters: dsliteStatisticsDiscards, dsliteStatisticsSends, dsliteStatisticsReceives, dsliteStatisticsIpv4Session, and dsliteStatisticsIpv6Session, all as Counter64 values.
The dsliteTunnelTable is a conceptual table indexed by dsliteTunnelAddressType, dsliteTunnelStartAddress, dsliteTunnelEndAddress, and ifIndex. It maps B4 IPv6 addresses to associated AFTR addresses for configured IPv4-in-IPv6 tunnels.
Three SNMP notification types are defined: dsliteTunnelNumAlarm (tunnel count exceeds dsliteAFTRAlarmConnectNumber), dsliteAFTRUserSessionNumAlarm (user sessions exceed dsliteAFTRAlarmSessionNumber), and dsliteAFTRPortUsageOfSpecificIpAlarm (NAT port usage of a specific IP exceeds dsliteAFTRAlarmPortNumber).
IANA allocated OID { mib-2 240 } for the DSLite-MIB in the 'SMI Network Management MGMT Codes Internet-standard MIB' subregistry under the mib-2 branch (1.3.6.1.2.1).
IANA recorded IANAtunnelType value dsLite(17) in the IANAifType-MIB Textual Convention to identify DS-Lite tunnels.
Readable objects in dsliteTunnelTable and dsliteNATBindTable can reveal private host identities and tunnel topology. Unauthorized access violates subscriber privacy and could enable targeted attacks against private hosts by intercepting or originating sessions.
The read-write alarm threshold objects (dsliteAFTRAlarmConnectNumber, dsliteAFTRAlarmSessionNumber, dsliteAFTRAlarmPortNumber) are vulnerable to attack: setting thresholds arbitrarily low causes notification floods, while setting them arbitrarily high effectively disables notifications, potentially concealing another attack.