IP Flow Information Export (IPFIX) Information Elements for Logging NAT Events
Extracted elements (26)
Historic natEvent values 1 and 2 (generic NAT translation create/delete) were replaced with more specific per-event-type values because they do not specify whether the event is NAT44 or NAT64 and require additional context to qualify the event. The Behave working group decided on explicit definitions for each unique event.
IPFIX was chosen over syslog as the encoding mechanism because it is an IETF standard with binary encoding suited for high-volume environments such as Carrier-Grade NAT. IPFIX's binary format is efficient and flexible, allowing the logging device to define the datasets being logged.
Quota Exceeded and Threshold Reached events are distinct: Quota Exceeded events result in packet drops or mapping failures, whereas Threshold Reached events give the operator a chance to act before traffic disruptions occur. A NAT device can choose to implement one, the other, or both.
The Collector distinguishes between multiple CGN devices using the source IP address, source port, and Observation Domain ID in the IPFIX header. The retention policy for collected events is defined at the Collector and is not dictated by the Exporter.
A NAT device implementing IPFIX logging MUST follow the IPFIX specification in RFC 7011. The NAT device will specify the template it is going to use for each event, and the Collector MUST support receiving multiple templates from the same source.
A NAT device that implements a given NAT event MUST support the mandatory IEs in the templates. Depending on the implementation and configuration, non-mandatory IEs can be included or ignored.
Addresses Exhausted and Ports Exhausted events SHOULD be rate-limited by the NAT device before sending to Collectors, as many simultaneous packets can trigger bursts of exhaustion events.
An IPFIX Collector MUST be able to collect events from multiple NAT devices and decipher events based on the Observation Domain ID in the IPFIX header.
Any compliant implementation SHOULD NOT use historic natEvent values 1 (NAT translation create) and 2 (NAT translation delete), as they do not specify whether the event is NAT44 or NAT64 and require additional context.
Each NAT event SHOULD be logged unless this is administratively prohibited. A NAT device MAY log these events to multiple Collectors if redundancy is required.
In the Port Block Allocation template, portRangeStart and portRangeEnd MUST be specified to identify the allocated port block range.
Logging of destination addresses and ports, pre- or post-NAT, SHOULD NOT be done per RFC 6888. However, this document provides the necessary fields to log the destination information in cases where they must be logged.
Logs SHOULD be reliably sent to the Collector to ensure that the log events are not lost. The choice of actual transport protocol (TCP, UDP, or SCTP) is beyond the scope of this document.
When destination information is suppressed in a NAT44 session log event, the session log contains the same information as the BIB event; in such cases, the NAT device SHOULD NOT send both BIB and session events.
Logging NAT events exposes source address and port information, raising privacy concerns. Destination information logging raises additional concerns documented in RFC 6888. NAT devices may operate in logging modes that avoid logging private information; Collectors may mask private information while generating abstract reports.
Quota Exceeded events (natEvent=13) are generated when hard administrator-set limits are reached. The natQuotaExceededEvent IE (IPFIX ID 466, unsigned32) identifies the sub-type: maximum session entries (1), maximum BIB entries (2), maximum entries per user (3), maximum active hosts/subscribers (4), or maximum fragments pending reassembly (5).
The complete IE table (Table 1) defines all IPFIX fields for NAT logging. Key fields include: timeStamp (64-bit, ID 323), natInstanceID (32-bit, ID 463), internalAddressRealm (octetArray, ID 464), externalAddressRealm (octetArray, ID 465), natEvent (8-bit, ID 230), natQuotaExceededEvent (32-bit, ID 466), natThresholdEvent (32-bit, ID 467), and 11 quota/threshold limit IEs (IDs 471-481).
The natEvent Information Element (IPFIX ID 230, unsigned8) identifies the type of NAT event. RFC 8158 defines 19 event values including: Reserved (0), NAT44/NAT64 session create/delete (4-7), NAT44/NAT64 BIB create/delete (8-11), NAT ports exhausted (12), Quota Exceeded (13), Address binding create/delete (14-15), Port block allocation/de-allocation (16-17), and Threshold Reached (18).
Threshold Reached events (natEvent=18) are generated when operator-configured thresholds are hit, giving operators a chance to act before traffic disruptions occur. The natThresholdEvent IE (IPFIX ID 467, unsigned32) identifies sub-types including address pool high/low threshold (1-2), address and port mapping high threshold (3), per-user address and port mapping high threshold (4), and global address mapping high threshold (5).
RFC 8158 creates the 'NAT Event Type (Value 230)' registry for the natEvent IE, seeding it with values 0-18 as defined in Table 2. New assignments are subject to Expert Review per RFC 8126.
RFC 8158 creates the 'NAT Quota Exceeded Event Type' registry for the natQuotaExceededEvent IE (ID 466), with initial values 0-5. It also creates the 'NAT Threshold Event Type' registry for natThresholdEvent IE (ID 467), with initial values 0-5. Both registries use Expert Review for new assignments.
RFC 8158 registers 17 new IPFIX Information Elements in the IANA 'IPFIX Information Elements' registry: natInstanceID (463), internalAddressRealm (464), externalAddressRealm (465), natQuotaExceededEvent (466), natThresholdEvent (467), and limit/threshold IEs maxSessionEntries through globalAddressMappingHighThreshold (471-481). It also updates natEvent (230) from a fixed three-value IE to a registry-backed IE.
Messages exchanged between the NAT device and the Collector MUST be protected to provide confidentiality, integrity, and authenticity. TLS or DTLS MUST be used; log events SHOULD NOT be sent in cleartext, as cleartext enables attackers to read and spoof log events.
NAT44 Session Create/Delete template mandatory fields: timeStamp (64-bit), natEvent (8-bit), sourceIPv4Address (32-bit), postNATSourceIPv4Address (32-bit), protocolIdentifier (8-bit), sourceTransportPort (16-bit), postNAPTSourceTransportPort (16-bit). Destination address and port fields are optional.
NAT64 Session Create/Delete template mandatory fields: timeStamp (64-bit), natEvent (8-bit), sourceIPv6Address (128-bit), postNATSourceIPv4Address (32-bit), protocolIdentifier (8-bit), sourceTransportPort (16-bit), postNAPTSourceTransportPort (16-bit). Source/destination IPv6 addresses are 128 bits wide.
Port Block Allocation template includes portRangeStart (16-bit, IPFIX ID 361) and portRangeEnd (16-bit, IPFIX ID 362) to represent the allocated block. sourceIPv4Address (32-bit) is mandatory for NAT44; sourceIPv6Address (128-bit) is mandatory for NAT64.