Definitions of Managed Objects for Mapping of Address and Port with Encapsulation (MAP-E)
Extracted elements (18)
The bmrAndfmr(3) RuleType value was introduced to handle the mesh mode scenario where a single rule serves as both a Basic Mapping Rule and a Forwarding Mapping Rule, reflecting the F-flag semantics defined in RFC 7598 Section 4.1.
The MAP-E MIB is configurable on a per-interface basis and depends on the IF-MIB (RFC 2863), because each MAP-E tunnel endpoint acts as a virtual interface with a corresponding ifEntry indexed by ifIndex. This reuse of IF-MIB avoids duplicating generic interface management objects.
The MAP-E MIB imports from SNMPv2-SMI (RFC 2578), SNMPv2-TC (RFC 2579), SNMPv2-CONF (RFC 2580), IF-MIB (RFC 2863), and INET-ADDRESS-MIB (RFC 4001). Implementations must support these base MIB modules for the MAP-E MIB to function correctly.
A BMR that does not have the F-flag set MUST NOT be used for forwarding. Only when the F-flag is set may a BMR also be used as an FMR for forwarding.
Implementations claiming compliance to SNMPv3 MUST include full support for authentication and privacy via the User-based Security Model (USM) with the AES cipher algorithm.
Implementations MAY also provide support for the Transport Security Model (TSM) in combination with a secure transport such as SSH or TLS/DTLS as an alternative or complement to USM.
Implementations SHOULD provide the security features described by the SNMPv3 framework, and deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and enable cryptographic security.
mapRuleBRIPv6Address stores the IPv6 address of the Border Relay conveyed to CEs. If the BR IPv6 address is anycast, the relay must use this anycast IPv6 address as the source address in packets relayed to CEs.
mapRuleEALen specifies the length (0..48 bits) of the Embedded Address (EA) defined in the mapping rule that will be assigned to CEs, referencing Section 3 of RFC 7597.
mapRuleOffset specifies the number of offset bits (default 6) to exclude system ports (0-1023) from the port range. It is provided via the Rule Port Mapping Parameters in the Basic Mapping Rule and has a range of 0..15.
The MAP-E MIB module (MAP-E-MIB) is assigned OID { mib-2 242 } and defines managed objects for monitoring MAP-E Border Relays (BRs) and Customer Edges (CEs). It contains two main subtrees: mapRule for managing mapping rules and mapSecurityCheck for security check statistics.
The mapRuleTable is a conceptual table indexed by ifIndex and mapRuleID containing rule information for MAP-E mapping rules. Each entry includes IPv6 prefix, IPv4 prefix, BR IPv6 address, PSID, PSID length, offset, EA length, and rule type.
The mapSecurityCheckTable is indexed by ifIndex and provides two Counter64 objects: mapSecurityCheckInvalidv4 counts received IPv4 packets whose source address or port is outside the MAP rule range, and mapSecurityCheckInvalidv6 counts received IPv6 packets whose source or destination address does not match a Basic Mapping Rule.
The RuleType textual convention enumerates three mapping rule types: bmr(1) for Basic Mapping Rule only, fmr(2) for Forwarding Mapping Rule only, and bmrAndfmr(3) for a rule that serves as both BMR and FMR (used in mesh mode).
This document assigns { mib-2 242 } (descriptor MAP-E-MIB) in the SMI Numbers registry for the MAP-E MIB module OID.
All MIB objects are read-only (no read-write or read-create objects), so there is no risk of an intruder altering or creating management objects via direct SNMP SET operations.
Mapping rule objects (mapRuleIPv6Prefix, mapRuleIPv4Prefix, mapRuleBRIPv6Address, mapRulePSID, etc.) are sensitive because they can be used to deduce customer IPv4/IPv6 topologies and address-sharing ratios, potentially enabling targeted attacks against MAP nodes. GET and NOTIFY access should be controlled and values encrypted when transmitted via SNMP.
The RulePSID textual convention represents the Port Set ID (PSID) as a 2-octet OCTET STRING displayed in hexadecimal. The mapRulePSIDLen object encodes the bit length of significant bits in the PSID field (0..16), with a value of 0 indicating the PSID field should be ignored.