[BEHAVE] REQ-7 and REQ-8 Re: I-D Action: draft-ietf-behave-lsn-requirements-02.txt

[Reinaldo Penno <[e-mail]>]

Hello Simon,

Thanks for the updated draft. It shows a lot of good progress.

I'm going through it and have a few questions regarding REQ-7 and REQ-8.

Given there was discussion on the list about these requirements and no
definite consensus on the wording or purpose (
http://www.ietf.org/mail-archive/web/behave/current/msg09433.html) I was
surprised to see them in the new version.

It seems we are trying to solve the address change problem in another
fashion (..."This is to prevent users from receiving unwanted traffic").

As discussed in http://www.ietf.org/id/draft-ietf-pcp-base-13.txt, section
8.7, address change already happens today and traffic is directed to another
CPE with or w/o CGN.


"  REQ-7:  When a CGN loses state (due to a crash, reboot, failover to a
           cold standby, etc.), it MUST NOT reuse the same external IP
           addresses for new dynamic mappings for at least 120 seconds.

   Justification:  This is necessary in order to prevent collisions
      between old and new mappings and sessions.  It ensures that all
      established sessions are broken instead of redirected to a
      different peer.  The previous address pool MAY of course be reused
      after a second loss of state."

If the premise is that when a CGN reboots it looses state, can you elaborate
on the use cases on how packets will be directed to a different peer in case
a CGN reboots and reuses the same NAT pool in less than 120 seconds?


"   REQ-8:  Once an external port is deallocated, it SHOULD NOT be
           reallocated to a new mapping until at least 120 seconds have
           passed.  The length of time and the maximum number of ports
           in this state SHOULD be configurable by the CGN
           administrator.

   Justification:  This is to prevent users from receiving unwanted
      traffic.  It also helps prevent against clock skew when mappings
      are logged."

Another question, when you say " The length of time and the maximum number
of ports in this state SHOULD be configurable by the CGN administrator." do
you mean it can be configured to be less than 120 seconds

Or

It can configured but it needs to be more than 120 seconds.

Thanks,

Reinaldo

On 7/11/11 12:11 PM, "Simon Perreault" <[e-mail]> wrote:

> [e-mail] wrote, on 07/11/2011 03:08 PM:
>> A New Internet-Draft is available from the on-line Internet-Drafts
>> directories. This draft is a work item of the Behavior Engineering for
>> Hindrance Avoidance Working Group of the IETF.
>> 
>> Title           : Common requirements for Carrier Grade NAT (CGN)
>> Author(s)       : Simon Perreault
>>                           Ikuhei Yamagata
>>                           Shin Miyakawa
>>                           Akira Nakagawa
>>                           Hiroyuki Ashida
>> Filename        : draft-ietf-behave-lsn-requirements-02.txt
>> Pages           : 16
>> Date            : 2011-07-11
> 
> This revision introduces many important changes. As far as I know it addresses
> every issue that was raised.
> 
> Here's the change log:
> 
>    o  CGNs MUST support at least TCP, UDP, and ICMP.
> 
>    o  Add requirement from [I-D.ietf-intarea-ipv4-id-update].
> 
>    o  Add informative reference to
>       [I-D.ietf-intarea-shared-addressing-issues].
> 
>    o  Add requirement (SHOULD level) for a port forwarding protocol.
> 
>    o  Allow any pooling behavior on a per-application protocol basis.
> 
>    o  Adjust wording for external port allocation rate limiting.
> 
>    o  Add requirement for RFC4008 support (SHOULD level).
> 
>    o  Adjust wording for swapping address pools when rebooting.
> 
>    o  Add DSCP requirement (stolen from draft-jennings-behave-nat6).
> 
>    o  Add informative reference to
>       draft-boucadair-intarea-nat-reveal-analysis.
> 
>    o  Add requirement for hold-down pool.
> 
>    o  Change definition of CGN.
> 
>    o  Avoid usage of "device" loaded word throughout the document.
> 
>    o  Add requirement about resource exhaustion.
> 
>    o  Change title.
> 
>    o  Describe additional CGN topology where there is no NAT444.
> 
>    o  Better justification for "Paired" pool behavior.
> 
>    o  Make it clear that rate limiting allocation is for preserving CPU
>       resources
> 
>    o  Generalize the requirement for limiting the number of TCP sessions
>       per mapping so that it applies to all memory-consuming state
>       elements.
> 
>    o  Change CPE to subscriber where it applies throughout the text.
> 
>    o  Better terminology for bulk port allocation mechanisms.
> 
>    o  Explain how external address pairing works with DS-Lite.
> 
> Simon