Re: [BEHAVE] REQ-5, RFC5508

The NAT box itself has a public IP address assigned to its outgoing
interface/port which can be used instead of allocating one from the
address pool but it is upto the implementation. 

Senthil

-----Original Message-----
From: behave-bounces@ietf.org [mailto:behave-bounces@ietf.org] On Behalf
Of WashamFan
Sent: Friday, February 05, 2010 1:50 AM
To: behave@ietf.org
Subject: [BEHAVE] REQ-5, RFC5508

Hi,

THe text says

   REQ-5: If a NAT device receives an ICMP Error packet from the private
          realm, and the NAT does not have an active mapping for the
          embedded payload, the NAT SHOULD silently drop the ICMP Error
          packet.  If the NAT has active mapping for the embedded
          payload, then the NAT MUST do the following prior to
          forwarding the packet, unless explicitly overridden by local
          policy:

          a) Revert the IP and transport headers of the embedded IP
             packet to their original form, using the matching mapping;
             and

          b) Leave the ICMP Error type and code unchanged; and

          c) If the NAT enforces Basic NAT function ([NAT-TRAD]), and
             the NAT has active mapping for the IP address that sent the
             ICMP Error, translate the source IP address of the ICMP
             Error packet with the public IP address in the mapping.  In
| 
             all other cases, translate the source IP address of the
|
             ICMP Error packet with its own public IP address.
|

I have a comment on the last sentence. 

Please note that NAPT can have a address pool either. If the ICMP Error
message generated by an intermediate node in the interal realm, and NAPT
has no corresponding active mapping for this node. The last sentence
applies in this case, but which one should be picked up for mapping if
the NAPT has multiple external addresses.

Thanks,
washam

_______________________________________________
Behave mailing list
Behave@ietf.org
https://www.ietf.org/mailman/listinfo/behave