[BEHAVE] REQ-5, RFC5508

[WashamFan <[e-mail]>]

Hi,

THe text says

   REQ-5: If a NAT device receives an ICMP Error packet from the private
          realm, and the NAT does not have an active mapping for the
          embedded payload, the NAT SHOULD silently drop the ICMP Error
          packet.  If the NAT has active mapping for the embedded
          payload, then the NAT MUST do the following prior to
          forwarding the packet, unless explicitly overridden by local
          policy:

          a) Revert the IP and transport headers of the embedded IP
             packet to their original form, using the matching mapping;
             and

          b) Leave the ICMP Error type and code unchanged; and

          c) If the NAT enforces Basic NAT function ([NAT-TRAD]), and
             the NAT has active mapping for the IP address that sent the
             ICMP Error, translate the source IP address of the ICMP
             Error packet with the public IP address in the mapping.  In   | 
             all other cases, translate the source IP address of the         |
             ICMP Error packet with its own public IP address.                |

I have a comment on the last sentence. 

Please note that NAPT can have a address pool either. If the ICMP
Error message generated by an intermediate node in the interal realm,
and NAPT has no corresponding active mapping for this node. The
last sentence applies in this case, but which one should be picked up
for mapping if the NAPT has multiple external addresses.

Thanks,
washam