[IPFIX] RFC 8158 applicability and breadth

["Wayne Tackabury" <[e-mail]>]

Hi all:

 

I have two questions, and will separate them since they're distinct, IPFIX-wise.

 

I'm noting the presence of RFC 8158, have briefly gone over it.  It addresses IEs for "logging NAT events".

 

My question is this: in the formulation of these entities, was the intent to have this be strictly the reporting domain for "classic" NAT implementations, with configured pools and ports and static vs. dynamic mappings and all of that? 

 

Or, was there a considered "mission creep" :) to allow these to be used for reporting on things like load balancers, firewall domain address mapping, and the like, to report what their "pre-translated" address is on the source of a flow?  Keep in mind, the mapping for such a thing has nothing to do with the exporter itself (the exporter may just be detecting this from network traffic), so it would be quite wrong to use a source vs. exporter address.

 

If using the RFC 8158 fields for this just seems....wrong (I mean, it is translation....of an address), is there another (probably simpler) set of fields for this that come to mind?  To be perfectly transparent here, if this was to be used for supporting the semantics of the "Forwarded: " HTTP header as in RFC 7239, this would in fact have to be a list of addresses, but I'm just wondering if there was an IPFIX reporting practice for this using IANA elements even if the forwarded source was a scalar address.

 

Thanks!

Wayne