RFC 6888
RFC 6888
RFC 6888
Abstract
Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Requirements for CGNs . . . . . . . . . . . . . . . . . . . 4
4. Logging . . . . . . . . . . . . . . . . . . . . . . . . . . 10
5. Port Allocation Scheme . . . . . . . . . . . . . . . . . . . 11
6. Deployment Considerations . . . . . . . . . . . . . . . . . 11
7. Security Considerations . . . . . . . . . . . . . . . . . . 12
8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 12
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 12
9.1. Normative References . . . . . . . . . . . . . . . . . 12
9.2. Informative Reference . . . . . . . . . . . . . . . . . 13
1. Introduction
2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
.
:
| Internet
............... | ...................
| ISP network
External pool: |
192.0.2.1/26 |
++------++ External realm
........... | CGN |...............
++------++ Internal realm
10.0.0.1 | |
| |
| | ISP network
............. | .. | ................
| | Customer premises
10.0.0.100 | | 10.0.0.101
++------++ ++------++
| CPE1 | | CPE2 | etc.
++------++ ++------++
REQ-3: The CGN function SHOULD NOT have any limitations on the size
or the contiguity of the external address pool. In particular,
the CGN function MUST be configurable with contiguous or non-
contiguous external IPv4 address ranges.
REQ-4: A CGN MUST support limiting the number of external ports (or,
equivalently, "identifiers" for ICMP) that are assigned per
subscriber.
The length of time and the maximum number of ports in this state
MUST be configurable by the CGN administrator.
The exceptions are for cases where reusing a port immediately does
not create a possibility that packets would be redirected to the
wrong peer. One can imagine other exceptions where mapping
collisions are avoided, thus justifying the SHOULD level for this
requirement.
Note that this requirement also applies to the case when a CGN
loses state (due to a crash, reboot, failover to a cold standby,
etc.). In that case, ports that were in use at the time of state
loss SHOULD NOT be reallocated until at least 120 seconds have
passed.
Note also that there are efforts within the IETF toward creating a
MIB tailored for CGNs (e.g., [NAT-MIB]).
4. Logging
o transport protocol
o timestamp
Some schemes create one log entry per mapping. Others allow
multiple mappings to generate a single log entry, which sometimes
can be expressed very compactly. With some schemes, the logging
frequency can approach that of DHCP servers.
Some schemes provide very good security in that ports numbers are
not easily guessed. Others provide poor security to subscribers.
6. Deployment Considerations
Several issues are encountered when CGNs are used [RFC6269]. There
is current work in the IETF toward alleviating some of these issues.
For example, see [NAT-REVEAL].
7. Security Considerations
8. Acknowledgements
9. References
[RFC4008] Rohit, R., Srisuresh, P., Raghunarayan, R., Pai, N., and
C. Wang, "Definitions of Managed Objects for Network
Address Translators (NAT)", RFC 4008, March 2005.
[RFC5382] Guha, S., Biswas, K., Ford, B., Sivakumar, S., and P.
Srisuresh, "NAT Behavioral Requirements for TCP", BCP 142,
RFC 5382, October 2008.
[RFC5508] Srisuresh, P., Ford, B., Sivakumar, S., and S. Guha, "NAT
Behavioral Requirements for ICMP", BCP 148, RFC 5508,
April 2009.
[RFC6887] Wing, D., Ed., Cheshire, S., Boucadair, M., Penno, R., and
P. Selkirk, "Port Control Protocol (PCP)", RFC 6887,
April 2013.
[RFC6269] Ford, M., Boucadair, M., Durand, A., Levis, P., and P.
Roberts, "Issues with IP Address Sharing", RFC 6269, June
2011.
[RFC6333] Durand, A., Droms, R., Woodyatt, J., and Y. Lee, "Dual-
Stack Lite Broadband Deployments Following IPv4
Exhaustion", RFC 6333, August 2011.
[NAT-REVEAL]
Boucadair, M., Touch, J., Levis, P., and R. Penno,
"Analysis of Solution Candidates to Reveal a Host
Identifier (HOST_ID) in Shared Address Deployments", Work
in Progress, April 2013.
[NAT444] Donley, C., Ed., Howard, L., Kuarsingh, V., Berg, J., and
J. Doshi, "Assessing the Impact of Carrier-Grade NAT on
Network Applications", Work in Progress, April 2013.
[BITTORRENT]
Boucadair, M., Zheng, T., Deng, X., and J. Queiroz,
"Behavior of BitTorrent service in PCP-enabled networks
with Address Sharing", Work in Progress, May 2012.
Authors’ Addresses
Ikuhei Yamagata
NTT Communications Corporation
Gran Park Tower 17F, 3-4-1 Shibaura, Minato-ku
Tokyo 108-8118
Japan
Shin Miyakawa
NTT Communications Corporation
Gran Park Tower 17F, 3-4-1 Shibaura, Minato-ku
Tokyo 108-8118
Japan
Akira Nakagawa
Japan Internet Exchange Co., Ltd. (JPIX)
Otemachi Building 21F, 1-8-1 Otemachi, Chiyoda-ku
Tokyo 100-0004
Japan
Hiroyuki Ashida
Cisco Systems
Midtown Tower, 9-7-1, Akasaka
Minato-Ku, Tokyo 107-6227
Japan
EMail: hiashida@cisco.com