Internet DRAFT - draft-cheng-behave-nat44-fixed-port

draft-cheng-behave-nat44-fixed-port



Network working group                                    D. Cheng
Internet Draft                                Huawei Technologies
Category: Standards Track
Expires: February 25 2011



                                                  August 25, 2010



                        NAT44 with Pre-allcoated Ports

                draft-cheng-behave-nat44-pre-allocated-ports-00


Status of this Memo

   This Internet-Draft is submitted to IETF in full conformance with
   the provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups. Note that
   other groups may also distribute working documents as
   Internet-Drafts.

   Internet-Drafts are draft documents valid for a maximum of six
   months and may be updated, replaced, or obsoleted by other documents
   at any time. It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This Internet-Draft will expire on March 4, 2010.

Copyright Notice

   Copyright (c) 2009 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document. Please review these documents




Cheng                 Expires February, 2011                [Page 1]

Internet-Draft         NAT44 with Pre-allocated Ports      August 2010

   carefully, as they describe your rights and restrictions with
   respect to this document.

Abstract

   This document specifies a NAT44 operation model where external
   ports are pre-allocated per subscriber. The NAT44 function is
   deployed in carrier's networks also known as CGN. Two new RADIUS
   attributes are proposed to support that operation for
   configuration and billing purpose. Translation logging on a
   NAT44 device is significantly reduced with this operational model.

Conventions used in this document

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC-2119 [RFC2119].

Table of Contents

   1. Introduction....................................................2
   2. Terminology.....................................................4
   3. Operation.......................................................4
      3.1. An Example.................................................6
   4. RADIUS Attributes...............................................6
      4.1. Nat-Max-Port-Count Attribute...............................7
      4.2. Nat-Port-Range Attribute...................................8
   5. Table of Attributes.............................................8
   6. Security........................................................9
   7. IANA Considerations.............................................9
   8. Acknowledgements................................................9
   9. References......................................................9
      9.1. Normative References.......................................9
      9.2. Informative References.....................................9
   10. Authors' Addresses............................................10


  1. Introduction

   There are currently several IPv4 address sharing mechanisms such as
   NAT444([I-D.shirasaki-nat444-isp-shared-addr]) and DS-Lite
   ([I-D.ietf-softwire-dual-stack-lite]) because of shortage of IPv4
   addresses. When an IP flow is initiated from a user side and its
   source IPv4 address is replaced by a shared IPv4 address at a NAT44
   device, the source TCP/UDP port in the IPv4 packet is also replaced
   by one dynamically allocated by the NAT44 device, most likely from a
   single port pool, and as such, the IP flow can be uniquely


 
Cheng                     Expires February 2011            [Page 2]

Internet-Draft         NAT44 with Pre-allocated Ports      August 2010

   identified end-to-end. A NAT44 device usually randomizes the port
   selection, and this practice helps enhance the security in the
   network.

   However, such practice increases the translation logging task on
   a NAT44 device. Note each NAT44 translation log entry corresponds
   to a unique IP flow and typically includes the destination address
   and port, translated source address (the shared IPv4 address),
   translated source port (the one allocated by the NAT44 device),
   original source address and port, etc. It requires large volume of
   storage and also processing capacity on a NAT44 device for such
   operation (see Section 11 of
   [I-D.ietf-intarea-shared-addressing-issues]).

   This document proposes an operation model for NAT44, where a maximum
   number of TCP/UDP ports is configured on a RADIUS server for each
   subscriber as part of the user profile. This information is passed to
   the NAT44 device where a subscriber is attached. The NAT44
   dynamically pre-allocates a port range for a given subscriber, and
   the number of ports in that range must be less or equal to the
   maximum number of ports that has been assigned. When a new IP flow
   arrives from the subscriber, the NAT44 then allocates dynamically a
   port from the pre-allocated port range for the subscriber, also
   assigns a shared IPv4 address. The NAT44 would need to pass the
   pre-allocated port range along with the shared IPv4 address to the
   RADIUS server and the information may be used for billing purpose.
   The communication between the NAT44 and RADIUS server uses RADIUS
   protocol ([RFC2865]), requiring NAS co-locates with the NAT44 device.

   Note a NAT44 may pre-allocate more than one port ranges for any
   given subscriber, as long as the total number of ports is less or
   equal to the maximum number of ports configured on the RADIUS
   server for that subscriber. The actual pre-allocation is entirely
   based on necessity during the operation, but the actual algorithm
   behind this is out of the scope of this document.

   This NAT44 port pre-allocation model using RADIUS service could
   hopefully reduce substantially the intensity on a NAT44 when
   performing session based logging, while still able to conduct
   port allocation with randomization.

   To support this operation model, two new RADIUS attributes are
   defined in this document as follows:

     1) The Nat-Max-Port-Count attribute carries the maximum number of
        TCP/UDP ports that a NAT44 device can use for a given subscriber




Cheng                     Expires February 2011            [Page 3]

Internet-Draft         NAT44 with Pre-allocated Ports      August 2010

        during the translation. The information is configured on a
        RADIUS server and passed to a NAT44 device.

     2) The Nat-Port-Range attribute carries a block of contiguous
        ports that a NAT44 device pre-allocates for a given subscriber
        along with a shared IPv4 address. This information is passed
        to a RADIUS server from the NAT44 device.

  2. Terminology

   This document introduces two terms as follows:

     . Max port count

        This is the maximum number of TCP/UDP ports for a given
        subscriber, which can be used at a NAT44 device.

     . Port range

        This specifies a contiguous TCP/UDP ports, indicated by the
        port with the smallest numerical number and the port with
        the largest numerical number.

  3. Operation

   The per-subscriber based maximum port count is configured on
   a RADIUS server, along with other user information such as
   credentials. The value of the port count is based on service
   agreement and its specification is out of the scope of this
   document.

   A Network Access Server (NAS), located on a NAT44 device,
   operates as a RADIUS client.

   A subscriber initiates a service request, which is sent to the
   NAT44 device that hosts a NAS, which in turn sends a RADIUS
   Access-Request message to a RADIUS server. If the server approves
   the request after validation, it replies with an Access-Accept
   message back to the NAS, where the message includes a list of
   parameters for the associated IP session but also the maximum
   number of ports as defined in this document. While some parameters
   are passed to the subscriber, the maximum port count for that
   subscriber is recorded on the NAT44 device.

   Upon obtaining the maximum port count for a subscriber, the NAT44
   device pre-allocates some ports for the subscriber that are used
   during NAT44 procedure when receiving IPv4 flows sent from that



Cheng                     Expires February 2011            [Page 4]

Internet-Draft         NAT44 with Pre-allocated Ports      August 2010

   subscriber. The NAT44 may allocates one or more port ranges, where
   each range contains a contiguous ports, and the total number of
   ports must be less or equal to the maximum port count that it
   records for that subscriber. A NAT44 device may choose to allocate
   a small range of ports, and allocate more at a later time as
   needed; such practice is good due to its randomization.

   At the same time, the NAT44 device also needs to decide the shared
   IPv4 address for that subscriber. The shared IPv4 address and the
   pre-allocated port range are then passed to the RADIUS server.

   When a subscriber initiates an IPv4 flow, the NAT44 device
   randomly selects a port from the pre-allocated port range for that
   subscriber to replace the original source port, along with the
   replacement of the source IPv4 address by the shared IPv4 address.

   Figure-1 illustrates how RADIUS protocol is used to configure
   the maximum number of ports for a given subscriber on a NAT44
   device, and obtains the shared IPv4 address and pre-allocated
   port range determined by the NAT44 device for that subscriber.


        User                    NAT44/NAS                       AAA
         |                          |                          Server
         |                          |                             |
         |----Service Request------>|                             |
         |                          |                             |
         |                          |-----Access-Request -------->|
         |                          |                             |
         |                          |<----Access-Accept-----------|
         |                          |    (Nat-Max-Port-Count)     |
         |                          |                             |
         |<---Service Granted ------|                             |
         |    (other parameters)    |                             |
         |                          |                             |
         |                  (NAT44 external port                  |
         |                   pre-allocation and                   |
         |                   IPv4 address assignment)             |
         |                          |                             |
         |                          |-----Accounting-Request----->|
         |                          |     (Nat-Port-Range)        |
         |                          |                             |

              DHCPv4/IPoPPP                     RADIUS

                          Figure 1: RADIUS Message Flow





Cheng                     Expires February 2011            [Page 5]

Internet-Draft         NAT44 with Pre-allocated Ports      August 2010

   [Editor's notes - one issue was raised that a NAT44 may create too
   many fixed port ranges for a given maximum port count (perhaps due
   to a poor implementation), resulting too many RADIUS messages. It
   may be useful to define an additional parameter, called "maximum
   port range count", which defines the maximum number of port ranges
   a NAT44 may create for a given subscriber. This parameter is defined
   along side of the "maximum port count" and carried by the same
   RADIUS attribute. This issue and the need of the additional
   parameter will be discussed and added to the next revision if
   required.]

  3.1. An Example

   An ISP assigns 1000 ports for the subscriber A based on a
   service agreement. This number is the maximum number
   of ports that can be used during NAT44 on a NAT44 device for A,
   and is configured on a RADIUS server. When A registers with
   the ISP's Internet service after required AAA procedure, the
   RADIUS server passes the maximum port count (1000) to the NAT44
   device that is co-located with a BNG that connects A to
   the Internet.

   The NAT44 device decides to pre-allocate a small port pool that
   contains 40 contiguous ports, from 3500 to 3540, inclusively,
   and also assign a shared IPv4 address 192.27.30.15, for A.

   The NAT44 device passes this port range (3500-3540) and the
   shared IPv4 address 192.27.30.15 together to the RADIUS server.

   When A initiates a new IP flow that reaches the NAT44, the
   original source IP address is replaced by 192.27.30.15, and
   the source port is replaced by an available one that is
   randomly selected in the port range, say port 3521.

   If at a later time, the port pool (3500-3540) is close to
   exhaustion, the NAT44 device pre-allocates a second port range
   in a similar fashion, with the same or different number of
   ports as in the first one, say from 8500 to 8800, inclusively.
   The NAT44 then passes this port range (8500-8800) and IPv4
   address 192.27.30.15 together to the RADIUS server.

  4. RADIUS Attributes

  Two new RADIUS attributes are defined in this document in order to
  achieve the NAT44 operational model as described in Section 3.

  The Nat-Max-Port-Count attribute carries the maximum number of
  TCP/UDP ports that a NAT44 device can use during NAT44 procedure


Cheng                     Expires February 2011            [Page 6]

Internet-Draft         NAT44 with Pre-allocated Ports      August 2010

  for a given subscriber. This maximum number of ports for a given
  subscriber is configured on a RADIUS server as part of the user's
  profile, and conveyed to the NAT44 device during the user
  registration.

  The Nat-Port-Range attribute carries a contiguous TCP/UDP ports that
  a NAT44 device has pre-allocated to be used during NAT44 procedure
  for a given subscriber, along with an IPv4 address, which may be
  shared with other subscribers. This information is sent by the NAT44
  device to a RADIUS server and may be used for billing purpose.

  4.1. Nat-Max-Port-Count Attribute

     Description

     This Attribute specifies the maximum number of TCP/UDP ports that
     is assigned to a NAT44 device corresponding to a specific
     subscriber for NAT44 operation.

     The Nat-Max-Port-Count MAY appear in an Access-Accept packet, and
     it MAY also appear in an Access-Request packet as a hint by the
     NAS to the server as a preference, although the RADIUS server is
     not required to honor the hint.

     The Nat-Max-Port-Count MAY appear in an Accounting-Request
     packet.

     The Nat-Max-Port-Count MUST NOT appear in any other RADIUS packets.

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      Type     |     Length    |        Max NAT Port Count     |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

      Type

         TBD

      Length

         4 octets.

      Max NAT Port Count

         The maximum number of TCP/UDP ports that can be used during
         NAT44 operation for a given subscriber.



Cheng                     Expires February 2011            [Page 7]

Internet-Draft         NAT44 with Pre-allocated Ports      August 2010

   4.2. Nat-Port-Range Attribute

     Description

     This Attribute contains a contiguous TCP/UDP port numbers in a
     range, which is pre-allocated by a NAT44 device for a given
     subscriber, and an IPv4 address that may be shared with other
     subscribers.

     The Nat-Port-Range MAY appear in an Accounting-Request
     packet.

     The Nat-Port-Range MUST NOT appear in any other RADIUS packets.

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      Type     |     Length    |   External Port Range Start   |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |   External Port Range End     |     Shared IPv4 Address       |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |  Shared IPv4 Address (cont.)  |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

      Type

         TBD

      Length

         10 octets.

      External Port Range Start

        The smallest port number in a range of contiguous TCP/UDP
        ports.

      External Port Range End

         The largest port number in a range of contiguous TCP/UDP
         ports.

  5. Table of Attributes

   The following table provides a guide as the attributes may be
   found in which kinds of packets, and in what quantity.




Cheng                     Expires February 2011            [Page 8]

Internet-Draft         NAT44 with Pre-allocated Ports      August 2010

   Request  Accept Reject Challenge Accounting  #   Attribute

    0-1     0-1      0       0         0-1     TBD  Nat-Max-Port-Count

    0       0        0       0         0+      TBD  NAT-Port-Range

   The meaning of the above table entries is as follows:

      0   This attribute MUST NOT be present.

      0-1 Zero or one instance of this attribute MAY be present.

      0+  Zero or more instances of this attribute MAY be present.

  6. Security

   Security problems of the RADIUS protocol are discussed in [RFC2865].

  7. IANA Considerations

   This document requires the assignment of two new RADIUS attribute
   numbers for the following attribute:

      Nat-Max-Port-Count

      Nat-Port-Range

  8. Acknowledgements

   Many thanks to Dan Wing who provided useful suggestions and comments.

  9. References

  9.1. Normative References

    [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
   Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC2865]  Rigney, C., Willens, S., Rubens, A., and W. Simpson,
   "Remote Authentication Dial In User Service (RADIUS)", RFC2865,
   June 2000.

  9.2. Informative References

   [I-D.ietf-softwire-dual-stack-lite] Durand, A., "Dual-Stack Lite
  Broadband Deployments Following IPv4 Exhaustion",
   draft-ietf-softwire-dual-stack-lite-05 (work in progress),
  July 2010.


Cheng                     Expires February 2011            [Page 9]

Internet-Draft         NAT44 with Pre-allocated Ports      August 2010


  [I-D.shirasaki-nat444-isp-shared-addr] Shirasaki, Y., Miyakawa, S.,
  Nakagawa, A., Yamaguchi, J., and H. Ashida, "NAT444 addressing
  models", draft-shirasaki-nat444-isp-shared-addr-03 (work in
  progress), March 2010.

   [I-D.ietf-intarea-shared-addressing-issues] M. Ford, M. Boucadair,
   A. Durand, P. Levis, P. Roberts,
   draft-ietf-intarea-shared-addressing-issues-01, work in progress.

  10.             Authors' Addresses

   Dean Cheng
   Huawei Technologies,
   2330 Central Expressway, CA 95050, USA
   Phone:+1 408 330 4754
   Email: Chengd@huawei.com

































Cheng                     Expires February 2011            [Page 10]