One document matched: draft-donley-behave-deterministic-cgn-00.xml
<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
<?rfc toc="yes"?>
<?rfc tocompact="yes"?>
<?rfc tocdepth="3"?>
<?rfc tocindent="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes"?>
<?rfc comments="yes"?>
<?rfc inline="yes"?>
<?rfc compact="yes"?>
<?rfc subcompact="no"?>
<rfc category="exp" docName="draft-donley-behave-deterministic-cgn-00"
ipr="trust200902">
<front>
<title abbrev="deterministic-cgn">Deterministic Address Mapping to Reduce
Logging in Carrier Grade NATs</title>
<author fullname="Chris Donley" initials="C.D." surname="Donley">
<organization>CableLabs</organization>
<address>
<postal>
<street>858 Coal Creek Cir</street>
<city>Louisville</city>
<region>CO</region>
<code>80027</code>
<country>US</country>
</postal>
<email>c.donley@cablelabs.com</email>
</address>
</author>
<author fullname="Chris Grundemann" initials="C.G." surname="Grundemann">
<organization>CableLabs</organization>
<address>
<postal>
<street>858 Coal Creek Cir</street>
<city>Louisville</city>
<region>CO</region>
<code>80027</code>
<country>US</country>
</postal>
<email>c.grundemann@cablelabs.com</email>
</address>
</author>
<author fullname="Vikas Sarawat" initials="V.S." surname="Sarawat">
<organization>CableLabs</organization>
<address>
<postal>
<street>858 Coal Creek Cir</street>
<city>Louisville</city>
<region>CO</region>
<code>80027</code>
<country>US</country>
</postal>
<email>v.sarawat@cablelabs.com</email>
</address>
</author>
<author fullname="Karthik Sundaresan" initials="K.S." surname="Sundaresan">
<organization>CableLabs</organization>
<address>
<postal>
<street>858 Coal Creek Cir</street>
<city>Louisville</city>
<region>CO</region>
<code>80027</code>
<country>US</country>
</postal>
<email>k.sundaresan@cablelabs.com</email>
</address>
</author>
<date day="26" month="September" year="2011" />
<abstract>
<t>Many Carrier Grade NAT solutions require per-connection logging.
Unfortunately, such logging is not scalable to many residential
broadband services. This document suggests a way to manage Carrier Grade
NAT translations in such a way as to significantly reduce the amount of
logging required while providing traceability for abuse response. This
method also provides a way of including geo-location significance in
such assignments.</t>
</abstract>
<note title="Requirements Language">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <xref
target="RFC2119">RFC 2119</xref>.</t>
</note>
</front>
<middle>
<section title="Introduction">
<t>The world is rapidly running out of unallocated IPv4 addresses. To
meet the growing demand for Internet service from new subscribers,
devices, and service types, ISPs will be forced to share a single public
IPv4 address among multiple subscribers using a technology such as <xref
target="RFC6264">Carrier Grade Network Address Translation (CGN)</xref>.
However, address sharing poses additional challenges to ISPs in
responding to law enforcement requests or attack/abuse reports. In order
to respond to such requests to identify a specific user associated with
an IP address, an ISP will need to map a subscriber's internal source IP
address and source port with the global public IP address and source
port provided by the CGN for every connection initiated by the user.</t>
<t>CGN connection logging satisfies the need to identify attackers and
respond to abuse/law enforcement requests, but it imposes significant
operational challenges to ISPs. In lab testing, we have observed CGN log
messages to be approximately 150 bytes long for NAT444 <xref
target="I-D.shirasaki-nat444"></xref>, and 175 bytes for DS-Lite <xref
target="RFC6333"></xref> (individual log messages vary somewhat in
size). Although we are not aware of definitive studies of connection
rates per subscriber, reports from several ISPs in the US sets the
average number of connections per household per day at approximately
33,000 connections per day. If each connection is individually logged,
this translates to a data volume of approximately 5 MB per subscriber
per day, or about 150 MB per subscriber per month; however, specific
data volumes may vary across different ISPs based on myriad factors.
Based on available data, a 1-million subscriber service provider will
generate approximately 150 terabytes of log data per month, or 1.8
petabytes per year.</t>
<t>As an alternative to per-connection logging, CGNs could
deterministically map internal addresses to external addresses in such a
way as to be able to algorithmically calculate the mapping without
relying on per connection logging. This document describes a method for
such CGN address mapping, combined with block port reservations, that
significantly reduces the burden on ISPs while offering the ability to
map a subscriber's inside IP address with an outside address and port
observed on the Internet.</t>
</section>
<section title="Deterministic NAT">
<t>While a subscriber uses thousands of connections per day, most
subscribers use far fewer at any given time. When the compression ratio
is low (i.e., the ratio of the number of subscribers to the number of
public IPv4 addresses allocated to a CGN is closer to 10:1 than 1000:1),
each subscriber could expect to have access to thousands of TCP/UDP
ports at any given time. Thus, as an alternative to logging each
connection, CGNs could deterministically map customer private addresses
on the inside of the CGN to public addresses on the outside of the CGN.
This algorithm will allow an operator to identify a subscriber internal
IP address when provided the public side IP and port number without
having to examine the CGN translation logs. This prevents an operator
from having to transport and store massive amounts of session data from
the CGN and then process it to identify a subscriber.</t>
<t>Deterministic NAT requires configuration of the following
variables:</t>
<t><list style="symbols">
<t>Inside IPv4/IPv6 address range (I);</t>
<t>Outside IPv4 address range (O);</t>
<t>Compression ratio (e.g. inside IP addresses I/outside IP
addresses O) (C);</t>
<t>Dynamic address pool factor (D), to be added to the compression
ratio in order to create an overflow address pool;</t>
<t>Maximum ports per user (M); and</t>
<t>Reserved TCP/UDP port list</t>
</list></t>
<t>Note: The inside address range (I) will be an IPv4 range in NAT444
operation (<xref target="I-D.shirasaki-nat444"></xref>) and an IPv6
range in DS-Lite operation (<xref target="RFC6333"></xref>).</t>
<t>The CGN then reserves ports as follows:</t>
<t><list style="numbers">
<t>The CGN removes reserved ports from the port candidate list (e.g.
1-1023 for TCP and UDP). At a minimum, the CGN SHOULD remove system
ports <xref target="I-D.ietf-tsvwg-iana-ports"></xref> from the port
candidate list reserved for deterministic assignment.</t>
<t>The CGN calculates the total compression ratio (C+D), and
allocates 1/(C+D) of the available ports to each internal IP
address. Any remaining ports are allocated to the dynamic pool. Port
allocation could be made sequentially (e.g. the first block goes to
address 1, the second block to address 2, etc.), staggered (e.g.
address 1 receives ports n*(C+D), address 2 receives ports
1+n*(C+D), etc.), or through some other deterministic algorithm left
to CGN implementation. Subscribers could be restricted to ports from
a single IPv4 address, or could be allocated ports across all
addresses in a pool, for example.</t>
<t>When a subscriber initiates a connection, the CGN creates a
translation mapping between the subscriber's inside local IP
address/port and the CGN outside global IP address/port. The CGN
MUST use one of the ports allocated in step 2 for the translation as
long as such ports are available. The CGN MUST use the preallocated
port range from step 2 for port control protocol <xref
target="I-D.ietf-pcp-base">(PCP)</xref> reservations as long as such
ports are available. While the CGN maintains its mapping table, it
need not generate a log entry for translation mappings created in
this step.</t>
<t>The CGN will have a pool of ports left for dynamic assignment. If
a subscriber uses more than the range of ports allocated in step 2
(but fewer than the configured maximum ports M), the CGN uses a port
from the dynamic assignment range for such a connection or for PCP
reservations. The CGN MUST log dynamically assigned ports to
facilitate subscriber-to-address mapping. The CGN SHOULD manage
dynamic ports as described in <xref
target="I-D.tsou-behave-natx4-log-reduction"> </xref>.</t>
<t>Configuration of reserved ports (e.g. system ports) is left to
operator configuration.</t>
</list></t>
<t>Thus, the CGN will maintain translation mapping information for all
connections within its internal translation tables; however, it only
needs to externally log translations for dynamically-assigned ports.</t>
<section title="Geo-location Considerations">
<t>As described in <xref target="RFC6269"></xref>, CGN implementation
can reduce the level of confidence and level of granularity of
geo-location information. However, the level of confidence in
geo-location data can be increased, even in a centralized CGN
deployment, by sub-dividing inside and outside ranges. If I and O are
subdivided such that I-1 corresponds to a particular headend or
central office (CO), and I-2 corresponds with another headend/CO,
etc., then geo-location data tied to address ranges O-1 and O-2, etc.
can be accurate down to the headend/CO level, approximately the same
level of granularity available in residential broadband services
without CGNs. This information can help content providers enforce
regional content licensing restrictions, target advertising to local
markets, and assist with emergency services provisioning.</t>
</section>
<section title="Deterministic NAT Example">
<t>To illustrate the use of deterministic NAT, let's consider a simple
example. The operator configures an inside address range (I) of
192.168.0.0/28 and outside address (O) of 203.0.113.1. The dynamic
buffer factor is set to '2'. Thus, the total compression ratio is
1:(14+2) = 1:16. Only the system ports (e.g. ports < 1024) are
reserved. This configuration causes the CGN to preallocate
((65536-1024)/16 =) 4032 TCP and 4032 UDP ports per inside IPv4
address. For the purposes of this example, let's assume that they are
allocated sequentially, where 192.168.0.1 maps to 203.0.113.1 ports
1024-5055, 192.168.0.2 maps to 203.0.113.1 ports 5056-9087, etc. The
dynamic port range thus contains ports 57472-65535. Finally, the
maximum ports/subscriber is set to 5040.</t>
<t>When subscriber 1 using 192.168.0.1 initiates a low volume of
connections (e.g. < 4032 concurrent connections), the CGN maps the
outgoing source address/port to the preallocated range. These
translation mappings are not logged.</t>
<t>Subscriber 2 concurrently uses more than the allocated 4032 ports
(e.g. for peer-to-peer, mapping, video streaming, or other
connection-intensive traffic types), the CGN allocates up to an
additional 1008 ports using bulk port reservations. In this example,
subscriber 2 uses outside ports 5056-9087, and then 100-port blocks
between 58000-58999. Connections using ports 5056-9087 are not logged,
while 10 log entries are created for ports 58000-58099, 58100-58199,
58200-58299, ..., 58900-58999.</t>
<t>If a law enforcement agency reports abuse from 203.0.113.1, port
2001, the operator can reverse the mapping algorithm to determine that
subscriber 1 generated the traffic without consulting logs. If a
second abuse report comes in for 203.0.113.1, port 58204, the operator
will determine that port 58204 is within the dynamic pool range,
consult the log file, and determine that subscriber 2 generated the
traffic (assuming that the law enforcement timestamp matches the
operator timestamp).</t>
<t>In this example, there are no log entries for the majority of
subscribers, who only use pre-allocated ports. Only minimal logging
would be needed for those few subscribers who exceed their
pre-allocated ports and obtain extra bulk port assignments from the
dynamic pool. Logging data for those users will include inside
address, outside address, outside port range, and timestamp.</t>
</section>
</section>
<section title="Additional Logging Considerations">
<t>In order to be able to identify a subscriber based on observed
external IPv4 address, port, and timestamp, an operator needs to know
how the CGN was configured with regards to internal and external IP
addresses, dynamic address pool factor, maximum ports per user, and
reserved port range at any given time. Therefore, the CGN MUST generate
a log message any time such variables are changed. Also, the CGN SHOULD
generate such a log message once per day to facilitate quick
identification of the relevant configuration in the event of an abuse
notification.</t>
<t>Such a log message MUST, at minimum, include the timestamp, inside
prefix I, inside mask, outside prefix O, outside mask, D, M, and
reserved port range; for example:</t>
<t>[Wed Oct 11 14:32:52
2000]:192.168.0.0:28:203.0.113.0:32:2:5040:1-1023,5004,5060.</t>
</section>
<section anchor="IANA" title="IANA Considerations">
<t>This document makes no request of IANA.</t>
<t></t>
</section>
<section anchor="Security" title="Security Considerations">
<t>The security considerations applicable to NAT operation for various
protocols as documented in, for example, <xref target="RFC4787">RFC
4787</xref> and <xref target="RFC5382">RFC 5382</xref> also apply to
this document.</t>
</section>
<section anchor="Acknowledgements" title="Acknowledgements">
<t>TBD</t>
</section>
</middle>
<back>
<references title="Normative References">
<?rfc include="reference.RFC.2119"?>
<?rfc include="reference.RFC.4787"?>
<?rfc include="reference.RFC.6269"?>
<?rfc include="reference.RFC.5382"?>
<?rfc include="reference.RFC.6264"?>
<?rfc include="reference.I-D.draft-ietf-pcp-base-13"?>
</references>
<references title="Informative References">
<?rfc include="reference.RFC.6333"?>
<?rfc include="reference.I-D.draft-ietf-tsvwg-iana-ports-10"?>
<?rfc include="reference.I-D.draft-shirasaki-nat444-04"?>
<?rfc include="reference.I-D.draft-tsou-behave-natx4-log-reduction-02"?>
</references>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-24 02:54:24 |