12/14/00IETF 49 - Pyda Srisuresh1 Framework for interfacing with NAT Pyda Srisuresh

12/14/00IETF 49 - Pyda Srisuresh2 Objective Identify service-neutral resources within an intermediate device of interest to ext. agents Identify NAT service specific resources. Illustrate resource interface mechanism for NAT service through an API. Provide a framework for the development of one or more protocols by which external agents can interface with NAT.

12/14/00IETF 49 - Pyda Srisuresh3 Intermediate Devices Network Address Translator devices (NAT) Proxy Servers Security Gateways, Tunnel terminators Firewalls Server-load Balancers QOS enforcement devices Etc...

12/14/00IETF 49 - Pyda Srisuresh4 Data flow across NATs End-to-End Session Private network traffic Private Network Boundary ClientServer Internet traffic NAT Ext. Agent

12/14/00IETF 49 - Pyda Srisuresh5 Proxy traffic across NAT Device Proxy server Target server Proxy-client Aplication User’s view of Session Proxy Exchange Server’s view of Session NAT Router

12/14/00IETF 49 - Pyda Srisuresh6 Router-to-Router Tunnel data flow Router End-to-End Session Client Server Trusted Network Boundary Trusted Network Boundary Internet T u n n e l Ext. Agent

12/14/00IETF 49 - Pyda Srisuresh7 NAT Elements NAT Descriptor ID, Nat-Type, Address map and Type specific parameters. BIND Descriptor ID, Bind-Type, specific addresses (ports) bound, Lease time, Controlling Agent ID etc. SESSion Descriptor ID, Session Direction, Original and Translated session tuples, Application Tag, Controlling BIND- ID, Termination heuristic, Controlling agent ID etc.

12/14/00IETF 49 - Pyda Srisuresh8 External Agents Application Level Gateways (ALGs) Intermediate Application proxies RSIP (I.e., RSA-IP & RSAP-IP) clients. Backup-NAT devices Management utilities enforcing NAT policies

12/14/00IETF 49 - Pyda Srisuresh9 External Agent Descriptor Agent ID Agent Type Agent Call-back Requirements Agent Call-back functions Agent Accessibility Information

12/14/00IETF 49 - Pyda Srisuresh10 Interface to external agents Service-neutral interface to external agents Functions applicable to any type of stateful IP service on an intermediate device - NAT, firewall, Server-load balancers, Security Gateways etc. Resource interface based on session identities. Versatile interface to allow addressing a specific instance of a service on a device that supports multiple instances of a variety of services. Asynchronous Call-back from device to ext. agents. NAT-service specific interface Functions manipulating NAT specific resources. I.e., BINDs and NAT specific session parameters.

12/14/00IETF 49 - Pyda Srisuresh11 Service-neutral interface Query available services on device service_enquire_Identity(service_type, &service_info) Register agent with select services on device service_register_agent(service_id, &agent_info) Session based manipulation and enquiries service_set_sess(), service_free_sess(), service_enquire_sess_range() etc. Asynchronous call-back to ext. agents agent_callback_event(event_type, &event_info) agent_callback_periodic(info_type, length, &info) agent_callback_packet(sess_id, pkt_direction, packet)

12/14/00IETF 49 - Pyda Srisuresh12 NAT-Service specific interface NAT service Identity NAT service type (Basic NAT, NAPT, RSIP etc.) Address Maps, RSIP tunnel-type supported etc. NAT specific session parameters Translated session tuples, BIND ID, Pkt mod funcs NAT BIND manipulations and enquiries nat_set_bind(), nat_free_bind(), nat_enquire_address_bind() Asynchronous Callback Interface Packet redirection to external agents BIND notification, NAT specific statistics notification

12/14/00IETF 49 - Pyda Srisuresh13 FTP-ALG Registration process FTP-ALGNAT service_enquire_Identity() OK. Return NAT Descriptor that includes nat-id. service_register_agent(nat_id, &ftp_alg_descriptor) OK. Return an agent-ID.

12/14/00IETF 49 - Pyda Srisuresh14 ALG interaction when FTP is active FTP-ALGNAT ftp_alg_pkt_notify(nat_id, agent_id, sess_id, pkt_direction, pkt) service_enquire_sess_info(nat_id, agent_id, &sess_info) nat_enquire_address_bind(nat_id, agent_id, &bind_info) nat_set_bind(nat_id, agent_id, &bind_info) service_set_sess(nat_id, agent_id, &sess_info)

12/14/00IETF 49 - Pyda Srisuresh15 FTP session termination notification FTP-ALGNAT ftp_alg_notify(nat-id, agent-id, SESSION- TERMINATED, sess-id) service_free_sess_bundle(nat_id, agent-id, sess-id)