Subject: [IPFIX] Request new IPFIX information elements for NAT/FW

From: Paul Aitken <[email-masked]>
Date: Mon, 21 Aug 2006 15:01:36 +0100

Dear all,

We'd like to request the following new IPFIX IE's for NAT and FW:

Name:                natOrigInsideAddr
Description:         The original IPv4 inside address.
Group:               NAT
Abstract Data Type:  ipv4Address
Data Type Semantics: identifier
Units:               n/a

Name:                natTransInsideAddr
Description:         The translated IPv4 inside address.
Group:               NAT
Abstract Data Type:  ipv4Address
Data Type Semantics: identifier
Units:               n/a

Name:                natOrigOutsideAddr
Description:         The original IPv4 outside address.
Group:               NAT
Abstract Data Type:  ipv4Address
Data Type Semantics: identifier
Units:               n/a

Name:                natTransOutsideAddr
Description:         The translated IPv4 outside address.
Group:               NAT
Abstract Data Type:  ipv4Address
Data Type Semantics: identifier
Units:               n/a

- Also equivalent elements for IPv6 addresses, if deemed necessary.

Name:                natOrigInsidePort;
Description:         The original inside port.
Group:               NAT
Abstract Data Type:  unsigned16
Data Type Semantics: identifier
Units:               n/a

Name:                natTransInsidePort;
Description:         The translated inside port.
Group:               NAT
Abstract Data Type:  unsigned16
Data Type Semantics: identifier
Units:               n/a

- Alternatively, create just one of these and overload 
sourceTransportPort, clearly indicating whether this should be the 
original or translated port.

Name:                natOrigOutsidePort;
Description:         The original outside port.
Group:               NAT
Abstract Data Type:  unsigned16
Data Type Semantics: identifier
Units:               n/a

Name:                natTransOutsidePort;
Description:         The translated outside port.
Group:               NAT
Abstract Data Type:  unsigned16
Data Type Semantics: identifier
Units:               n/a

- Alternatively, create just one of these and overload 
destinationTransportPort, clearly indicating whether this should be the 
original or translated port.

Name:                natEvent
Description:         Indication of the NAT creation / deletion event.
Group:               NAT
Abstract Data Type:  unsigned16
Data Type Semantics: identifier
Units:               n/a

Name:                fwInitiatorOctets
Description:         No. of bytes sent by the initiator.
Group:               counter
Abstract Data Type:  unsigned64
Data Type Semantics: quantity
Units:               n/a

Name:                fwResponderOctets
Description:         No. of bytes sent by the responder.
Group:               counter
Abstract Data Type:  unsigned64
Data Type Semantics: quantity
Units:               n/a

- Also the corresponding delta counters, if deemed necessary.

Name:                fwEvent
Description:         Indication of the FW audit trail event.
Group:               firewall
Abstract Data Type:  unsigned8
Data Type Semantics: identifier
Units:               n/a

Thanks.

-- 
Paul Aitken
Cisco Systems Ltd, Edinburgh, Scotland.

_______________________________________________
IPFIX mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipfix