draft-ietf-dime-nat-control-05.txt		draft-ietf-dime-nat-control-06.txt
	Internet Engineering Task Force F. Brockners		Internet Engineering Task Force F. Brockners
	Internet-Draft S. Bhandari		Internet-Draft S. Bhandari
	Intended status: Standards Track Cisco		Intended status: Standards Track Cisco
	Expires: April 25, 2011 V. Singh		Expires: July 14, 2011 V. Singh
	Mavenir Systems
	V. Fajardo		V. Fajardo
	Telcordia Technologies		Telcordia Technologies
	October 22, 2010		January 10, 2011
	Diameter Network Address and Port Translation Control Application		Diameter Network Address and Port Translation Control Application
	draft-ietf-dime-nat-control-05		draft-ietf-dime-nat-control-06
	Abstract		Abstract
	This document describes the framework, messages, and procedures for		This document describes the framework, messages, and procedures for
	the Diameter Network address and port translation Control		the Diameter Network address and port translation Control
	Application. This Diameter application allows per endpoint control		Application. This Diameter application allows per endpoint control
	of Network Address Translators and Network Address and Port		of Network Address Translators and Network Address and Port
	Translators, which are added to cope with IPv4-address space		Translators, which are added to cope with IPv4-address space
	completion. This Diameter application allows external devices to		completion. This Diameter application allows external devices to
	configure and manage a Network Address Translator device - expanding		configure and manage a Network Address Translator device - expanding
	skipping to change at page 2, line 7		skipping to change at page 2, line 7
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at http://datatracker.ietf.org/drafts/current/.		Drafts is at http://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on April 25, 2011.		This Internet-Draft will expire on July 14, 2011.
	Copyright Notice		Copyright Notice
	Copyright (c) 2010 IETF Trust and the persons identified as the		Copyright (c) 2011 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(http://trustee.ietf.org/license-info) in effect on the date of		(http://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	carefully, as they describe your rights and restrictions with respect		carefully, as they describe your rights and restrictions with respect
	to this document. Code Components extracted from this document must		to this document. Code Components extracted from this document must
	include Simplified BSD License text as described in Section 4.e of		include Simplified BSD License text as described in Section 4.e of
	the Trust Legal Provisions and are provided without warranty as		the Trust Legal Provisions and are provided without warranty as
	skipping to change at page 4, line 12		skipping to change at page 4, line 12
	9.1. NAT Control Accounting Messages . . . . . . . . . . . . . 34		9.1. NAT Control Accounting Messages . . . . . . . . . . . . . 34
	9.2. NAT Control Accounting AVPs . . . . . . . . . . . . . . . 34		9.2. NAT Control Accounting AVPs . . . . . . . . . . . . . . . 34
	9.2.1. NAT-Control-Record . . . . . . . . . . . . . . . . . . 34		9.2.1. NAT-Control-Record . . . . . . . . . . . . . . . . . . 34
	9.2.2. NAT-Control-Binding-Status . . . . . . . . . . . . . . 34		9.2.2. NAT-Control-Binding-Status . . . . . . . . . . . . . . 34
	9.2.3. Current-NAT-Bindings . . . . . . . . . . . . . . . . . 35		9.2.3. Current-NAT-Bindings . . . . . . . . . . . . . . . . . 35
	10. AVP Occurrence Table . . . . . . . . . . . . . . . . . . . . . 35		10. AVP Occurrence Table . . . . . . . . . . . . . . . . . . . . . 35
	10.1. DNCA AVP Table for NAT Control Initial and Update		10.1. DNCA AVP Table for NAT Control Initial and Update
	Requests . . . . . . . . . . . . . . . . . . . . . . . . . 35		Requests . . . . . . . . . . . . . . . . . . . . . . . . . 35
	10.2. DNCA AVP Table for Session Query request . . . . . . . . . 36		10.2. DNCA AVP Table for Session Query request . . . . . . . . . 36
	10.3. DNCA AVP Table for Accounting Message . . . . . . . . . . 36		10.3. DNCA AVP Table for Accounting Message . . . . . . . . . . 36
	11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 37		11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 36
	11.1. Command Codes . . . . . . . . . . . . . . . . . . . . . . 37		11.1. Command Codes . . . . . . . . . . . . . . . . . . . . . . 37
	11.2. AVP Codes . . . . . . . . . . . . . . . . . . . . . . . . 37		11.2. AVP Codes . . . . . . . . . . . . . . . . . . . . . . . . 37
	11.3. AVP Values . . . . . . . . . . . . . . . . . . . . . . . . 38		11.3. AVP Values . . . . . . . . . . . . . . . . . . . . . . . . 37
	11.3.1. Result-Code AVP Values . . . . . . . . . . . . . . . . 38		11.3.1. Result-Code AVP Values . . . . . . . . . . . . . . . . 38
	11.4. Application IDs . . . . . . . . . . . . . . . . . . . . . 39		11.4. Application IDs . . . . . . . . . . . . . . . . . . . . . 38
	12. Security Considerations . . . . . . . . . . . . . . . . . . . 39		12. Security Considerations . . . . . . . . . . . . . . . . . . . 39
	13. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 39		13. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 39
	14. Change History (to be removed prior to publication as an		14. Change History (to be removed prior to publication as an
	RFC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40		RFC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
	15. References . . . . . . . . . . . . . . . . . . . . . . . . . . 41		15. References . . . . . . . . . . . . . . . . . . . . . . . . . . 40
	15.1. Normative References . . . . . . . . . . . . . . . . . . . 41		15.1. Normative References . . . . . . . . . . . . . . . . . . . 40
	15.2. Informative References . . . . . . . . . . . . . . . . . . 41		15.2. Informative References . . . . . . . . . . . . . . . . . . 41
	Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 42		Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 41
	1. Introduction		1. Introduction
	Internet service providers have started to deploy Network Address		Internet service providers have started to deploy Network Address
	Translators (NATs) and Network Address and Port Translators (NAPTs)		Translators (NATs) and Network Address and Port Translators (NAPTs)
	at the edge of their networks to deal with the depletion of available		at the edge of their networks to deal with the depletion of available
	public IPv4 addresses. This document defines a Diameter application		public IPv4 addresses. This document defines a Diameter application
	for providers deploying such NAT and NAPT devices. The use of a		for providers deploying such NAT and NAPT devices. The use of a
	Diameter application allows for simple integration into the existing		Diameter application allows for simple integration into the existing
	AAA environment of a provider.		Authentication, Authorization and Accounting (AAA) environment of a
			provider.
	The Diameter Network address and port translation Control Application		The Diameter Network address and port translation Control Application
	(DNCA) offers the following capabilities:		(DNCA) offers the following capabilities:
	1. Limits or defines the number of NAPT/NAT bindings made available		1. Limits or defines the number of NAPT/NAT bindings made available
	to an individual subscriber or end point.		to an individual subscriber or end point.
	2. Supports the allocation of specific NAPT/NAT bindings. Two types		2. Supports the allocation of specific NAPT/NAT bindings. Two types
	of specific bindings can be distinguished:		of specific bindings can be distinguished:
	skipping to change at page 6, line 8		skipping to change at page 6, line 8
	select external IP address in NAPT/NAT bindings for multiple		select external IP address in NAPT/NAT bindings for multiple
	subscribers.		subscribers.
	4. Generates reports and accounting records: Reports established		4. Generates reports and accounting records: Reports established
	bindings for a particular user. The collected information is		bindings for a particular user. The collected information is
	used by accounting systems for statistical purposes.		used by accounting systems for statistical purposes.
	5. Queries and retrieves details about bindings on demand: This		5. Queries and retrieves details about bindings on demand: This
	feature complements the previously mentioned accounting		feature complements the previously mentioned accounting
	functionality(see item 4). The query functionality complements		functionality(see item 4). The query functionality complements
	alternative information query mechanisms, such as SNMP-based		alternative information query mechanisms, such as Simple Network
	mechanism, if available.		Management Protocol (SNMP) based mechanisms, if available.
	6. Identifies a subscriber or endpoint on multiple network devices		6. Identifies a subscriber or endpoint on multiple network devices
	(NAPT or NAT device, the AAA-server, or the Network Access Server		(NAPT or NAT device, the AAA-server, or the Network Access Server
	(NAS)): Endpoint identification is facilitated through a Global		(NAS)): Endpoint identification is facilitated through a Global
	Endpoint ID. Endpoints are identified through a single or a set		Endpoint ID. Endpoints are identified through a single or a set
	of classifiers, such as IP address, VLAN identifier, or interface		of classifiers, such as IP address, Virtual Local Area Network
	identifier which uniquely identify the traffic associated with a		(VLAN) identifier, or interface identifier which uniquely
	particular global endpoint		identify the traffic associated with a particular global endpoint
	This document is structured as follows: Section 2 lists terminology,		This document is structured as follows: Section 2 lists terminology,
	while Section 3 provides an introduction to the DNCA and its overall		while Section 3 provides an introduction to the DNCA and its overall
	deployment framework. Sections 4 to 8 cover the DNCA specifics, with		deployment framework. Sections 4 to 8 cover the DNCA specifics, with
	Section 4 describing session management, Section 5 the use of the		Section 4 describing session management, Section 5 the use of the
	Diameter base protocol, Section 6 new commands, Section 7 AVPs used,		Diameter base protocol, Section 6 new commands, Section 7 AVPs used,
	and Section 8 accounting aspects. Section 9 presents an AVP		and Section 8 accounting aspects. Section 9 presents an AVP
	occurance table. IANA and security considerations are addressed in		occurance table. IANA and security considerations are addressed in
	Sections 10 and 11.		Sections 10 and 11.
	skipping to change at page 12, line 39		skipping to change at page 12, line 39
	Request-Type AVP set to INITIAL_REQUEST that identifies an already		Request-Type AVP set to INITIAL_REQUEST that identifies an already
	existing session; that is, DNCA Manager and endpoint identifier		existing session; that is, DNCA Manager and endpoint identifier
	match an already existing session, the DNCA Agent returns NCA with		match an already existing session, the DNCA Agent returns NCA with
	Result-Code set to SESSION_EXISTS, and provides the Session-Id of		Result-Code set to SESSION_EXISTS, and provides the Session-Id of
	the existing session in Duplicate-Session-Id AVP.		the existing session in Duplicate-Session-Id AVP.
	o If a DNCA Agent receives an NCR from a DNCA Manager with NC-		o If a DNCA Agent receives an NCR from a DNCA Manager with NC-
	Request-Type AVP set to INITIAL_REQUEST that matches more than one		Request-Type AVP set to INITIAL_REQUEST that matches more than one
	of the already existing sessions; that is, DNCA Manager and		of the already existing sessions; that is, DNCA Manager and
	endpoint identifier match already existing sessions, the DNCA		endpoint identifier match already existing sessions, the DNCA
	Agent returns a NCA with Result-Code set to Insufficient-		Agent returns a NCA with Result-Code set to INSUFFICIENT-
	Classifiers. In case a DNCA Manager receives NCA that reports		CLASSIFIERS. In case a DNCA Manager receives NCA that reports
	Insufficient-Classifiers, it may choose to retry establishing a		Insufficient-Classifiers, it may choose to retry establishing a
	new session using additional or more specific classifiers.		new session using additional and more specific classifiers.
	o If the NCR contains a binding rule not defined on the NAT device,		o If the NCR contains a binding rule not defined on the NAT device,
	the DNCA Agent returns NCA with Result-Code AVP set to		the DNCA Agent returns NCA with Result-Code AVP set to
	UNKNOWN_BINDING_RULE.		UNKNOWN_BINDING_RULE.
	o In case the DNCA Agent is unable to establish all of the bindings		o In case the DNCA Agent is unable to establish all of the bindings
	requested in the NCR, it will return a NCA with Result-Code set to		requested in the NCR, it will return a NCA with Result-Code set to
	BINDING_FAILURE. The DNCA Agent, that is NAT device, treats a NCR		BINDING_FAILURE. The DNCA Agent, that is NAT device, treats a NCR
	as an atomic operation; hence none of the requested bindings will		as an atomic operation; hence none of the requested bindings will
	be established by the NAT device. Either all requested actions		be established by the NAT device. Either all requested actions
	skipping to change at page 13, line 48		skipping to change at page 13, line 48
	Figure 5: Initial NAT Control request and session establishment		Figure 5: Initial NAT Control request and session establishment
	4.3. Session Re-Authorization		4.3. Session Re-Authorization
	Session re-authorization is performed if the DNCA Manager desires to		Session re-authorization is performed if the DNCA Manager desires to
	change the behavior of the NAT for an existing session. Re-		change the behavior of the NAT for an existing session. Re-
	authorization could be used, for example, to change the number of		authorization could be used, for example, to change the number of
	allowed bindings for a particular session, or establish or remove a		allowed bindings for a particular session, or establish or remove a
	pre-defined binding.		pre-defined binding.
	The DNCA Manager generates a NC message to the DNCA Agent with NC-		The DNCA Manager generates a NCR message to the DNCA Agent with NC-
	Request-Type AVP set to UPDATE_REQUEST upon receiving a trigger		Request-Type AVP set to UPDATE_REQUEST upon receiving a trigger
	signal. In case the session is updated successfully, the DNCA Agent		signal. In case the session is updated successfully, the DNCA Agent
	notifies the DNCA Manager about successful session update using a		notifies the DNCA Manager about successful session update using a
	NAT-Control Answer (NCA) message with Result-Code set to		NAT-Control Answer (NCA) message with Result-Code set to
	DIAMETER_SUCCESS. Figure 6 shows the protocol interaction between		DIAMETER_SUCCESS. Figure 6 shows the protocol interaction between
	the DNCA Manager and the DNCA Agent.		the DNCA Manager and the DNCA Agent.
	In certain cases, the DNCA Agent may not be able to perfborm the		In certain cases, the DNCA Agent may not be able to perfborm the
	tasks requested within the NCR. These include the following:		tasks requested within the NCR. These include the following:
	skipping to change at page 14, line 30		skipping to change at page 14, line 30
	the maximum number of allowed bindings has been reached for the		the maximum number of allowed bindings has been reached for the
	Endpoint Classifier, it returns NCA with Result-Code AVP set to		Endpoint Classifier, it returns NCA with Result-Code AVP set to
	MAXIMUM_BINDINGS_REACHED_FOR_ENDPOINT.		MAXIMUM_BINDINGS_REACHED_FOR_ENDPOINT.
	o If the DNCA Agent cannot establish some or all of the bindings		o If the DNCA Agent cannot establish some or all of the bindings
	requested in a NCR, but has not yet reached the maximum number of		requested in a NCR, but has not yet reached the maximum number of
	allowed bindings for the subscriber, it returns a NCA with Result-		allowed bindings for the subscriber, it returns a NCA with Result-
	Code set to BINDING_FAILURE. The DNCA Agent (i.e., NAT device)		Code set to BINDING_FAILURE. The DNCA Agent (i.e., NAT device)
	treats a NCR as an atomic operation. Hence none of the requested		treats a NCR as an atomic operation. Hence none of the requested
	bindings will be established by NAT device. Either all requested		bindings will be established by NAT device. Either all requested
	actions within a NCR are either successful or failed completely..		actions within a NCR are either successful or failed completely.
	o If DNCA Agent does not have sufficient resources to process a		o If DNCA Agent does not have sufficient resources to process a
	request, it returns NCA with Result-Code set to RESOURCE_FAILURE.		request, it returns NCA with Result-Code set to RESOURCE_FAILURE.
	o If a NCR redefines the maximum number of NAT bindings allowed for		o If a NCR redefines the maximum number of NAT bindings allowed for
	the endpoint, the new value will override any previously defined		the endpoint, the new value will override any previously defined
	limit on NAT bindings. It depends on the implementation of the		limit on NAT bindings. It depends on the implementation of the
	NAT device on how the NAT device copes with a case where the new		NAT device on how the NAT device copes with a case where the new
	value is lower than the actual number of allocated bindings.		value is lower than the actual number of allocated bindings.
	Typically the NAT device refrains from enforcing the new limit		Typically the NAT device refrains from enforcing the new limit
	skipping to change at page 16, line 20		skipping to change at page 16, line 20
	case the NCR MUST NOT contain a NAT-Control-Definition AVP. Each		case the NCR MUST NOT contain a NAT-Control-Definition AVP. Each
	NAT binding is reported in a NAT-Control-Definition AVP. In case		NAT binding is reported in a NAT-Control-Definition AVP. In case
	the session ID is unknown, the DNCA Agent returns NCA with		the session ID is unknown, the DNCA Agent returns NCA with
	Result-Code set to DIAMETER_UNKNOWN_SESSION_ID.		Result-Code set to DIAMETER_UNKNOWN_SESSION_ID.
	2. Retrieve session IDs and internal IP address/port pairs for one		2. Retrieve session IDs and internal IP address/port pairs for one
	or multiple external IP address/port pairs: If the DNCA Manager		or multiple external IP address/port pairs: If the DNCA Manager
	wishes to retrieve the session ID(s) for one or multiple external		wishes to retrieve the session ID(s) for one or multiple external
	IP address/port pairs, it MUST include the external IP address/		IP address/port pairs, it MUST include the external IP address/
	port pair(s) as part of the NAT-Control-Definition AVP of the		port pair(s) as part of the NAT-Control-Definition AVP of the
	NCR. The session ID used within the NCR is not meaningful for		NCR. The session ID is not included in the NCR or the NCA for
	this type of a query. The DNCA Agent reports the NAT bindings		this type of a query. The DNCA Agent reports the NAT bindings
	and associated session IDs corresponding to the external IP		and associated session IDs corresponding to the external IP
	address/port pairs in a NCA message with Result-Code set to		address/port pairs in a NCA message with Result-Code set to
	DIAMETER_SUCCESS with the same session ID, which is used in NCR.		DIAMETER_SUCCESS with the same session ID, which is used in NCR.
	In case an external IP address/port pair has no associated		In case an external IP address/port pair has no associated
	existing NAT binding, the NAT-Control-Definition AVP contained in		existing NAT binding, the NAT-Control-Definition AVP contained in
	the reply just contains the NAT-External-Address AVP.		the reply just contains the NAT-External-Address AVP.
	DNCA Manager DNCA Agent		DNCA Manager DNCA Agent
	| |		| |
	skipping to change at page 18, line 20		skipping to change at page 18, line 20
	DNCA relies on DNCA Manager and DNCA Agent to have builtin redundancy		DNCA relies on DNCA Manager and DNCA Agent to have builtin redundancy
	support to recover state in case of failure.		support to recover state in case of failure.
	Example failure cases include the following:		Example failure cases include the following:
	o The DNCA Manager loses session state (e.g. due to a restart). In		o The DNCA Manager loses session state (e.g. due to a restart). In
	this case,		this case,
	* The DNCA Agent may receive a NCR with NC-Request-Type AVP set		* The DNCA Agent may receive a NCR with NC-Request-Type AVP set
	to INITIAL_REQUEST that matches an existing session of DNCA		to INITIAL_REQUEST that matches an existing session of DNCA
	agent. The DNCA Agent returns an error that contains		agent. The DNCA Agent returns a Result-Code that contains
	Duplicate-Session-Id AVP to report the Session-ID of existing		Duplicate-Session-Id AVP to report the Session-ID of existing
	session. The DNCA Manager may send an explicit Sesstion		session. The DNCA Manager may send an explicit Sesstion
	Terminate Request(STR) for the older session, which was lost.		Terminate Request (STR) for the older session, which was lost.
	* The DNCA Manager may receive accounting records for a session		* The DNCA Manager may receive accounting records for a session
	that does not exist. The DNCA Manager sends an accounting		that does not exist. The DNCA Manager sends an accounting
	answer with Result-Code set to DIAMETER_UNKNOWN_SESSION_ID. On		answer with Result-Code set to DIAMETER_UNKNOWN_SESSION_ID. On
	receiving this, the DNCA Agent clears the session and removes		receiving this, the DNCA Agent clears the session and removes
	the associated session state.		the associated session state.
	o The DNCA Agent loses session state. In such a case, the DNCA		o The DNCA Agent loses session state. In such a case, the DNCA
	Agent may receive a NCR with NC-Request-Type AVP set to		Agent may receive a NCR with NC-Request-Type AVP set to
	UPDATE_REQUEST for a non-existent session. The DNCA Agent returns		UPDATE_REQUEST for a non-existent session. The DNCA Agent returns
	skipping to change at page 19, line 7		skipping to change at page 19, line 7
	offering of the service provider. The service provider can choose		offering of the service provider. The service provider can choose
	to terminate the access session to the endpoint.		to terminate the access session to the endpoint.
	5. Use Of The Diameter Base Protocol		5. Use Of The Diameter Base Protocol
	The Diameter Base Protocol defined by [RFC3588] applies with the		The Diameter Base Protocol defined by [RFC3588] applies with the
	clarifications listed in the present specification.		clarifications listed in the present specification.
	5.1. Securing Diameter Messages		5.1. Securing Diameter Messages
	For secure transport of Diameter messages, IPsec MAY be used.		For secure transport of Diameter messages recommendations in
			[RFC3588] apply.
	The DNCA Agent MAY verify the identity of the DNCA Manager during the		The DNCA Agent MAY verify the identity of the DNCA Manager during the
	Capabilities Exchange Request procedure.		Capabilities Exchange Request procedure.
	The DNCA Agent MAY verify if the DNCA Manager that issues a NCR		The DNCA Agent MAY verify if the DNCA Manager that issues a NCR
	command is allowed and it is based on:		command is allowed and it is based on:
	o The identity of the DNCA Manager		o The identity of the DNCA Manager
	o The type of NCR Command		o The type of NCR Command
	skipping to change at page 21, line 6		skipping to change at page 21, line 6
	bindings.		bindings.
	User-Name, Logical-Access-Id, Physical-Access-ID, Framed-IP-Address,		User-Name, Logical-Access-Id, Physical-Access-ID, Framed-IP-Address,
	Framed-IPv6-Prefix , Framed-Interface-Id, EGRESS-VLANID, NAS-Port-ID,		Framed-IPv6-Prefix , Framed-Interface-Id, EGRESS-VLANID, NAS-Port-ID,
	Address-Realm, Calling-Station-ID AVPs serve as identifiers for the		Address-Realm, Calling-Station-ID AVPs serve as identifiers for the
	subscriber.		subscriber.
	Message Format:		Message Format:
	< NC-Request > ::= < Diameter Header: TBD, REQ, PXY>		< NC-Request > ::= < Diameter Header: TBD, REQ, PXY>
			[ Session-Id ]
	< Session-Id >
	{ Auth-Application-Id }		{ Auth-Application-Id }
	{ Origin-Host }		{ Origin-Host }
	{ Origin-Realm }		{ Origin-Realm }
	{ Destination-Realm }		{ Destination-Realm }
	{ Destination-Host }		{ Destination-Host }
	{ NC-Request-Type }		{ NC-Request-Type }
	[ Origin-State-Id ]		[ Origin-State-Id ]
	* [ NAT-Control-Remove ]		*1 [ NAT-Control-Remove ]
	* [ NAT-Control-Install ]		*1 [ NAT-Control-Install ]
	[ User-Name ]		[ User-Name ]
	[ Logical-Access-Id ]		[ Logical-Access-Id ]
	[ Physical-Access-ID ]		[ Physical-Access-ID ]
	[ Framed-IP-Address ]		[ Framed-IP-Address ]
	[ Framed-IPv6-Prefix ]		[ Framed-IPv6-Prefix ]
	[ Framed-Interface-Id ]		[ Framed-Interface-Id ]
	[ EGRESS-VLANID]		[ EGRESS-VLANID]
	[ NAS-Port-ID]		[ NAS-Port-ID]
	[ Address-Realm ]		[ Address-Realm ]
	[ Calling-Station-ID ]		[ Calling-Station-ID ]
	skipping to change at page 22, line 6		skipping to change at page 22, line 6
	6.2. NAT-Control Answer (NCA) Command		6.2. NAT-Control Answer (NCA) Command
	The NAT-Control-Answer (NCA) command, indicated by the Command-Code		The NAT-Control-Answer (NCA) command, indicated by the Command-Code
	field set to TBD and the "R" bit cleared in the Command Flags field,		field set to TBD and the "R" bit cleared in the Command Flags field,
	is sent by the DNCA Agent in response to NAT-Control-Request command.		is sent by the DNCA Agent in response to NAT-Control-Request command.
	Message Format:		Message Format:
	<NC-Answer> ::= < Diameter Header: TBD, PXY >		<NC-Answer> ::= < Diameter Header: TBD, PXY >
	< Session-Id >		[ Session-Id ]
	{ Origin-Host }		{ Origin-Host }
	{ Origin-Realm }		{ Origin-Realm }
	{ NC-Request-Type }		{ NC-Request-Type }
	[ Result-Code ]		[ Result-Code ]
	* [ NAT-Control-Definition ]		* [ NAT-Control-Definition ]
	[ Current-NAT-Bindings ]		[ Current-NAT-Bindings ]
	[ Origin-State-Id ]		[ Origin-State-Id ]
	[ Error-Message ]		[ Error-Message ]
	[ Error-Reporting-Host ]		[ Error-Reporting-Host ]
	* [ Failed-AVP ]		* [ Failed-AVP ]
	skipping to change at page 27, line 46		skipping to change at page 27, line 46
	The DNCA Agent denies the request because the maximum number of		The DNCA Agent denies the request because the maximum number of
	allowed bindings has been reached for the specified Endpoint		allowed bindings has been reached for the specified Endpoint
	Classifier.		Classifier.
	SESSION_EXISTS (TBD)		SESSION_EXISTS (TBD)
	The DNCA Agent denies request to initialize a new session, if		The DNCA Agent denies request to initialize a new session, if
	it already has a DNCA session that uses the same set of		it already has a DNCA session that uses the same set of
	classifiers as indicated by DNCA Manager in the new session		classifiers as indicated by DNCA Manager in the new session
	initializationrequest.		initialization request.
	INSUFFICIENT_CLASSIFIERS (TBD)		INSUFFICIENT_CLASSIFIERS (TBD)
	The DNCA Agent defines request to initialize a new session, if		The DNCA Agent defines request to initialize a new session, if
	the classifiers in the request match more than one of the		the classifiers in the request match more than one of the
	existing sessions on DNCA Agent.		existing sessions on DNCA Agent.
	8.3. Reused NASREQ Diameter Application AVPs		8.3. Reused NASREQ Diameter Application AVPs
	The following AVPs are reused from Diameter Network Access Server		The following AVPs are reused from Diameter Network Access Server
	skipping to change at page 36, line 14		skipping to change at page 36, line 14
	+-------------------+		+-------------------+
	| Command Code |		| Command Code |
	+-----------------------------------+-------------------+		+-----------------------------------+-------------------+
	| Attribute Name NCR NCA |		| Attribute Name NCR NCA |
	+-------------------------------------------------------+		+-------------------------------------------------------+
	|NC-Request-Type 1 1 |		|NC-Request-Type 1 1 |
	|NAT-Control-Install 0-1 0 |		|NAT-Control-Install 0-1 0 |
	|NAT-Control-Remove 0-1 0 |		|NAT-Control-Remove 0-1 0 |
	|NAT-Control-Definition 0 0 |		|NAT-Control-Definition 0 0 |
	|NAT-Control-Record 0 0 |
	|Current-NAT-Bindings 0 0 |		|Current-NAT-Bindings 0 0 |
	|Duplicate-Session-Id 0 0-1 |		|Duplicate-Session-Id 0 0-1 |
	+-------------------------------------------------------+		+-------------------------------------------------------+
	10.2. DNCA AVP Table for Session Query request		10.2. DNCA AVP Table for Session Query request
	The following table lists the DNCA specific AVPs that have to be		The following table lists the DNCA specific AVPs that have to be
	present in NCR and NCA with NC-Request-Type set to QUERY_REQUEST.		present in NCR and NCA with NC-Request-Type set to QUERY_REQUEST.
	+-------------------+		+-------------------+
	| Command Code |		| Command Code |
	+-----------------------------------+-------------------+		+-----------------------------------+-------------------+
	| Attribute Name NCR NCA |		| Attribute Name NCR NCA |
	+-------------------------------------------------------+		+-------------------------------------------------------+
	|NC-Request-Type 1 1 |		|NC-Request-Type 1 1 |
	|NAT-Control-Install 0 0 |		|NAT-Control-Install 0 0 |
	|NAT-Control-Remove 0 0 |		|NAT-Control-Remove 0 0 |
	|NAT-Control-Definition 0 0+ |		|NAT-Control-Definition 0 0+ |
	|NAT-Control-Record 0 0 |
	|Current-NAT-Bindings 0 1 |		|Current-NAT-Bindings 0 1 |
	|Duplicate-Session-Id 0 0 |		|Duplicate-Session-Id 0 0 |
	+-------------------------------------------------------+		+-------------------------------------------------------+
	10.3. DNCA AVP Table for Accounting Message		10.3. DNCA AVP Table for Accounting Message
	The following table lists the DNCA specific AVPs, which may or may		The following table lists the DNCA specific AVPs, which may or may
	not be present in ACR and ACA messages.		not be present in ACR and ACA messages.
	+-------------------+		+-------------------+
	| Command Code |		| Command Code |
	+-----------------------------------+-------------------+		+-----------------------------------+-------------------+
	| Attribute Name ACR ACA |		| Attribute Name ACR ACA |
	+-------------------------------------------------------+		+-------------------------------------------------------+
	|NC-Request-Type 0 0 |
	|NAT-Control-Install 0 0 |
	|NAT-Control-Remove 0 0 |
	|NAT-Control-Definition 0 0 |
	|NAT-Control-Record 0+ 0 |		|NAT-Control-Record 0+ 0 |
	|Current-NAT-Bindings 1 0 |		|Current-NAT-Bindings 1 0 |
	|Duplicate-Session-Id 0 0 |
	+-------------------------------------------------------+		+-------------------------------------------------------+
	11. IANA Considerations		11. IANA Considerations
	This section contains the namespaces that have either been created in		This section contains the namespaces that have either been created in
	this specification or had their values assigned to existing		this specification or had their values assigned to existing
	namespaces managed by IANA.		namespaces managed by IANA.
	11.1. Command Codes		11.1. Command Codes
	IANA is requested to allocate command code values for the following.		IANA is requested to allocate command code values for the following.
	Registry:		Registry:
	+----------------+---------------------------+-------------+		+------------+-----------------------------------+------------------+
	| Code Value | Name | Reference |		| Code Value | Name | Reference |
	+----------------+---------------------------+-------------+		+------------+-----------------------------------+------------------+
	| to be assigned | NAT-Control-Request (NCR) | Section 6.1 |		| to be | NAT-Control-Request (NCR), | Section 6.1, |
	| to be assigned | NAT-Control-Answer (NCA) | Section 6.2 |		| assigned | NAT-Control-Answer (NCA) | Section 6.2 |
	+----------------+---------------------------+-------------+		+------------+-----------------------------------+------------------+
	Table 1: Command codes		Table 1: Command codes
	11.2. AVP Codes		11.2. AVP Codes
	IANA is requested to allocate AVP codes for the following AVPs that		IANA is requested to allocate AVP codes for the following AVPs that
	are defined in this document.		are defined in this document.
	Registry:		Registry:
	skipping to change at page 39, line 28		skipping to change at page 39, line 7
	+----------------+----------------------------------+-----------+		+----------------+----------------------------------+-----------+
	| ID Value | Name | Reference |		| ID Value | Name | Reference |
	+----------------+----------------------------------+-----------+		+----------------+----------------------------------+-----------+
	| to be assigned | Diameter NAT Control Application | Section 4 |		| to be assigned | Diameter NAT Control Application | Section 4 |
	+----------------+----------------------------------+-----------+		+----------------+----------------------------------+-----------+
	Table 4: Diameter Application ID values		Table 4: Diameter Application ID values
	12. Security Considerations		12. Security Considerations
	Similar to the impact of Diameter QoS application (see		Similar to the impact of Diameter QoS application (see [RFC5866]) on
	[I-D.ietf-dime-diameter-qos]) on authorization of QoS reservations,		authorization of QoS reservations, this document describes procedures
	this document describes procedures for authorizing NAT related		for authorizing NAT related attributes and parameters by an entity,
	attributes and parameters by an entity, which is non-local to the		which is non-local to the device performing NAT. The security
	device performing NAT. The security considerations for the Diameter		considerations for the Diameter QoS application (see [RFC5866]
	QoS application (see [I-D.ietf-dime-diameter-qos] section 11) apply		section 11) apply in a similar way to the DNCA. Securing the
	in a similar way to the DNCA. Securing the information exchange		information exchange between the authorizing entity (the DNCA
	between the authorizing entity (the DNCA Manager) and the NAT device		Manager) and the NAT device requires bilateral authentication of the
	requires bilateral authentication of the involved parties,		involved parties, authorization of the involved parties to perform
	authorization of the involved parties to perform the required		the required procedures and functions, and procedures to ensure
	procedures and functions, and procedures to ensure integrity and		integrity and confidentiality of the information exchange. The DNCA
	confidentiality of the information exchange. The DNCA makes use of		makes use of the capabilities offered by Diameter and the underlying
	the capabilities offered by Diameter and the underlying transport		transport protocols to deliver these requirements (see Section 5.1 ).
	protocols to deliver these requirements (see Section 5.1 ).
	It is assumed that the DNCA Agent and DNCA Manager are in the same		It is assumed that the DNCA Agent and DNCA Manager are in the same
	domain and have a mutual trust set up. Authorization between the		domain and have a mutual trust set up. Authorization between the
	DNCA Agent and DNCA Manager is beyond the scope of this document.		DNCA Agent and DNCA Manager is beyond the scope of this document.
	13. Acknowledgements		13. Acknowledgements
	The authors would like to thank Jouni Korhonen, Avi Lior, Chris Metz,		The authors would like to thank Jouni Korhonen, Avi Lior, Chris Metz,
	Hannes Tschofenig, Greg Weber, and Glen Zorn for their input on this		Hannes Tschofenig, Greg Weber, and Glen Zorn for their input on this
	document.		document.
	skipping to change at page 41, line 4		skipping to change at page 40, line 27
	b. Removed NCR Request type terminate and replaced with STR		b. Removed NCR Request type terminate and replaced with STR
	c. All references to Auth-Session-State are removed and a new		c. All references to Auth-Session-State are removed and a new
	section to describe FSM for Manager and Agent has been added		section to describe FSM for Manager and Agent has been added
	d. Clarified reuse of External address and address pools among		d. Clarified reuse of External address and address pools among
	multiple subscribers		multiple subscribers
	Changes from -04 to -05		Changes from -04 to -05
	a. Removed references to Large Scale NAT as per review comments		a. Removed references to Large Scale NAT as per review comments
			Changes from -05 to -06
			a. Editorial changes
	15. References		15. References
	15.1. Normative References		15.1. Normative References
	[ETSIES283034]		[ETSIES283034]
	ETSI, "Telecommunications and Internet Converged Services		ETSI, "Telecommunications and Internet Converged Services
	and Protocols for Advanced Networks (TISPAN),Network		and Protocols for Advanced Networks (TISPAN),Network
	Attachment Sub-System (NASS),e4 interface based on the		Attachment Sub-System (NASS),e4 interface based on the
	Diameter protocol.", September 2008.		Diameter protocol.", September 2008.
	skipping to change at page 41, line 33		skipping to change at page 41, line 14
	for Virtual LAN and Priority Support", RFC 4675,		for Virtual LAN and Priority Support", RFC 4675,
	September 2006.		September 2006.
	[RFC5777] Korhonen, J., Tschofenig, H., Arumaithurai, M., Jones, M.,		[RFC5777] Korhonen, J., Tschofenig, H., Arumaithurai, M., Jones, M.,
	and A. Lior, "Traffic Classification and Quality of		and A. Lior, "Traffic Classification and Quality of
	Service (QoS) Attributes for Diameter", RFC 5777,		Service (QoS) Attributes for Diameter", RFC 5777,
	February 2010.		February 2010.
	15.2. Informative References		15.2. Informative References
	[I-D.ietf-dime-diameter-qos]
	Sun, D., McCann, P., Tschofenig, H., ZOU), T., Doria, A.,
	and G. Zorn, "Diameter Quality of Service Application",
	draft-ietf-dime-diameter-qos-14 (work in progress),
	February 2010.
	[RFC4005] Calhoun, P., Zorn, G., Spence, D., and D. Mitton,		[RFC4005] Calhoun, P., Zorn, G., Spence, D., and D. Mitton,
	"Diameter Network Access Server Application", RFC 4005,		"Diameter Network Access Server Application", RFC 4005,
	August 2005.		August 2005.
	[TS32299] "3rd Generation Partnership Project; Technical		[RFC5866] Sun, D., McCann, P., Tschofenig, H., Tsou, T., Doria, A.,
	Specification Group Service and System Aspects;		and G. Zorn, "Diameter Quality-of-Service Application",
	Telecommunication management; Charging management;		RFC 5866, May 2010.
	"Diameter charging applications", 3GPP TS 32.299 Version
	6.3.0.2", 2008.
	Authors' Addresses		Authors' Addresses
	Frank Brockners		Frank Brockners
	Cisco		Cisco
	Hansaallee 249, 3rd Floor		Hansaallee 249, 3rd Floor
	DUESSELDORF, NORDRHEIN-WESTFALEN 40549		DUESSELDORF, NORDRHEIN-WESTFALEN 40549
	Germany		Germany
	Email: fbrockne@cisco.com		Email: fbrockne@cisco.com
	Shwetha Bhandari		Shwetha Bhandari
	Cisco		Cisco
	Cessna Business Park, Sarjapura Marathalli Outer Ring Road		Cessna Business Park, Sarjapura Marathalli Outer Ring Road
	Bangalore, KARNATAKA 560 087		Bangalore, KARNATAKA 560 087
	India		India
	Email: shwethab@cisco.com		Email: shwethab@cisco.com
	Vaneeta Singh		Vaneeta Singh
	Mavenir Systems		18, Cambridge Road
	Sharda Towers, 56/13 Nandidurga Road		Bangalore 560008
	Bangalore 560046
	India		India
	Email: vaneeta@mavenir.com		Email: vaneeta.singh@gmail.com
	Victor Fajardo		Victor Fajardo
	Telcordia Technologies		Telcordia Technologies
	1 Telcordia Drive #1S-222		1 Telcordia Drive #1S-222
	Piscataway, NJ 08854		Piscataway, NJ 08854
	USA		USA
	Email: vf0213@gmail.com		Email: vf0213@gmail.com
End of changes. 38 change blocks.
	78 lines changed or deleted		65 lines changed or added
This html diff was produced by rfcdiff 1.40. The latest version is available from http://tools.ietf.org/tools/rfcdiff/