Revision as of 11:14, 9 October 2016

VPP NAT implementation

Introduction

The VPP SNAT is an implementation of NAT44. It is a plugin and is meant to replace the VCGN component. The target use case is a general IPv4 CPE NAT, a CGN and to act as a NAT44 in a Openstack deployment.

It is intended to be pluggable, in the sense that it should be possible to plug the NAT44 function together with the MAP-E IPv4 to IPv6 translator to create a MAP-E CE, likewise one can plug the NAT44 together with MAP-T to create a MAP-T CE or 464XLAT.

Features are tracked as they are developed in the following VPP-441.

Until code is upstreamed it is developed on gitub.

Requirements

• Scale to millions of bindings
• Performance goal of 10Mpps/core.
• Configurable address and port selection algorithm.
• User quotas for sessions.
• Thread safe
• Efficient port utilisation. Endpoint independent for applications requiring it, address and port filtering otherwise
• No ALGs
• Configurable IP address pooling behavour
• Plugable with MAP-E/T to create MAP-E/T CE, 464XLAT
• Stateful NAT64
• Support for NAT on a stick (single inside / outside interface)

Work list

API

add S-NAT plugin address range:

define snat_add_address_range {
 u32 client_index;
 u32 context;
 u8 is_ip4;
 u8 first_ip_address[16];
 u8 last_ip_address[16];
 u8 is_add;
};

dump S-NAT plugin addresses:

define snat_address_dump {
 u32 client_index;
 u32 context;
};

define snat_address_details {
 u32 context;
 u8 is_ip4;
 u8 ip_address[16];
};

enable/disable S-NAT feature on the interface:

define snat_interface_add_del_feature {
 u32 client_index;
 u32 context;
 u8 is_add;
 u8 is_inside;
 u32 sw_if_index;
};

add/del 1:1 NAT:

define snat_add_static_mapping {
 u32 client_index;
 u32 context;
 u8 is_add;
 u8 is_ip4;
 u8 addr_only;
 u8 local_ip_address[16];
 u8 external_ip_address[16];
 u16 local_port;
 u16 external_port;
 u32 vrf_id;
};

dump 1:1 NAT:

define snat_static_mapping_dump {
 u32 client_index;
 u32 context;
};

define snat_static_mapping_details {
 u32 context;
 u8 is_ip4;
 u8 addr_only;
 u8 local_ip_address[16];
 u8 external_ip_address[16];
 u16 local_port;
 u16 external_port;
 u32 vrf_id;
};

show S-NAT plugin config:

define snat_show_config {
 u32 client_index;
 u32 context;
};

define snat_show_config_reply {
 u32 context;
 i32 retval;
 u8 static_mapping_only;
 u8 static_mapping_connection_tracking;
 u32 translation_buckets;
 u32 translation_memory_size;
 u32 user_buckets;
 u32 user_memory_size;
 u32 max_translations_per_user;
 u32 outside_vrf_id;
 u32 inside_vrf_id;
};

CLI

set interface snat in <intfc> out <intfc> [del]
snat add addresses <ip4-range-start> [- <ip4-range-end>]
snat add static mapping local <ip4-addr> [<port>] external <ip4-addr> [<port>] [vrf <table-id>] [del]
show snat [detail|verbose]

Enable S-NAT feature example

To enable NAT feature with local network interface GigabitEthernet0/8/0 and external network interface GigabitEthernet0/a/0 use:

vpp# set interface snat in GigabitEthernet0/8/0 out GigabitEthernet0/a/0

1:1 NAT example

To create static mapping between local address 10.0.0.3 and external address 4.4.4.4 use:

vpp# snat add static mapping local 10.0.0.3 external 4.4.4.4

1:1 NAT with ports example

If not runnig "static mapping only" S-NAT plugin mode first use:

vpp# snat add address 4.4.4.4

To create static mapping between local host address 10.0.0.3 port 6303 and external address 4.4.4.4 port 3606 use:

vpp# snat add static mapping local 10.0.0.3 6303 external 4.4.4.4 3606

Startup config

translation hash buckets <n> - default 1024
translation hash memory <n> - default 128<<20
user hash buckets <n> - default 128
user hash memory <n> - default 64<<20
max translations per user <n> - default 100
outside VRF id <table-id> - default 0
inside VRF id <table-id> - default 0
static mapping only [connection tracking] - default dynamic traslations enabled

YANG model

References

• RFC2663 - NAT terminology and considerations
• RFC4787 - NAT requirements for UDP
• RFC5382 - NAT requirements for TCP
• RFC5508 - NAT requirements for ICMP
• RFC6888 - CGN requirements - qualify and plan dev sequence:
• RFC7422 - Deterministic address mapping
• draft-ietf-behave-ipfix-nat-logging - IPFIX Information Elements for logging NAT Events