netgate-nat.yang

module netgate-nat {

    yang-version 1.1;

    namespace "urn:netgate:xml:yang:netgate-nat";
    prefix "ngnat";

    import ietf-inet-types {
	prefix "inet";
    }

    import netgate-cli-extensions {
	prefix "ngcliext";
    }

    import netgate-common {
	prefix "ngcom";
    }

    organization "Netgate";

    contact "Web: <http://www.netgate.com>";

    description
	"This YANG module provides a Netgate-defined data-model
	 for Network Address Translation data.

	 Copyright 2017-2020 Rubicon Communications, LLC.";

    revision 2022-06-15 {
	description
	    "TNSR Release 22.06.";
    }

    revision 2021-11-15 {
	description
	    "TNSR Release 21.11.";
    }

    revision 2021-06-15 {
	description
	    "TNSR Release 21.07.";
    }

    revision 2021-02-15 {
	description
	    "TNSR Release 21.02.";
    }

    revision 2020-10-15 {
	description
	    "TNSR Release 20.10.";
    }

    revision 2020-06-15 {
	description
	    "TNSR Release 20.06.";
    }

    revision 2020-02-15 {
	description
	    "TNSR Release 20.02.";
    }

    revision 2019-08-30 {
	description
	    "TNSR Release 19.08.";
    }

    revision 2019-05-30 {
	description
	    "TNSR Release 19.05.";
    }

    revision 2019-02-15 {
	description
	    "TNSR Release 19.02.";
    }

    revision 2017-01-20 {
	description
	    "Initial revision.";
    }

    typedef nat-side {
	type enumeration {
	    enum none {
		description "no NAT";
	    }
	    enum inside {
		description "inside interface";
	    }
	    enum outside {
		description "outside interface";
	    }
	    /*
	    enum both {
		description "inside/outside interface";
	    }
	    */
	}
    }

    typedef nat-ipv4-protocol {
	type enumeration {
	    enum icmp {
		description
		    "ICMP";
	    }

	    enum udp {
		description
		    "UDP";
	    }

	    enum tcp {
		description
		    "TCP";
	    }
	}
    }

    typedef nat-ipv4-protocol-any {
	type enumeration {
	    enum icmp {
		description
		    "ICMP";
	    }

	    enum udp {
		description
		    "UDP";
	    }

	    enum tcp {
		description
		    "TCP";
	    }
	    enum any {
		description
		    "any wildcard";
	    }
	}
	description
	    "Wildcard protocol or 'any'.";
    }

    typedef nat-ipv4-port-any {
	type union {
	    type uint16;
	    type string {
	        pattern 'any';
	    }

	}
	description
	    "Wildcard any port";
    }


    container "nat-config" {
	description
	    "Network Address Translation (NAT) data needed to support VPP.";

	ngcliext:context "nat-everything-else";
	ngcliext:parent-fmt "nat";

	container global-options {
	    description
		"NAT global options";

	    ngcliext:context "nat-global-options";
	    ngcliext:parent-fmt "nat $%";

	    container nat44 {
		description
		    "NAT44 options";

		ngcliext:parent-fmt "$< $%";

		leaf max-users-per-thread {
		    type uint32 {
			range "1..4294967295";
		    }
		    description
			"Maximum number of users per thread.";
		    ngcliext:node-fmt "$< $% @@$n";
		}

		leaf max-translations-per-thread {
		    type uint32 {
			range "1..4294967295";
		    }
		    default 128000;
		    description
			"Maximum number of sessions per thread.";
		    ngcliext:node-fmt "$< $% @@$n";
		}

		leaf max-translations-per-user {
		    type uint32 {
			range "1..4294967295";
		    }
		    description
			"Maximum number of sessions per user.";
		    ngcliext:node-fmt "$< $% @@$n";
		}

		leaf endpoint-dependent {
		    type boolean;
		    description
			"If 'true', endpoint-dependent mode is enabled.";
		    ngcliext:node-fmt "$< $% @@$n";
		}

		leaf static-mapping-only {
		    type boolean;
		    description
			"If 'true', static mapping only is enabled.";
		    ngcliext:node-fmt "$< $% @@$n";
		}

		leaf out2in-dpo {
		    type boolean;
		    description
			"If 'true', out2in DPO is enabled.";
		    ngcliext:node-fmt "$< $% @@$n";
		}

		leaf forwarding-enabled {
		    type boolean;
		    description
			"NAT44 forwarding option. Used 'true' or 'false'.";
		    ngcliext:node-fmt "$< forwarding @@$n";
		}

		leaf enabled {
		    type boolean;
		    default false;
		    description
			"If 'true', NAT44 is enabled.";
		    ngcliext:node-fmt "$< $% @@$n";
		}
	    }

	    container timeouts {
		description
		    "NAT global timeouts";

		ngcliext:parent-fmt "$< $%";

		leaf udp {
		    type uint32;
		    description
			"NAT UDP idle-timeout";
		    ngcliext:node-fmt "$< $% @@$n";
		}

		leaf tcp_established {
		    type uint32;
		    description
			"NAT TCP established connection idle-timeout";
		    ngcliext:node-fmt "$< $% @@$n";
		}

		leaf tcp_transitory {
		    type uint32;
		    description
			"NAT TCP transitory connection idle-timeout";
		    ngcliext:node-fmt "$< $% @@$n";
		}

		leaf icmp {
		    type uint32;
		    description
			"NAT ICMP idle-timeout";
		    ngcliext:node-fmt "$< $% @@$n";
		}
	    }
	}

	container dynamic {
	    description
		"Dynamic mapping information.";

	    ngcliext:parent-fmt "$< pool";

	    container pool-table {
		description
		    "NAT address pool table.";

		ngcliext:parent-fmt "$<";

		list pool-entry {
		    key "first-address";
		    description
			"NAT address range entry.";

		    ngcliext:node-fmt "$< address @{first-address}";
		    ngcliext:children-order "last-address twice-nat route-table-name";
		    ngcliext:post-node-fmt "$n";

		    leaf first-address {
			type inet:ipv4-address;
			mandatory true;
			description
			    "The first IPv4 address in the range.";
		    }

		    leaf last-address {
			type inet:ipv4-address;
			mandatory true;
			description
			    "The last IPv4 address in the range.";
			ngcliext:node-fmt " - @@";
		    }

		    leaf route-table-name {
			type ngcom:rt-identifier-63;
			description
			    "The route table name.";
			ngcliext:node-fmt " route-table @@";
		    }

		    leaf twice-nat {
			type boolean;
			description
			    "Twice-nat address range for external hosts.";
			ngcliext:node-op "bool";
			ngcliext:node-fmt "| $%";
		    }
		}
	    }

	    container pool-if-table {
		description
		    "NAT interface pool table.";

		ngcliext:parent-fmt "$<";

		list if-entry {
		    key "if-name";
		    description
			"Dynamic pool interface entries.";

		    ngcliext:node-fmt "$< interface @{if-name}";
		    ngcliext:children-order "twice-nat";
		    ngcliext:post-node-fmt "$n";

		    leaf if-name {
			type ngcom:if-identifier-63;
			description
			    "The name of an interface whose IPv4 addresses
			     are added to the pool of addresses used in
			     NAT mappings.";
		    }

		    leaf twice-nat {
			type boolean;
			description
			    "Twice-nat address range for external hosts.";
			ngcliext:node-op "bool";
			ngcliext:node-fmt "| $%";
		    }
		}
	    }
	}

	container static {
	    description
		"Static mapping information.";

	    ngcliext:parent-fmt "$< $%";

	    container mapping-table {
		description
		    "NAT mapping table.";

		ngcliext:parent-fmt "$<";

		list mapping-entry {
		    key "transport-protocol local-address local-port"
			+ " external-address external-port"
			+ " route-table-name";
		    description
			"NAT Mapping Entry.";

		    ngcliext:node-fmt "$< mapping @{transport-protocol} local @{local-address} @{local-port} external @{external-address}";
		    ngcliext:children-order "external-if-name
		         external-port
			 twice-nat
			 out-to-in-only
			 route-table-name";
		    ngcliext:post-node-fmt "$n";

		    leaf transport-protocol {
			type nat-ipv4-protocol-any;
			mandatory true;
			description
			    "Upper-layer protocol associated with this mapping.
			     Should be 'any', 'udp', 'tcp', or 'icmp'.";
		    }

		    leaf local-address {
			type inet:ipv4-address;
			mandatory true;
			description
			    "The local IPv4 address of the IPv4 packet.";
		    }

		    leaf local-port {
			/*
			 * there must always be a value set here, it is
			 * ignored for icmp though
			 */
			type nat-ipv4-port-any;
			description
			    "The local port mapped, or wildcard 'any'.";
		    }

		    leaf external-address {
			type inet:ipv4-address;
			description
			    "The external IPv4 address of the IPv4 packet.";
		    }

		    leaf external-if-name {
			type ngcom:if-identifier-63;
			description
			    "The external interface of the IPv4 packet.";
			ngcliext:node-fmt " @@";
		    }

		    leaf external-port {
			/*
			 * there must always be a value set here, it is
			 * ignored for icmp though
			 */
			type nat-ipv4-port-any;
			description
			    "The external port mapped, or wildcard 'any'.";
			ngcliext:node-fmt " @@";
		    }

		    leaf twice-nat {
			type boolean;
			description
			    "NAT translate external address and port
			     for 1:1 NAPT.";
			ngcliext:node-op "bool";
			ngcliext:node-fmt "| $%";
		    }

		    leaf out-to-in-only {
			type boolean;
			description
			    "Match only out-to-in direction.";
			ngcliext:node-op "bool";
			ngcliext:node-fmt "| $%";
		    }

		    leaf route-table-name {
			type ngcom:rt-identifier-63;
			description
			    "The name of a Route Table.";
			ngcliext:node-fmt " route-table @@";
		    }
		}
	    }
	}

	container ipfix {
	    description
		"IPFIX information.";

	    ngcliext:parent-fmt "$< $%";

	    container logging {
		description
		    "IPFIX logging information.";

		ngcliext:parent-fmt "$< $%";

		leaf domain {
		    type uint32 {
			range "1..max";
		    }
		    default 1;
		    description
			"The logging domain id.";
		    ngcliext:node-fmt "$< $% @@$n";
		}

		leaf src-port {
		    type uint16;
		    default 4739;
		    description
			"The logging source port id.";
		    ngcliext:node-fmt "$< $% @@$n";
		}

		leaf enable {
		    type boolean;
		    description
			"If logging is enabled for this domain and port,
			this value will be true.";
		    ngcliext:node-op "bool";
		    ngcliext:node-fmt "|$< $%$n";
		}
	    }
	}

	container nat64 {
	    description
		"NAT for IPv6/IPv4.";
	    ngcliext:parent-fmt "$< $%";
	}

    }

    container "nat-state" {
	config "false";

	description
	    "Network Address Translation (NAT) state data.";

	container parameters {
	    description
		"NAT configuration parameters.";

	    leaf translation-buckets {
		type uint32;
		description
		    "Translation hash buckets";
	    }

	    leaf translation-memory-size {
		type uint32;
		description
		    "Translation memory size.";
	    }

	    leaf endpoint-dependent {
		type boolean;
		description
		    "Endpoint-dependent mode enabled.";
	    }

	    leaf user-buckets {
		type uint32;
		description
		    "User hashs buckets.";
	    }

	    leaf user-memory-size {
		type uint32;
		description
		    "User memory size.";
	    }

	    leaf max-translations-per-user {
		type uint32;
		description
		    "Macimum translations per user";
	    }

	    leaf max-translations-per-thread {
		type uint32;
		description
		    "Maximum translations per thread.";
	    }

	    leaf max-users-per-thread {
		type uint32;
		description
		    "Maximum users per thread.";
	    }

	    leaf outside-route-table-name {
		type ngcom:rt-identifier-63;
		description
		    "Outside route table name";
	    }

	    leaf inside-route-table-name {
		type ngcom:rt-identifier-63;
		description
		    "Inside route table name";
	    }

	    leaf static-mapping-only {
		type boolean;
		description
		    "Static mapping only";
	    }

	    leaf static-mapping-connection-tracking {
		type boolean;
		description
		    "Static mapping connection tracking";
	    }

	    leaf forwarding-enabled {
		type boolean;
		description
		    "NAT44 Forwarding enabled";
	    }

	    leaf out2in-dpo {
		type boolean;
		description
		    "out2in DPO enabled.";
	    }

	    leaf timeout-udp {
		type uint32;
		description
		    "NAT UDP idle-timeout";
	    }
	    leaf timeout-tcp_established {
		type uint32;
		description
		    "NAT TCP established connection idle-timeout";
	    }
	    leaf timeout-tcp_transitory {
		type uint32;
		description
		    "NAT TCP transitory connection idle-timeout";
	    }
	    leaf timeout-icmp {
		type uint32;
		description
		    "NAT ICMP idle-timeout";
	    }
	}

	container static {
	    description
		"Static mapping information.";

	    container mapping-table {
		description
		    "NAT mapping table.";

		list mapping-entry {
		    key "transport-protocol local-address local-port"
			+ " external-address external-port"
			+ " route-table-name";
		    description
			"NAT Mapping Entry.";

		    leaf transport-protocol {
			type nat-ipv4-protocol-any;
			mandatory true;
			description
			    "Upper-layer protocol associated with this mapping.
			     Should be 'any', 'udp', 'tcp', or 'icmp'.";
		    }

		    leaf local-address {
			type inet:ipv4-address;
			mandatory true;
			description
			    "The local IPv4 address of the IPv4 packet.";
		    }

		    leaf local-port {
			type nat-ipv4-port-any;
			description
			    "The local port mapped, or wildcard 'any'.";
		    }

		    leaf external-address {
			type inet:ipv4-address;
			description
			    "The external IPv4 address of the IPv4 packet.";
		    }

		    leaf external-if-name {
			type ngcom:if-identifier-63;
			description
			    "The external interface of the IPv4 packet.";
		    }

		    leaf external-port {
			type nat-ipv4-port-any;
			description
			    "The external port mapped, or wildcard 'any'.";
		    }

		    leaf twice-nat {
			type boolean;
			description
			    "NAT translate external address and port
			     for 1:1 NAPT.";
		    }

		    leaf out-to-in-only {
			type boolean;
			description
			    "Match only out-to-in direction.";
		    }

		    leaf route-table-name {
			type ngcom:rt-identifier-63;
			description
			    "The name of a Route Table.";
		    }
		}
	    }
	}

	container dynamic {
	    description
		"Dynamic mapping information.";

	    container pool-table {
		description
		    "NAT address pool table.";

		list pool-entry {
		    key "address";
		    description
			"NAT pool address.";

		    leaf address {
			type inet:ipv4-address;
			mandatory true;
			description
			    "An IPv4 address in the address pool.";
		    }

		    leaf route-table-name {
			type ngcom:rt-identifier-63;
			description
			    "The route table name.";
		    }
		    leaf twice-nat {
			type boolean;
			description
			    "Twice-nat address range for external hosts.";
		    }
		}
	    }

	    container pool-if-table {
		description
		    "NAT interface pool table.";

		list if-entry {
		    key "if-name";
		    description
			"Dynamic pool interface entries.";

		    leaf if-name {
			type ngcom:if-identifier-63;
			description
			    "The name of an interface whose IPv4 addresses
			     are added to the pool of addresses used in
			     NAT mappings.";
		    }
		    leaf twice-nat {
			type boolean;
			description
			    "Twice-nat address range for external hosts.";
		    }
		}
	    }
	}

	container interface-sides {
	    description
		"Side information for each interface.";

	    list interface-side {
		key "if-name";
		description
		    "Side information about interfaces.";

		leaf if-name {
		    type ngcom:if-identifier-63;
		    description
			"The interface whose side information is given.";
		}

		leaf side {
		    type nat-side;
		    description
			"One of the strings 'inside', 'outside', or 'both'.";
		}
	    }
	}

	container nat64 {
	    description
		"NAT for IPv6/IPv4.";
	}

	container users {
	    description
		"NAT users.";

	    list user {
		key "route-table ip-address";
		description
		    "NAT user.";

		leaf route-table {
		    type ngcom:rt-identifier-63;
		    description
			"Route Table name.";
		}

		leaf ip-address {
		    type inet:ipv4-address;
		    description
			"IPv4 user address.";
		}

		leaf dynamic-number {
		    type uint32;
		    description
			"Number of dynamic sessions.";
		}

		leaf static-number {
		    type uint32;
		    description
			"Number of static sessions.";
		}

		list session {
		    key "index";
		    ordered-by "user";
		    description
			"NAT user session.";

		    leaf index {
			type uint32;
			description
			    "Session index.";
		    }

		    leaf outside-ip-address {
			type inet:ipv4-address;
			description
			    "Outside IPv4 address.";
		    }

		    leaf outside-port {
			type inet:port-number;
			description
			    "Outside port.";
		    }

		    leaf inside-ip-address {
			type inet:ipv4-address;
			description
			    "Inside IPv4 address.";
		    }

		    leaf inside-port {
			type inet:port-number;
			description
			    "Inside port.";
		    }

		    leaf protocol {
			type nat-ipv4-protocol;
			description
			    "Protocol.";
		    }

		    leaf static {
			type boolean;
			description
			    "Session is static.";
		    }

		    leaf last-heard {
			type uint64;
			description
			    "Last heard timer.";
		    }

		    leaf total-bytes {
			type uint64;
			description
			    "Count of bytes sent through session.";
		    }

		    leaf total-packets {
			type uint32;
			description
			    "Count of packets sent through session.";
		    }

		    leaf twice-nat {
			type boolean;
			description
			    "Session is Twice-NAT.";
		    }

		    leaf ext-host-valid {
			type boolean;
			description
			    "External host address and port are valid.";
		    }

		    leaf ext-host-address {
			type inet:ipv4-address;
			description
			    "External host IPv4 address.";
		    }

		    leaf ext-host-port {
			type inet:port-number;
			description
			    "External host port.";
		    }

		    leaf ext-host-nat-address {
			type inet:ipv4-address;
			description
			    "Post-NAT external host IPv4 address
			     (Twice-NAT only).";
		    }

		    leaf ext-host-nat-port {
			type inet:port-number;
			description
			    "Post-NAT external host port (Twice-NAT only).";
		    }
		}
	    }
	}
    }
}