NAT Pool Allocation

I was troubleshooting a connectivity issue for a client and he kept asking me to check the 'NAT pool allocation' on the loadbalancer context. My company uses a ACE module running software version A5(2.2). I could find no command such as show nat or show allocation. Running show xlate does not give me a count but a list of all the translation.
Can someone explain to me what exactly my client is asking for?

Hi,
Perhaps this:
switch/Admin# show np 1 me-stats -vsocm | include NAT
NAT[static mapped]: 0 0
NAT[static real]: 0 0
NAT[xlate alloc fail]: 0 0
NAT[xlate real hit]: 0 0
NAT[xlate mapped hit]: 0 0
NAT[invalid xlate]: 0 0
NAT[dump xlate]: 0 0
NAT[xlate release failed]: 0 0
NAT Pool Alloc [fail]: 0 0
NAT Pool Alloc [addr]: 0 0
NAT Pool Alloc [addr/port]: 0 0
NAT Pool Free [addr]: 0 0
NAT Pool Free [addr/port]: 0 0
NAT Pool Free [orphan IP]: 0 0
Drop [Need NAT IPv4-6]: 0 0
Drop [Need NAT IPv6-4]: 0 0
NAT free no xlate [real addr]: 0 0
NAT free no xlate [mapped addr]: 0 0
NAT Dynamic Xlate GC Reaped: 0 0
NAT Implicit PAT Alloc [fail]: 0 0
NAT Implicit PAT Alloc: 0 0
NAT Implicit PAT Free: 0 0
Based on model, np x can be 1, 2, 3 and 4.
Regards,
Kanwal
Note: Please mark answers if they are helpful.

Similar Messages

Cacti & Allocated IP NAT Pools

Hey,
We're using cacti for some monitoring tools. And i can easy get graphs for the Active NAT translations.
But we would like to have also a view on the allocated ip's for a nat pool. Is there an OID for this? Or do you've got an idea how we can check this?
OID that i'm using for the active NAT: 1.3.6.1.4.1.9.10.77.1.2.3.0

Hi Carl
Do find the different default time out values associated with the translation and also the ways to tweak the same accordingly as per our requirement..
timeout Specifies that the timeout value applies to dynamic translations except for overload translations. Default is 86,400 seconds (24 hours).
udp-timeout Specifies that the timeout value applies to the User Datagram Protocol (UDP) port. Default is 300 seconds (5 minutes).
dns-timeout Specifies that the timeout value applies to connections to the Domain Name System (DNS). Default is 60 seconds.
tcp-timeout Specifies that the timeout value applies to the TCP port. Default is 86,400 seconds (24 hours).
finrst-timeout Specifies that the timeout value applies to Finish and Reset TCP packets, which terminate a connection. Default is 60 seconds.
icmp-timeout Specifies the timeout value for Internet Control Message Protocol (ICMP) flows. Default is 60 seconds.
pptp-timeout Specifies the timeout value for NAT Point-to-Point Tunneling Protocol (PPTP) flows. Default is 86,400 seconds (24 hours).
syn-timeout Specifies the timeout value for TCP flows immediately after a synchronous transmission (SYN) message that consists of digital signals that are sent with precise clocking. The default is 60 seconds.
http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00801d09f0.html
regds

Use of client nat pools on the CSM

Hi Guys,
Just a quick questions about the use of NAT POOLS, which the configuration guide is a little scant for information.
If a client NAT pool such as this is used (16 addresses):
natpool POOL1 10.1.5.0 10.1.5.15 netmask 255.255.255.240
I just want to make sure that port address translation (PAT) will be used by the CSM if the number of sessions exceed the number of IP addresses available in the NAT pool?
I hope this makes sense!
thanks
Sheldon

the CSM does PAT by default.
Gilles.

NAT Pool question

I have a question on how NAT pools, or sNAT works with ACE in one-arm mode.
As I understand it, when the client sends the request to ACE, it changes the destination IP to a rServer and source IP to the sNAT address. When the rServer responds, it sends traffic back through the ACE via the sNat. How exactly does this work? I can't ping the sNAT address I configured, so how is the sNAT associated with the ACE in any way? How does traffic make it's way back to the ACE when the sNAT doesn't seem to be advertised externally in any way. And one more quick question, should the sNAT be on the rServer subnet or the ACE subnet? Just trying to understand so we can make good design decisions.

Tbone,
When you use SNAT you generally use a nat-pool address that will bring the traffic back to the ACE interface that the traffic left on. In a typical one-armed mode the Nat-pool would be in the same subnet as the ACE interface and rservers.
If the servers are local to the ACE you usually point the servers default gateway to the SVI or FW interface rather than the ACE. If SNAT is not used the client IP enters the ACE destined to the VIP. ACE will change the destination address to the rserver. Since the original client IP will be seen by the server it will reply to the default gateway. If the ACE does not get the server reply it cannot change the SYN ACK back to the VIP address that the client originally sent the connection to. This would result in a connection failure. When you use SNAT with a Nat-pool that is local to the server it will not use it's gateway but will reply directly back to the ACE since it owns this IP.
If the servers are not local to the ACE you would want to configure the nat-pool IPs to be local to the interface vlan the traffic egresses to get to the rserver. This way your routing will bring the server reply back to the ACE.
Let me know if this helps with your understanding or if you have more questions.
Best regards
Jim

ASA single outside IP address to an inbound NAT pool that round robins request to 2 web servers

How do I create a single outside IP address 1.2.3.4 to an inbound NAT pool that round robins request to 2 web servers?
I have 2 web server 10.0.0.1 and 10.0.0.2. They have the exact same content.
I think I start with defining the pool as an object group which contains 2 server 10.0.0.1 and 10.0.0.2
object-group network appservers
network-object host 10.0.0.1
network-object host 10.0.0.2
What to do next?
object-group network appservers
nat (inside,outside) static 1.2.3.4
gives me an error.

No, unfortunately you can't configure round robin static inbound NAT for 2 internal web servers.

Shared Pool Allocation Problem

Hi everyone,
When I execute the following statement from my application, it returns the ORA-04031 29080216 byte can not allocate shared pool ("large pool","unknown object","hash-join subh","kllcqc:kllcqslt") error.
SELECT DISTINCT KULLANICIID, NOVELKULLANICIADI AS "KULLANICIADI" FROM KULLANICIROLLERI
LEFT OUTER JOIN KULLANICILAR ON KULLANICIROLLERI.KULLANICIID = KULLANICILAR.ID
WHERE
KULLANICIROLLERI.AKTIF = '1' AND
KULLANICILAR.AKTIF = '1' AND
KULLANICILAR.NOVELKULLANICIADI IS NOT NULL AND
GECERLIOLDUGUELEMENTTYPENO = 5 AND GECERLIOLDUGUELEMENTID = 1
But when I look the parameters their values are
shared_pool_size : 318767104
large_pool_size : 335544320
How can I solve that problem.. Actually the parameters seem to be ok..
Thanks in advance
OzerK

Hi,
Do you resolved problem with sharet pool allocation ?
I have a same, with ora-4031 error...
Best,
Adam
[email protected]

ACE: Significance of mask in nat-pools configured for Source NAT

Hi guys
If I am using source nat in ACE (One IP address 10.10.10.200) used for all client address translations.
What would be the difference between the nat-pools configured with different netmask.
What is the recommended netmask for pat, 255.255.255.255 or Vlan interface's Mask (/24 in this case)
and why?
case1:
interface vlan 7
ip address 10.10.10.100 255.255.255.0
nat-pool 1 10.10.10.200 10.10.10.200 netmask 255.255.255.0 pat
service-policy input clientvips
no shutdown
case2:
interface vlan 7
ip address 10.10.10.100 255.255.255.0
nat-pool 1 10.10.10.200 10.10.10.200 netmask 255.255.255.255 pat
service-policy input clientvips
no shutdown
Thanks in Advance
A.

Gilles
Thanks a lot. It makes more sense now.
I posted another question for an ACE design validation. Could you please validate this
I am planning to deploy ACE module in following manner:
> ACE will be in one arm mode ( Only one vlan connected to the ACE).
> Vips & Rservers (all serverfarms) will be in the same Vlan X.
> Default gateway on the ACE & Real servers will be the upstream router
> There will be Source NAT configured for all Serverfarms.
ACE --- Vlan X -------Router--- internet
.................|
.................|-- Sfarm 1
.................|
.................|-- Sfarm 2
.................|
.................|-- Sfarm n
I am pretty sure that it should work.
Just wanted an expert opinion.
Thanks

Nat pool in CSM

Hi,
Can we use Same Nat pool for 2 different Server farms in CSM? Does it work. Or will it create any issue
(For E.g)
natpool XYZ 10.0.0.63 10.0.0.63 netmask 255.255.255.128
serverfarm ABC
nat server
nat client XYZ
real name Real1
   health probe TCP-3139
   inservice
real name Real2
   health probe TCP-3139
   inservice
serverfarm QAZ
nat server
nat client XYZ
real name Real1
   health probe HTTP-7779
   inservice
real name Real2
   health probe HTTP-7779
   inservice

Hi,
Yes, it's perfectly fine to use the same nat pool.
Regards
Daniel

High CPU load on msfc sup720 while using nat pool

Hello,
On our 6509-E+switchblades with sup720/pfc3 and CSM module we noticed a considerable cpu load like:
#show processes cpu sorted
CPU utilization for five seconds: 85%/81%; one minute: 82%; five minutes: 41%
after some research i'm able to reproduce it, and basically its:
when sending traffic through the vlans defined on the msfc with nat inside and nat outside it's reproducable.
when unconfiguring NAT the cpu load drops (in lab) to 0%/0%.
we're using nat pools just to fix a internal application/service on 1 IP.
it's configured like:
ip nat pool DMZ-193 1.1.1.1 1.1.1.1 netmask 255.255.255.224
ip nat inside source list DMZ-193 pool DMZ-193 overload
ip access-list extended DMZ-193
<snip>
where the 1.1.1.1 the external (example) source IP is where it's S-natted to.
With this "feature" i can't get a higher rate then about 130Mbit/s (msfc cpu bound)
Has any one an idea why this gets executed in software and not in hardware like what the docu says?
Any idea or workaround is welcome.
additional note: i reviewed document:
http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a00804916e0.shtml
which gave good ideas, but no solution yet.
Regards,
Arjan Filius

problem solved, there where some empty ACL's which causes to use the cpu instead of hardware.
Regards,

Dynamic IP Nat Pool with 3030 -- 3002 Tunnel

I currently use the 3002 HW Client at several ROBO/SOHO locations in Network Extension mode. This works great. Recently I have the need to establish the same type of connection, but I need to provide a dynamic IP NAT pool for the clients behind the 3002. Is a configuration like this possible using the 3030 & 3002, or will I need some other HW to replace the 3002. If other HW is needed please suggest low end options (i.e. I realize a L2L with another concentrator will work). And I asume the configuration is possible with a 1720(?).
Thanks in advance,
John

Hi,
If I understand you correctly, you want to NAT the ip addresses behind the VPN3002 to specific ip address when they go accross the IPSec tunnel to the VPN Server, so that the source ip address is different when the packet reaches the VPN Server.
This is not possible with the VPN3002 and you can try using PAT but this is only for many to one translation and also if you have a VOIP solution or a speficic reason for using NEM, then PAT will not work for you.
Regards,
Arul

Ip nat pool no-overload prefix 22 (just starting out with the cisco training and wanted to know )

Above is the command ip nat pool no overload prefix 22
Does anyone know what the prefix 22 does and why it is added. I also and new at learning and currently studying and wanted to know any recommendations for taking the CCNA or CCNP and what online routers (emulators) can i play on to learn commands and prepare for exams

Hi,
It is just describing the prefix length for the network or Subnet Mask in general terms.
Check this:-
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr/command/ipaddr-cr-book/ipaddr-i3.html#wp6064781280
Thanks and Regards,
Vibhor Amrodia

NAT pool configuration question

Hi all,
I would like to know how can I compute for a wild card mask for this hosts?
10.1.1.5 /24 - 10.1.1.8 /24
I have created a nat pool that translates addresses above to 124.24.34.250/24 - 124.24.34.253/24
R3#show access-list
Extended IP access list traders
10 permit ip 10.1.1.0 0.0.0.5 any
R3#sh run | s nat
ip nat pool my_traders 124.24.34.250 124.24.34.253 prefix-length 24
ip nat inside source list traders pool my_traders
10.1.1.5 to 10.1.1.7 works, it's only .8 that doesn't, how can I cover it?
thanks all,

Hi Seb,
I was able to resolve, although I would like to know if I can further aggregate or summarize acls?
R3#sh run | s users
ip nat pool users 124.24.34.249 124.24.34.249 prefix-length 24
ip nat inside source route-map my_users pool users overload
route-map my_users permit 10
match ip address lan
R3#show access-list lan
Extended IP access list lan
10 permit ip 10.1.1.16 0.0.0.15 any (2 matches)
20 permit ip 10.1.1.32 0.0.0.15 any (1 match)
30 permit ip 10.1.1.64 0.0.0.63 any
40 permit ip 10.1.1.128 0.0.0.127 any
Also should the prefix length in the NAT statement be equal to the subnet mask of the inside local address?
Thanks,
Thanks,

Resource pool allocation problem - MS Project 2013

I have a new resource pool which I have created, im very new to MS Project so I may have set this up wrong im not too sure as I am learning from reading articles on google.
So my resource pool has 12 fabricators on it – working 8am – 4.30pm but I have put the max units at 75%, totalling to 900%, ive input all absences that I know of in the future by reducing the percentage of work, 2 people off I have reduced it to 750% for
that day. Im hoping this is the right way to do this?
Here’s where it gets messy . There is over allocation throughout January on the fabs so 6 of them have agreed to do overtime at 2 hours a day Mon-Fri and full day Saturday. As there is only 6 of them and not the full 12 do I change it in the resource information
under general or should I be splitting them and changing their working hours or is there no way round this. Sorry my brain has been fried this week trying to work out resource pools.
Any advice would be gratefully received thanks
J
Kath

Hi Kath
I doubt if I understood you completely!!!
I am mentioning some links please go through these links and just check if it helps you in any way possible.
Assignment Units
Modify working and nonworking times
Please write back to us in the forum for any other help. Someone may help if question is more accurate.
Thanks
Manish

Reclaim an IP from the IP Pool allocated for ESXi VTEP

I had an IP Pool of 5 addresses all of which were allocated to my 5 ESXi hosts. I then screwed up the VTEP vmkernel port on one of the ESXi hosts. I was only able to correct it by adding another IP to the IP Pool range of addresses and then Forcing a Synch. Now I have an IP Pool that show 6 of 6 IP addresses allocated when in reality I only have 5 of 6 allocated to ESXi hosts. Is there any way for me to reclaim the 6th IP address in the pool that is still showing Allocated?
Thanks

The commands you provided worked perfect. My IP Pool in NSX Manager now says 5 of 6 allocated. At first it still wasn't obvious what the pool-id was after running the command https://<nsxmgr-ip>/api/2.0/services/ipam/pools/scope/globalroot-0. However, under <ipamAddressPools><ipamAddressPool> is <objectId> and its that objectid that is the pool-id needed for the command https://<nsxmgr-ip>/api/2.0/services/ipam/pools/<pool-id>/ipaddresses/<ipaddress>
Thanks

IKEv2 AnyConnect and Pool allocation via RADIUS

I am configured a CSR1000V (03.09.00a.S.153-2.S) for AnyConnect with IKEv2. I am storing username and IKEv2 authorization policy on the RADIUS server. Clients are dropped into their own iVRFs through RADIUS attributes passed back to the NAS.
e.g. in FreeRadius (2.1.12), the following is defined (home is the 'group') in username@group format.
home                    Cleartext-Password := "cisco"
                             Cisco-AVPair += "ip:interface-config=vrf forwarding CUST-A",
                             Cisco-AVPair += "ip:interface-config=ip unnumbered loopback100",
                              Framed-Pool = "CUST-A-POOL"
matt@home               Cleartext-Password := "test123"
Group and user authorization information is then merged and cloned onto the virtual template:
crypto ikev2 name-mangler EXTRACT-GROUP
eap suffix delimiter @
crypto ikev2 profile FlexVPN-IKEv2-Profile-1
match fvrf IPSEC-FVRF
match identity remote key-id FlexAnyConnect
identity local dn
authentication remote eap query-identity
authentication local rsa-sig
pki trustpoint cacert.org
dpd 60 2 on-demand
aaa authentication eap FlexVPN-AuthC-List1
aaa authorization group eap list FlexVPN-AuthZ-List-1 name-mangler EXTRACT-GROUP
aaa authorization user eap cached
virtual-template 1
interface Virtual-Template1 type tunnel
no ip address
tunnel mode ipsec ipv4
tunnel vrf IPSEC-FVRF
tunnel protection ipsec profile FlexVPN-IPsec-Profile-1
However, it appears that the RADIUS attribute specifying the pool is ignored; I can see the RADIUS attribute (IETF 88) passed back to the NAS in the RADIUS debugs:
*Aug 16 21:36:39.384 BST: RADIUS: Framed-IP-Pool      [88] 13 "CUST-A-POOL"
However, the crypto debugs state that an IP address cannot be assigned:
*Aug 16 21:36:39.435 BST: IKEv2:Failed to allocate IP addr
<snip>
Payload contents:
AUTH NOTIFY(INTERNAL_ADDRESS_FAILURE)
If the Framed-Pool is removed and a Framed-IP-Address defined instead for the user, then the address is assigned. The CUST-A-POOL is defined locally on the NAS. Is there anything I am missing? Can any more detailed debugs be generated?
Cheers,
Matt

Marcin,
Thank you for your response; sending "ipsec:addr-pool" does work. I did a bug scrape, but didn't find this (if I try to view it in the new Bug Tool, I get "Insufficient Permissions to View Bug"), but it was possible to paste the Bug ID into the old Bug Toolkit to get the detail.
As an aside, I also found that "include-local-lan" doesn't appear to work with IKEv2 AnyConnect and isn't likely to be fixed; according to CSCud65859, the workaround is to use split-tunneling ("ipsec:route-set=prefix prefix/len").
Cheers,
Matt

NAT Pool Allocation

Similar Messages

Maybe you are looking for