Downloads |
Table Of Contents
Prerequisites for Rate Limiting NAT Translation
Information About Rate Limiting NAT Translation
Benefits of Rate Limiting NAT Translation
Viruses and Worms that Target NAT
How to Configure Rate Limiting NAT Translation
Configuration Examples for Rate Limiting NAT Translation
Setting a Global NAT Rate Limit: Example
Setting NAT Rate Limits for a Specific VRF Instance: Example
Setting NAT Rate Limits for All VRF Instances: Example
Setting NAT Rate Limits for Access Control Lists: Example
Setting NAT Rate Limits for an IP Address: Example
ip nat translation max-entries
Rate Limiting NAT Translation
The Rate Limiting NAT Translation feature provides the ability to limit the maximum number of concurrent network address translation (NAT) operations on a router. In addition to giving users more control over how NAT addresses are used, the Rate Limiting NAT Translation feature can be used to limit the effects of viruses, worms, and denial-of-service attacks.
12.3(4)T
This feature was introduced.
12.2(25)S
This feature was implemented in Cisco IOS Release 12.2(25)S.
Feature History for Rate Limiting NAT Translation
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Prerequisites for Rate Limiting NAT Translation
•
•
•
Prerequisites for Rate Limiting NAT Translation
Before configuring rate limits for NAT translation, you must first enable NAT on your router. For additional information on NAT configuration, see the "Related Documents" section.
Information About Rate Limiting NAT Translation
To configure the Rate Limiting NAT Translation feature, you should understand the following concepts:
•
•
Benefits of Rate Limiting NAT Translation
Since NAT is a CPU-intensive process, router performance can be adversely affected by denial-of-service attacks, viruses, and worms that target NAT. The Rate Limiting NAT Translation feature allows the user to limit the maximum number of concurrent NAT requests on a router.
Denial-of-Service Attacks
A denial-of-service (DoS) attack typically involves the misuse of standard protocols or connection processes with the intent to overload and disable a target, such as a router or web server. DoS attacks can come from a malicious user or from a computer infected with a virus or worm. When the attack comes from many different sources at once, such as when a virus or worm has infected many computers, it is known as a distributed denial-of-service (DDoS) attack. Such DDoS attacks can spread rapidly and involve thousands of systems.
Viruses and Worms that Target NAT
Viruses and worms are malicious programs designed to attack computer and networking equipment. While viruses are typically embedded in discrete applications and only run when executed, worms self-propagate and can quickly spread on their own. Although a specific virus or worm may not expressly target NAT, it might use NAT resources to propagate itself. The Rate Limiting NAT Translation feature can be used to limit the impact of viruses and worms that originate from specific hosts, access control lists, and VPN routing and forwarding (VRF) instances.
How to Configure Rate Limiting NAT Translation
This section contains the following procedure:
•
Configuring a NAT Rate Limit
Before you configure a NAT rate limit, you should first classify current NAT usage and determine the sources of requests for NAT translations. If a specific host, access control list, or VRF instance is generating an unexpectedly high number of NAT requests, it may be the source of a malicious virus or worm attack.
Once you have identified the source of excess NAT requests, you can set a NAT rate limit that contains a specific host, access control list, or VRF instance, or you can set a general limit for the maximum number of NAT requests allowed regardless of their source.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Configuration Examples for Rate Limiting NAT Translation
This section provides the following configuration examples:
•
•
•
•
•
Setting a Global NAT Rate Limit: Example
The following example shows how to limit the maximum number of allowed NAT entries to 300:
Router(config)# ip nat translation max-entries 300Setting NAT Rate Limits for a Specific VRF Instance: Example
The following example shows how to limit the VRF instance named "vrf1" to 150 NAT entries:
Router(config)# ip nat translation max-entries vrf vrf1 150Setting NAT Rate Limits for All VRF Instances: Example
The following example shows how to limit each VRF instance to 200 NAT entries:
Router(config)# ip nat translation max-entries all-vrf 200The following example shows how to limit the the VRF instance named "vrf2" to 225 NAT entries, but limit all other VRF instances to 100 NAT entries each:
Router(config)# ip nat translation max-entries all-vrf 100Router(config)# ip nat translation max-entries vrf vrf2 225Setting NAT Rate Limits for Access Control Lists: Example
The following example shows how to limit the access control list named "vrf3" to 100 NAT entries:
Router(config)# ip nat translation max-entries list vrf3 100Setting NAT Rate Limits for an IP Address: Example
The following example shows how to limit the host at IP address 127.0.0.1 to 300 NAT entries:
Router(config)# ip nat translation max-entries host 127.0.0.1 300Additional References
The following sections provide references related to Rate Limiting NAT Translation.
Related Documents
Standards
No new or modified standards are supported by this feature and support for existing standards has not been modified by this feature.
—
MIBs
RFCs
RFC 2663
IP Network Address Translator (NAT) Terminology and Considerations
RFC 3022
Traditional IP Network Address Translator (Traditional NAT)
Technical Assistance
Command Reference
This section documents new and modified commands. All other commands used with this feature are documented in the Cisco IOS Release 12.3 T command reference publications.
New Command
•
Modified Commands
•
•
ip nat translation max-entries
To limit the size of a network address translation (NAT) table to a specified maximum, use the ip nat translation max-entries command in global configuration mode. To remove a specified limit, use the no form of this command.
ip nat translation max-entries {number | all-vrf number | host ip-address number | list listname number | vrf name number}
no ip nat translation max-entries {number | all-vrf name number | host ip-address number | list listname number | vrf name number}
Syntax Description
Defaults
No maximum size is specified for the NAT table.
Command Modes
Global configuration
Command History
12.3(4)T
This command was introduced.
12.2(25)S
This command was implemented in Cisco IOS Release 12.2(25)S.
Usage Guidelines
Before you configure a NAT rate limit, you should first classify current NAT usage and determine the sources of requests for NAT translations. If a specific host, access control list, or VRF instance is generating an unexpectedly high number of NAT requests, it may be the source of a malicious virus or worm attack.
Once you have identified the source of excess NAT requests, you can set a NAT rate limit that constrains a specific host, access control list, or VRF instance, or you can set a general limit for the maximum number of NAT requests allowed regardless of their source.
Note
Examples
The following examples show how to configure rate limiting NAT translation.
Setting a General NAT Limit
The following example shows how to limit the maximum number of allowed NAT entries to 300:
Router(config)# ip nat translation max-entries 300Setting NAT Limits for VRF Instances
The following example shows how to limit each VRF instance to 200 NAT entries:
Router(config)# ip nat translation max-entries all-vrf 200The following example shows how to limit the VRF instance named "vrf1" to 150 NAT entries:
Router(config)# ip nat translation max-entries vrf vrf1 150The following example shows how to limit the the VRF instance named "vrf2" to 225 NAT entries, but limit all other VRF instances to 100 NAT entries each:
Router(config)# ip nat translation max-entries all-vrf 100Router(config)# ip nat translation max-entries vrf vrf2 225Setting NAT Limits for Access Control Lists
The following example shows how to limit the access control list named "vrf3" to 100 NAT entries:
Router(config)# ip nat translation max-entries list vrf3 100Setting NAT Limits for an IP Address
The following example shows how to limit the host at IP address 127.0.0.1 to 300 NAT entries:
Router(config)# ip nat translation max-entries host 127.0.0.1 300Related Commands
ip nat translation (timeout)
To change the amount of time after which Network Address Translation (NAT) translations time out, use the ip nat translation command in global configuration mode. To disable the timeout, use the no form of this command.
ip nat translation {timeout | udp-timeout | dns-timeout | tcp-timeout | finrst-timeout | icmp-timeout | pptp-timeout | syn-timeout | port-timeout} {seconds | never}
no ip nat translation {timeout | udp-timeout | dns-timeout | tcp-timeout | finrst-timeout | icmp-timeout | pptp-timeout | syn-timeout | port-timeout}
Syntax Description
Defaults
timeout: 86,400 seconds (24 hours)
udp-timeout: 300 seconds (5 minutes)
dns-timeout: 60 seconds (1 minute)
tcp-timeout: 86,400 seconds (24 hours)
finrst-timeout: 60 seconds (1 minute)
icmp-timeout: 60 seconds (1 minute)
pptp-timeout: 86,400 seconds (24 hours)
syn-timeout: 60 seconds (1 minute)
seconds: 0 (never)Command Modes
Global configuration
Command History
Usage Guidelines
When port translation is configured, each entry contains more context about the traffic that is using it, which gives you finer control over translation entry timeouts. Non-DNS UDP translations time out after 5 minutes, while DNS times out in 1 minute. TCP translations time out in 24 hours, unless an RST or FIN bit is seen on the stream, in which case they will time out in 1 minute.
Examples
The following example configures the router to cause UDP port translation entries to time out after 10 minutes (600 seconds):
ip nat translation udp-timeout 600Related Commands
show ip nat statistics
To display Network Address Translation (NAT) statistics, use the show ip nat statistics command in User EXEC mode.
show ip nat statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC
Command History
11.2
This command was introduced.
12.3(4)T
This command was enhanced to display NAT limit information.
12.2(25)S
This command was implemented in Cisco IOS Release 12.2(25)S.
Usage Guidelines
Use the show ip nat statistics command to display current NAT usage information, and to verify current NAT limit settings.
Examples
The following is sample output from the show ip nat statistics command:
Router# show ip nat statisticsTotal active translations: 5 (0 static, 5 dynamic; 5 extended)Outside interfaces:Virtual-Access1, Virtual-Template1Inside interfaces:Ethernet1/0, Ethernet1/1Hits: 15 Misses: 25CEF Translated packets: 37, CEF Punted packets: 0Expired translations: 5Dynamic mappings:-- Inside Source[Id: 1] access-list 1 interface Virtual-Template1 refcount 5nat-limit statistics:host 10.1.25.4: max allowed 5, used 5, missed 0Table 1 describes the significant fields shown in the example.
Related Commands
Copyright © 2003 Cisco Systems, Inc. All rights reserved.
