-
Cisco IOS IP Addressing Services Command Reference
-
Introduction
-
ARP Commands
-
DHCP Commands: accounting (DHCP) through ip dhcp excluded-address
-
DHCP Commands: ip dhcp limit lease through lease
-
DHCP Commands: netbios-name-server through vrf (DHCP pool)
-
DNS Commands: ddns (DDNS-update-method) through ip dns server queue limit
-
DNS Commands: ip dns spoofing through view (DNS)
-
IP Addressing Commands
-
NAT Commands
-
NHRP Commands
-
Table Of Contents
clear ip snat translation distributed
clear ip snat translation peer
debug redundancy application group config
debug redundancy application group faults
debug redundancy application group media
debug redundancy application group protocol
debug redundancy application group rii
debug redundancy application group transport
debug redundancy application group vp
ip nat log translations flow-export
ip nat log translations syslog
ip nat service enable-sym-port
ip nat translation max-entries
redundancy application reload group
show platform hardware qfp feature
show platform software trace message
show redundancy application group
show redundancy application transport
show redundancy application control-interface
show redundancy application faults
show redundancy application protocol
show redundancy application if-mgr
show redundancy application data-interface
NAT Commands
application redundancy
To enter redundancy application configuration mode, use the application redundancy command in redundancy configuration mode.
application redundancy
Syntax Description
This command has no arguments or keywords.
Command Default
None
Command Modes
Redundancy configuration (config-red)
Command History
Examples
The following example shows how to enter redundancy application configuration mode:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)#Related Commands
authentication
To configure clear text authentication and MD5 authentication under a redundancy group protocol, use the authentication command in redundancy application protocol configuration mode. To disable the authentication settings in the redundancy group, use the no form of this command.
authentication {text string | md5 key-string [0 | 7] key | md5 key-chain key-chain-name}
no authentication {text string | md5 key-string [0 | 7] key | md5 key-chain key-chain-name}
Syntax Description
Command Default
The key is not encrypted.
Command Modes
Redundancy application group protocol configuration (config-red-app-prtcl)
Command History
Examples
The following example shows how to configure clear text authentication for a redundancy group:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)# protocol 1Router(config-red-app-prtcl)# authentication text name1Related Commands
clear ip nat translation
To clear dynamic Network Address Translation (NAT) translations from the translation table, use the clear ip nat translation command in EXEC mode.
clear ip nat translation {* | forced | [piggyback-internal | esp | tcp | udp] [inside global-ip [global-port] local-ip [local-port] outside local-ip global-ip] | inside global-ip local-ip [forced] | outside local-ip global-ip [forced]}
Syntax Description
Command Modes
EXEC
Command History
Usage Guidelines
Use this command to clear entries from the translation table before they time out.
Examples
The following example shows the NAT entries before and after the User Datagram Protocol (UDP) entry is cleared:
Router> show ip nat translationsPro Inside global Inside local Outside local Outside globaludp 10.69.233.209:1220 10.168.1.95:1220 10.69.2.132:53 10.69.2.132:53tcp 10.69.233.208 10.168.1.94tcp 10.69.233.209:11012 10.168.1.89:11012 10.69.1.220:23 10.69.1.220:23tcp 10.69.233.209:1067 10.168.1.95:1067 10.69.1.161:23 10.69.1.161:23Router# clear ip nat translation udp inside 10.69.233.209 1220 10.168.1.95 1220outside 10.69.2.132 53 10.69.2.132 53Router# show ip nat translationsPro Inside global Inside local Outside local Outside globaltcp 10.69.233.208 10.168.1.94tcp 10.69.233.209:11012 10.168.1.89:11012 10.69.1.220:23 10.69.1.220:23tcp 10.69.233.209:1067 10.168.1.95:1067 10.69.1.161:23 10.69.1.161:23Router# clear ip nat translation inside 10.69.233.208 10.168.1.94 forcedRouter# show ip nat translationsPro Inside global Inside local Outside local Outside globaltcp 10.69.233.209:11012 10.168.1.89:11012 10.69.1.220:23 10.69.1.220:23tcp 10.69.233.209:1067 10.168.1.95:1067 10.69.1.161:23 10.69.1.161:23Related Commands
clear ip snat sessions
To clear dynamic Stateful Network Address Translation (SNAT) sessions from the translation table, use the clear ip snat sessions command in EXEC mode.
clear ip snat sessions * [ip-address-peer]
Syntax Description
*
Removes all dynamic entries.
ip-address-peer
(Optional) Removes SNAT entries of the peer translator.
Command Modes
EXEC
Command History
Usage Guidelines
Use this command to clear entries from the translation table before they time out.
Examples
The following example shows the SNAT entries before and after using the clear ip snat sessions command:
Router> show ip snat distributedSNAT:Mode PRIMARY:State READY:Local Address 10.168.123.2:Local NAT id 100:Peer Address 10.168.123.3:Peer NAT id 200:Mapping List 10Router> clear ip snat sessions *Closing TCP session to peer:10.168.123.3Router> show ip snat distributed
clear ip snat translation distributed
To clear dynamic Stateful Network Address Translation (SNAT) translations from the translation table, use the clear ip snat translation distributed command in EXEC mode.
clear ip snat translation distributed *
Syntax Description
Command Modes
EXEC
Command History
Usage Guidelines
Use this command to clear entries from the translation table before they time out.
Examples
The following example clears all dynamic SNAT translations from the translation table:
Router# clear ip snat translation distributed *clear ip snat translation peer
To clear peer Stateful Network Address Translation (SNAT) translations from the translation table, use the clear ip snat translation peer command in EXEC mode.
clear ip snat translation peer ip-address-peer [refresh]
Syntax Description
ip-address-peer
IP address of the peer translator.
refresh
(Optional) Provides a fresh dump of the NAT table from the peer.
Command Modes
EXEC
Command History
Usage Guidelines
Use this command to clear peer entries from the translation table before they time out.
Examples
The following example shows the SNAT entries before and after the peer entry is cleared:
Router# show ip snat peerPro Inside global Inside local Outside local Outside global--- 192.168.25.20 192.168.122.20 --- ---tcp 192.168.25.20:33528 192.168.122.20:33528 192.168.24.2:21 192.168.24.2:21Router# clear ip snat translation peer 192.168.122.20clear nat64 ha statistics
To clear the Network Address Translation 64 (NAT64) high availability (HA) statistics, use the clear nat64 ha statistics command in privileged EXEC mode.
clear nat64 ha statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
The HA statistics include the number of HA messages that are transmitted and received by the Route Processor (RP).
Examples
The following example shows how to use the clear nat64 ha statistics command to clear the NAT64 HA statistics:
Router# clear nat64 ha statisticsRelated Commands
clear nat64 statistics
To clear the Network Address Translation 64 (NAT64) statistics, use the clear nat64 statistics command in privileged EXEC mode.
clear nat64 statistics [global | interface type number | prefix ipv6-prefix/prefix-length]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
You can use the clear nat64 statistics command to clear the statistics of a specified interface or all the interfaces for a given stateless prefix.
Examples
The following example shows how to clear NAT64 statistics:
Router# clear nat64 statisticsRelated Commands
show nat64 statistics
Displays statistics about NAT64 interfaces and the translated and dropped packet count.
control
To configure the control interface type and number for a redundancy group, use the control command in redundancy application group configuration mode. To remove control interface for the redundancy group, use the no form of this command.
control interface-name number protocol id
no control
Syntax Description
interface-name
Interface name.
number
Interface number.
protocol
Specifies redundancy group protocol media.
id
Redundancy group protocol instance. The range is from 1 to 8.
Command Default
Control interface is not configured
Command Modes
Redundancy application group configuration (config-red-app-grp)
Command History
Examples
The following example shows how to configure the redundancy group protocol media and instance for control Gigabit Ethernet interface:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)# group 1Router(config-red-app-grp)# control GigabitEthernet 0/0/0 protocol 1Related Commands
data
To configure the data interface type and number for a redundancy group, use the data command in redundancy application group configuration mode. To remove the configuration, use the no form of this command.
data interface-name number
no data interface-name number
Syntax Description
Command Default
No data interface is configured.
Command Modes
Redundancy application group configuration (config-red-app-grp)
Command History
Usage Guidelines
Use the data command to configure the data interface. Data interface can be the same physical interface as the control interface.
Examples
The following example shows how to configure the data Gigabit Ethernet interface for group1:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)# group 1Router(config-red-app-grp)# data GigabitEthernet 0/0/0Related Commands
debug redundancy application group config
To display the redundancy application group configuration, use the debug redundancy application group config command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug redundancy application group config {all | error | event | func}
no debug redundancy application group config {all | error | event | func}
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output from the debug redundancy application group config all command:
Router# debug redundancy application group config allRG config all debugging is onRelated Commands
debug redundancy application group faults
To display the redundancy application group faults, use the debug redundancy application group faults command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug redundancy application group faults {all | error | event | fault | func}
no debug redundancy application group faults {all | error | event | fault | func}
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output from the debug redundancy application group faults error command:
Router# debug redundancy application group faults errorRG Faults error debugging is onRelated Commands
debug redundancy application group media
To display the redundancy application group media information, use the debug redundancy application group media command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug redundancy application group media {all | error | event | nbr | packet {rx | tx} | timer}
no debug redundancy application group media {all | error | event | nbr | packet {rx | tx} | timer}
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output from the debug redundancy application group media timer command:
Router# debug redundancy application group media timerRG Media timer debugging is onRelated Commands
debug redundancy application group protocol
To display the redundancy application group protocol information, use the debug redundancy application group protocol command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug redundancy application group protocol {all | detail | error | event | media | peer}
no debug redundancy application group protocol {all | detail | error | event | media | peer}
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output from the debug redundancy application group protocol peer command:
Router# debug redundancy application group protocol peerRG Protocol peer debugging is onRelated Commands
debug redundancy application group rii
To display the redundancy application group RII information, use the debug redundancy application group rii command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug redundancy application group rii {error | event}
no debug redundancy application group rii {error | event }
Syntax Description
error
Displays RII errors information about the redundancy group's .
event
Dispalys information about the redundancy group's RII events.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output from the debug redundancy application group rii event command:
Router# debug redundancy application group rii eventRG RII events debugging is onRelated Commands
debug redundancy application group transport
To display the redundancy application group transport information, use the debug redundancy application group transport command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug redundancy application group transport {db | error | event | packet | timer | trace}
no debug redundancy application group transport {db | error | event | packet | timer | trace}
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output from the debug redundancy application group transport trace command:
Router# debug redundancy application group transport traceRG Transport trace debugging is onRelated Commands
debug redundancy application group vp
To display the redundancy application group virtual platform (VP) information, use the debug redundancy application group VP command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug redundancy application group vp {error | event}
no debug redundancy application group vp{error | event}
Syntax Description
error
Displays VP errors information of a redundancy group.
event
Displays VP event information of a redundancy group.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output from the debug redundancy application group vp event command:
Router# debug redundancy application group vp eventRG VP events debugging is onRelated Commands
group
To enter redundancy application group configuration mode, use the group command in redundancy application configuration mode. To remove the group configuration, use the no form of this command.
group id
no group id
Syntax Description
Command Default
No group is configured.
Command Modes
Redundancy application configuration (config-red-app)
Command History
Examples
The following example shows how to configure a redundancy group with group ID 1:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)# group 1Router(config-red-app-grp)#Related Commands
ip nat
To designate that traffic originating from or destined for the interface is subject to Network Address Translation (NAT), to enable NAT logging, or to enable static IP address support, use the ip nat command in interface configuration mode. To prevent the interface from being able to translate or log, use the no form of this command.
ip nat [inside | outside | Stateful | create | piggyback-support | pool | portmap | service | sip-sbc | source | log | translations | syslog | allow-static-host]
no ip nat [inside | outside | Stateful | create | piggyback-support | pool | portmap | service | sip-sbc | source | log | translations | syslog | allow-static-host]
Syntax Description
Command Default
Traffic leaving or arriving at this interface is not subject to NAT.
Command Modes
Interface configuration
Command History
ip nat create flow-entries
To create Network Address Translation (NAT) flow entries, use the ip nat create command in global configuration mode. To disable the flow cache, use the no form of this command.
ip nat create flow-entries
no ip nat create flow-entries
Syntax Description
This command has no arguments or keywords.
Command Default
Flow entries are created.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
To scale the performance of NAT, an enhancement is created that allows for a flow table for NAT entries.
Examples
The following example shows how to create NAT flow entries:
Router(config)# no ip nat create flow-entriesRelated Commands
ip nat enable
To configure an interface connecting Virtual Private Networks (VPNs) and the Internet for Network Address Translation (NAT), use the ip nat enable command in interface configuration mode.
ip nat enable
no ip nat enable
Syntax Description
This command has no arguments or keywords.
Command Modes
Interface configuration
Command History
Examples
The following example show how to configure an interface connecting VPNs and the Internet for NAT translation:
interface Ethernet0/0ip vrf forwarding vrf1ip address 192.168.122.1 255.255.255.0ip nat enableRelated Commands
ip nat inside destination
To enable the Network Address Translation (NAT) of a globally unique outside host address to multiple inside host addresses, use the ip nat inside destination command in global configuration mode. This command is primarily used to implement TCP load balancing by performing destination address rotary translation. To remove the dynamic association to a pool, use the no form of this command.
ip nat inside destination list {access-list-number | name} pool name [mapping-id map-id]
no ip nat inside destination list {access-list-number | name} pool name [mapping-id map-id]
Syntax Description
Defaults
No inside destination addresses are translated.
Command Modes
Global configuration
Command History
Usage Guidelines
To implement TCP load balancing, you must configure NAT to use rotary pools as specified with the
ip nat pool command and the rotary keyword.Packets from addresses that match the standard access list are translated using global addresses allocated from the pool named with the ip nat pool command.
For more information about implementing TCP load balancing, see the Cisco IOS IP Addressing Services Configuration Guide.
Examples
The following example shows how to define a virtual address with connections that are distributed among a set of real hosts. The rotary pool defines the addresses of the real hosts. The access list defines the virtual address. If a translation does not already exist, TCP packets from serial interface 0 (the outside interface) whose destination matches the access list are translated to an address from the rotary pool.
ip nat pool real-hosts 192.168.15.2 192.168.15.15 prefix-length 28 type rotaryip nat inside destination list 2 pool real-hosts!interface serial 0/0/0ip address 192.168.15.129 255.255.255.240ip nat outside!interface GigabitEthernet 0/0/1ip address 192.168.15.17 255.255.255.240ip nat inside!access-list 2 permit 192.168.15.1Related Commands
ip nat inside source
To enable Network Address Translation (NAT) of the inside source address, use the ip nat inside source command in global configuration mode. To remove the static translation, or the dynamic association to a pool, use the no form of this command.
Dynamic NAT
ip nat inside source {list {access-list-number | access-list-name} | route-map name} {interface type number | pool name} [no-payload] [overload] [reversible] [vrf name [match-in-vrf]] [oer] [portmap name]
no ip nat inside source {list {access-list-number | access-list-name} | route-map name} {interface type number | pool name} [no-payload] [overload] [reversible] [vrf name [match-in-vrf]] [oer] [portmap name]
Static NAT
ip nat inside source static {esp local-ip interface type number | local-ip global-ip} [extendable] [forced] [mapping-id map-id] [no-alias] [no-payload] [redundancy group-name] [route-map name [reversible]] [vrf name [match-in-vrf]]
no ip nat inside source static {esp local-ip interface type number | local-ip global-ip} [extendable] [forced] [mapping-id map-id] [no-alias] [no-payload] [redundancy group-name] [route-map name [reversible]] [vrf name [match-in-vrf]]
Port Static NAT
ip nat inside source static {{tcp | udp} {local-ip local-port global-ip global-port [extendable] [forced] [mapping-id map-id] [no-alias] [no-payload] [redundancy group-name] [route-map name [reversible]] [vrf name [match-in-vrf]] | interface global-port}}
no ip nat inside source static {tcp | udp {local-ip local-port global-ip global-port [extendable] [forced] [mapping-id map-id] [no-alias] [no-payload] [redundancy group-name] [route-map name [reversible]] [vrf name [match-in-vrf]] | interface global-port}}
Network Static NAT
ip nat inside source static network local-network global-network mask [extendable] [forced] [mapping-id map-id] [no-alias] [no-payload] [redundancy group-name] [vrf name [match-in-vrf]]
no ip nat inside source static network local-network global-network mask [extendable] [forced] [mapping-id map-id] [no-alias] [no-payload] [redundancy group-name] [vrf name [match-in-vrf]]
Syntax Description
Command Default
No NAT translation of inside source addresses occurs.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
The optional keywords of the ip nat inside source command can be entered in any order.
For information about the limitations when the ip nat inside source command was integrated into Cisco IOS XE Release 2.5, see the Cisco IOS XE 2 Release Notes.
This command has two forms: the dynamic and the static address translation. The form with an access list establishes the dynamic translation. Packets from addresses that match the standard access list are translated using global addresses allocated from the pool named with the ip nat pool command.
Packets that enter the router through the inside interface and packets sourced from the router are checked against the access list for possible NAT candidates. The access list is used to specify which traffic is to be translated.
Alternatively, the syntax form with the keyword static establishes a single static translation.
Note
When a session is initiated from outside with the source IP as the outside global address, the router is unable to determine the destination VRF of the packet. Use the match-in-vrf keyword to enable the IP alias installation to work correctly when routing NAT inside and outside traffic in the same VRF.
Examples
The following example shows how to translate between inside hosts addressed from either the 192.0.2.0 or the 198.51.100.0 network to the globally unique 203.0.113.209/28 network:
ip nat pool net-209 203.0.113.209 203.0.113.222 prefix-length 28ip nat inside source list 1 pool net-209!interface ethernet 0ip address 203.0.113.113 255.255.255.240ip nat outside!interface ethernet 1ip address 192.0.2.1 255.255.255.0ip nat inside!access-list 1 permit 192.0.2.1 255.255.255.0access-list 1 permit 198.51.100.253 255.255.255.0The following example shows how to translate the traffic that is local to the provider's edge device running NAT (NAT-PE):
ip nat inside source list 1 interface ethernet 0 vrf vrf1 overloadip nat inside source list 1 interface ethernet 0 vrf vrf2 overload!ip route vrf vrf1 10.0.0.1 10.0.0.1 192.0.2.1ip route vrf vrf2 10.0.0.1 10.0.0.1 192.0.2.1!access-list 1 permit 10.1.1.1 0.0.0.255!ip nat inside source list 1 interface ethernet 1 vrf vrf1 overloadip nat inside source list 1 interface ethernet 1 vrf vrf2 overload!ip route vrf vrf1 10.0.0.1 10.0.0.1 198.51.100.1 globalip route vrf vrf2 10.0.0.1 10.0.0.1 198.51.100.1 globalaccess-list 1 permit 10.1.1.0 0.0.0.255The following example shows how to translate sessions from outside-to-inside:
ip nat pool POOL-A 10.1.10.1 10.1.10.126 255.255.255.128ip nat pool POOL-B 10.1.20.1 10.1.20.126 255.255.255.128ip nat inside source route-map MAP-A pool POOL-A reversibleip nat inside source route-map MAP-B pool POOL-B reversible!ip access-list extended ACL-Apermit ip any 10.1.10.128 0.0.0.127ip access-list extended ACL-Bpermit ip any 10.1.20.128 0.0.0.127!route-map MAP-A permit 10match ip address ACL-A!route-map MAP-B permit 10match ip address ACL-B!The following example shows how to configure the route map R1 to allow outside-to-inside translation for static NAT:
ip nat inside source static 10.1.1.1 10.2.2.2 route-map R1 reversible!ip access-list extended ACL-Apermit ip any 10.1.10.128 0.0.0.127route-map R1 permit 10match ip address ACL-AThe following example shows how to configure NAT inside and outside traffic in the same VRF:
interface Loopback1ip vrf forwarding forwarding1ip address 192.0.2.11 255.255.255.0ip nat insideip virtual-reassembly!interface Ethernet0/0ip vrf forwarding forwarding2ip address 192.0.2.22 255.255.255.0ip nat outsideip virtual-reassemblyip nat pool MYPOOL 192.0.2.5 192.0.2.5 prefix-length 24ip nat inside source list acl-nat pool MYPOOL vrf vrf1 overload!!ip access-list extended acl-natpermit ip 192.0.2.0 0.0.0.255 anyRelated Commands
ip nat log translations flow-export
To enable high speed logging for all or some a Network Address Translation (NAT) translations, use the ip nat log translations flow-export command in global configuration mode. To remove one or more translations from the log, use the no form of this command.
ip nat log translations flow-export v9 {udp destination addr port source interface interface-number | {vrf-name | global-on}}
no ip nat log translations flow-export v9 {udp destination addr port source interface interface-number | {vrf-name | global-on}}
Syntax Description
Command Default
Logging is disabled for all translations
Command Modes
Global configuration (config)
Command History
Usage Guidelines
You must first use the ip nat log translations flow-export v9 udp destination command to enable high speed logging for all VPN and non-VPN translations. VPN translations are also know as VPN Routing and Forwarding (VRF) translations.
After you enable high speed logging for all NAT translations, you can then use the ip nat log translations flow-export v9 vrf-name command to enable or disable translations for specific VPNs. When you use this command, high speed logging is disabled for all VPNs except for the ones where it is explicitly enabled.
Examples
The following example shows how to enable logging for a specific VPN.
Router(config)# ip nat log translations flow-export v9 udp destination 10.10.0.1 1020 source Ethernet 0/0Router(config)# ip nat log translations flow-export v9 VPN-18Related Commands
ip nat log translations syslog
To define a set of log translations for Network Address Translation (NAT), use the ip nat log command in global configuration mode. To remove one or more translations from the log, use the no form of this command.
ip nat log translations syslog
no ip nat log translations syslog
Syntax Description
Command Default
No pool of addresses is defined.
Command Modes
Global configuration (config)
Command History
Examples
The following example shows how to define a set of log translations.
Router(config)# ip nat log translations syslogRelated Commands
ip nat outside source
To enable Network Address Translation (NAT) of the outside source address, use the ip nat outside source command in global configuration mode. To remove the static entry or the dynamic association, use the no form of this command.
Dynamic NAT
ip nat outside source {list {access-list-number | access-list-name} | route-map name} pool pool-name [add-route | mapping-id map-id | vrf name]
no ip nat outside source {list {access-list-number | access-list-name} | route-map name} pool pool-name [add-route | mapping-id map-id | vrf name]
Dynamic NAT for inter-chassis redundancy
ip nat outside source {list {access-list-number | access-list-name} | route-map name} pool pool-name vrf name redundancy group-ID mapping-id map-id [add-route]
no ip nat outside source {list {access-list-number | access-list-name} | route-map name} pool pool-name vrf name redundancy group-ID mapping-id map-id [add-route]
Static NAT
ip nat outside source static global-ip local-ip [add-route | extendable | mapping-id map-id | no-alias | no-payload | redundancy group-name | vrf name]
no ip nat outside source static global-ip local-ip [add-route | extendable | mapping-id map-id | no-alias | no-payload | redundancy group-name | vrf name]
Static NAT for inter-chassis redundancy
ip nat outside source static global-ip local-ip vrf name redundancy group-ID mapping-id map-id [add-route | extendable | no-alias | no-payload ]
no ip nat outside source static global-ip local-ip vrf name redundancy group-ID mapping-id map-id [add-route | extendable | no-alias | no-payload ]
Port Static NAT
ip nat outside source static {tcp | udp} global-ip global-port local-ip local-port [add-route | extendable | mapping-id map-id | no-alias | no-payload | redundancy group-name | vrf name]
no ip nat outside source static {tcp | udp} global-ip global-port local-ip local-port [add-route | extendable | mapping-id map-id | no-alias | no-payload | redundancy group-name | vrf name]
Port Static NAT for inter-chassis redundancy
ip nat outside source static {tcp | udp} global-ip global-port local-ip local-port vrf name redundancy group-ID mapping-id map-id [add-route | extendable | no-alias | no-payload ]
no ip nat outside source static {tcp | udp} global-ip global-port local-ip local-port vrf name redundancy group-ID mapping-id map-id [add-route | extendable | no-alias | no-payload ]
Network Static NAT
ip nat outside source static network global-network local-network mask [add-route | extendable | mapping-id map-id | no-alias | no-payload | redundancy | vrf name]
no ip nat outside source static network global-network local-network mask [add-route | extendable | mapping-id map-id no-alias | no-payload | redundancy | vrf name]
Network Static NAT for inter-chasis redundancy
ip nat outside source static network global-network local-network mask vrf name redundancy group-ID mapping-id map-id [add-route | extendable | no-alias | no-payload ]
no ip nat outside source static network global-network local-network mask vrf name redundancy group-ID mapping-id map-id [add-route | extendable | no-alias | no-payload ]
Syntax Description
Defaults
No translation of source addresses coming from the outside to the inside network occurs.
Command Modes
Global configuration
Command History
Usage Guidelines
For information about the limitations when this command was integrated into Cisco IOS XE Release 2.5, see the Cisco IOS XE 2 Release Notes.
You might have IP addresses that are not legal, officially assigned IP addresses. Perhaps you chose IP addresses that officially belong to another network. The case of an address used illegally and legally is called overlapping. You can use NAT to translate inside addresses that overlap with outside addresses. Use this command if your IP addresses in the stub network happen to be legitimate IP addresses belonging to another network, and you need to communicate with those hosts or routers.
This command has two general forms: dynamic and static address translation. The form with an access list establishes dynamic translation. Packets from addresses that match the standard access list are translated using global addresses allocated from the pool named with the ip nat pool command.
Alternatively, the syntax form with the static keyword establishes a single static translation.
Examples
The following example shows how to translate between inside hosts addressed from the 10.114.11.0 network to the globally unique 10.69.233.208/28 network. Further packets from outside hosts addressed from the 10.114.11.0 network (the true 10.114.11.0 network) are translated to appear to be from the 10.0.1.0/24 network.
ip nat pool net-208 10.69.233.208 10.69.233.223 prefix-length 28 ip nat pool net-10 10.0.1.0 10.0.1.255 prefix-length 24ip nat inside source list 1 pool net-208ip nat outside source list 1 pool net-10!interface ethernet 0ip address 10.69.232.182 255.255.255.240ip nat outside!interface ethernet 1ip address 10.114.11.39 255.255.255.0ip nat inside!access-list 1 permit 10.114.11.0 0.0.0.255The following example shows NAT configured on the Provider Edge (PE) router with a static route to the shared service for the group1 and group2 VPNs. NAT is configured as inside source static one-to-one translations.
ip nat pool outside 10.4.4.1 10.4.4.254 netmask 255.255.255.0ip nat outside source list 1 pool mypoolaccess-list 1 permit 10.58.18.0 0.0.0.255ip nat inside source static 192.168.121.33 10.2.2.1 vrf group1ip nat inside source static 192.169.121.33 10.2.2.2 vrf group2Related Commands
ip nat piggyback-support
To enable a Network Address Translation (NAT) optimized Session Initiation Protocol (SIP) media path, use the ip nat piggyback-support command in global configuration mode.
ip nat piggyback-support sip {all-messages | sdp-only} router router-id [authentication authentication-key]
no ip nat piggyback-support sip {all-messages | sdp-only} router router-id [authentication authentication-key]
Syntax Description
Command Modes
Global configuration (config)
Command History
Examples
The following example shows how to configure a NAT optimized SIP media path with SDP:
ip nat piggyback-support sip sdp-only router 100 authentication md5-keyRelated Commands
ip nat pool
To define a pool of IP addresses for Network Address Translation (NAT), use the ip nat pool command in global configuration mode. To remove one or more addresses from the pool, use the no form of this command.
ip nat pool name start-ip end-ip {netmask netmask | prefix-length prefix-length} [add-route] [type {match-host | rotary}] [accounting list-name] [arp-ping] [nopreservation]
no ip nat pool name start-ip end-ip {netmask netmask | prefix-length prefix-length} [add-route] [type {match-host | rotary}] [accounting list-name] [arp-ping] [nopreservation]
Syntax Description
Defaults
No pool of addresses is defined.
Command Modes
Global configuration
Command History
Usage Guidelines
This command defines a pool of addresses using start address, end address, and either netmask or prefix length. The pool could define an inside global pool, an outside local pool, or a rotary pool.
The nopreservation keyword is used after the prefix-length or netmask keywords. It turns off the default behavior, which is known as IP address reservation. The no form of the command with the nopreservation keyword enables the default behavior, and reserves the first IP address in the NAT pool, making it unavailable for dynamic translation.
Examples
The following example translates between inside hosts addressed from either the 192.168.1.0 or 192.168.2.0 network to the globally unique 10.69.233.208/28 network:
ip nat pool net-208 10.69.233.208 10.69.233.223 prefix-length 28ip nat inside source list 1 pool net-208!interface ethernet 0ip address 10.69.232.182 255.255.255.240ip nat outside!interface ethernet 1ip address 192.168.1.94 255.255.255.0ip nat inside!access-list 1 permit 192.168.1.0 0.0.0.255access-list 1 permit 192.168.2.0 0.0.0.255The following example shows that a route has been added to the NVI interface for the global address:
ip nat pool NAT 192.168.25.20 192.168.25.30 netmask 255.255.255.0 add-routeip nat source list 1 pool NAT vrf group1 overloadRelated Commands
ip nat service
To specify a port other than the default port, use the ip nat service command in global configuration mode. To disable the port, use the no form of this command.
ip nat service {H225 | allow-h323-even-rtp-ports | allow-h323-keepalive | allow-sip-even-rtp-ports | allow-skinny-even-rtp-ports | fullrange {tcp | udp} port port-number | list {access-list-number | access-list-name} {ESP spi-match | IKE preserve-port | ftp tcp port port-number} | alg {tcp | udp} dns | allow-multipart | mgcp | enable-mib | nbar | port-randomization | ras | rtsp | sip {tcp | udp} port port-number | skinny tcp port port-number}
no ip nat service {H225 | allow-h323-even-rtp-ports | allow-h323-keepalive | allow-sip-even-rtp-ports | allow-skinny-even-rtp-ports | fullrange {tcp | udp} port port-number | list {access-list-number | access-list-name} {ESP spi-match | IKE preserve-port | ftp tcp port port-number} | alg {tcp | udp} dns | allow-multipart | mgcp | enable-mib | nbar | port-randomization | ras | rtsp | sip {tcp | udp} port port-number | skinny tcp port port-number}
Syntax Description
Command Default
DNS ALG processing is enabled for TCP and UDP.
H.323 even-numbered RTP port allocation is enabled.
Port randomization is disabled.
RTSP is enabled and requires NBAR.
Skinny even-numbered RTP port allocation is enabled.
UDP SIP even-numbered RTP port allocation is enabled.
UDP SIP is enabled on port 5060.
UDP SIP multipart processing is disabled.Command Modes
Global configuration (config)
Command History
Usage Guidelines
A host with an FTP server using a port other than the default port can have an FTP client using the default FTP control port. When a port other than the default port is configured for an FTP server, Network Address Translation (NAT) prevents FTP control sessions that are using port 21 for that particular server. If an FTP server uses the default port and a port other than the default port, both ports need to be configured using the ip nat service command.
NAT listens on the default port of the Cisco CallManager to translate the skinny messages. If the Cisco CallManager uses a port other than the default port, that port needs to be configured using the ip nat service command.
Use the no ip nat service H225 command to disable support of H.225 packets by NAT.
Use the no ip nat service allow-h323-even-rtp-ports command to force odd-numbered RTP port allocation for H.323.
Use the no ip nat service allow-sip-even-rtp-ports command to force odd-numbered RTP port allocation for SIP.
Use the no ip nat service allow-skinny-even-rtp-ports command to force odd-numbered RTP port allocation for the skinny protocol.
Use the no ip nat service rtsp command to disable support of RTSP packets by NAT. RSTP uses port 554.
By default SIP is enabled on port 5060; therefore NAT-enabled devices interpret all packets on this port as SIP call messages. If other applications in the system use port 5060 to send packets, the NAT service may corrupt the packet as it attempts to interpret the packet as a SIP call message.
A NAT-enabled Cisco device that is running Cisco IOS Release 12.3(7)T or a later release may experience an increase in CPU usage when upgrading from a previous release. RTSP and MGCP NAT ALG support was added in Cisco IOS Release 12.3(7)T, which requires NBAR. You can use the no ip nat service nbar command to disable NBAR processing, which can decrease the CPU utilization rate.
The port-randomization keyword can be used to prevent a security threat caused by the possibility of of predicting the next port number that NAT will allocate. This security threat is described in the Cisco Security Advisory titled Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks. Port randomization has the following limitations:
•
•
Use the ip nat service allow-multipart command to enable the processing of SIP multipart Session Description Protocol (SDP) packets.
NAT MIB support is turned off by default to avoid breakpoint exception crashes. To enable NAT MIB support, use the enable-mib keyword.
Examples
The following example shows how to configure the nonstandard port 2021:
ip nat service list 10 ftp tcp port 2021access-list 10 permit 10.1.1.1The following example shows how to configure the standard FTP port 21 and the nonstandard port 2021:
ip nat service list 10 ftp tcp port 21ip nat service list 10 ftp tcp port 2021access-list 10 permit 10.1.1.1The following example shows how to configure the 20002 port of the Cisco CallManager:
ip nat service skinny tcp port 20002The following example shows how to configure TCP port 500 of the third-party concentrator:
ip nat service list 10 IKE preserve-portThe following example shows how to configure SPI matching on the endpoint routers:
ip nat service list 10 ESP spi-matchRelated Commands
ip nat service dns-reset-ttl
To reset the time-to-live (TTL) value for Domain Name System (DNS) resource records (RRs) going through Network Address Translation (NAT) to zero (0), use the ip nat service dns-reset-ttl command in global configuration mode. To prevent the TTL value for a DNS RR from being set to 0, use the no form of this command.
ip nat service dns-reset-ttl
no ip nat service dns-reset-ttl
Syntax Description
This command has no arguments or keywords.
Command Default
The TTL value is set to 0 for DNS RRs going through NAT.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
RFC 2694, DNS extensions to Network Address Translators (DNS_ALG), states that the TTL value supplied in the original RRs for static address assignments is left unchanged. For dynamic address assignments, DNS_ALG will modify the TTL to be 0, so the RRs are used just for the transaction in progress, and not cached. RFC 2181, Clarifications to the DNS Specification, requires all RRs in an RRset (RRs with the same name, class, and type, but with different RDATA) to have the same TTL. So if the TTL of an RR is set to 0, all other RRs within the same RRset will also be adjusted by the DNS_ALG to be 0.
The ip nat service dns-reset-ttl command allows you to modify this behavior. The TTL values on all DNS RRs passing through NAT are set to 0 by default. This means that DNS servers or clients do not cache temporarily assigned RRs. Use the no ip nat service dns-reset-ttl command to disable the TTL value from being set to 0, and use the ip nat service dns-reset-ttl command to allow the TTL value to be reset to 0 again.
You may want to have a TTL value of 0 to prevent nonauthoritative servers from caching DNS RRs, perhaps in advance of changing a server's IP address. Allowing a nonzero value for DNS RRs enables remote name servers to cache the DNS RR information for a longer period of time, reducing the number of queries for the RR, while having the effect of lengthening the amount of time required to proliferate RR changes simultaneously.
Examples
The following example shows how to prevent DNS RRs that pass through NAT from having their TTL values set to 0:
Router(config)# no ip nat service dns-reset-ttlRelated Commands
ip nat service enable-sym-port
To enable the endpoint agnostic port allocation, use the ip nat service enable-sym-port command in global configuration mode. To disable the endpoint agnostic port allocation, use the no form of this command.
ip nat service enable-sym-port
no ip nat service enable-sym-port
Syntax Description
This command has no arguments or keywords.
Command Default
If you do not issue this command, the endpoint agnostic port allocation is disabled.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Use the ip nat service enable-sym-port command to enable the endpoint agnostic port allocation, which is also known as symmetric port allocation.
Note
Examples
In the following example, an access list is created and the inside source address is translated using NAT. The endpoint agnostic port allocation is enabled after the inside source address is translated.
Router(config)# interface Ethernet 0/0Router(config-if)# ip nat insideRouter(config-if)# exitRouter(config)# access list 1 permit 172.18.192.0 0.0.0.255Router(config)# ip nat inside source list 1 interface Ethernet 0/0Router(config)# ip nat service enable-sym-portRouter(config)# endFollowing are the list of entries which are made to the SymmetricPort (Sym Port) table, debugs, and Symmetric DB (Sym DB) when the command is issued and when the command is not entered:
NAT Symmetric Port Database: 1 entries public ipaddr:port [tableid] | port# [refcount][syscount] | localaddr:localport [flags] 172.18.192.69:1024 [0] | 1025 [1] [0] | 172.18.192.69:1024 [0]Sample SymPort Debugs:If SymDB is not enabled or initiated: NAT-SymDB: DB is either not enabled or not initiated.If an entry needs to be inserted into SymDB:NAT-SymDB: insert 172.18.192.69 1024 0172.18.192.69 is the local address, 1024 is the local port, and 0 is the tableidIf SymDB lookup found an entry: NAT-SymDB: [0] Entry was found for 172.18.192.69 -> 10.10.10.1: wanted 1024 got 1025 172.18.192.69 is the local address, 10.10.10.1 is the global address, 1024 is the requested port, and 1025 is the allocated portIf entry was deleted from SymDB: NAT-SymDB: deleting entry 172.18.192.69:1024172.18.192.69 is the local address, 1024 is the local port.Related Commands
show ip nat translations
Displays the list of translations entries.
show ip nat statistics
Displays the entries in the symmetric port database
ip nat sip-sbc
To configure a Cisco IOS hosted Network Address Translation (NAT) traversal for Session Border Controller (SBC), use the ip nat sip-sbc command in global configuration mode. To disable the Cisco IOS hosted NAT traversal for SBC, use the no form of this command.
ip nat sip-sbc proxy inside-address inside-port outside-address outside-port {tcp | udp} [call-id-pool pool-name] [override {address | none | port}] [mode allow-flow-around] [mode allow-flow-through pool-name] [session-timeout {seconds | nat-default}] [registration-throttle inside-timeout seconds outside-timeout seconds] [vrf-list vrf-name vrf-name | no | exit]
no ip nat sip-sbc proxy inside-address inside-port outside-address outside-port {tcp | udp} [call-id-pool pool-name] [override {address | none | port}] [mode allow-flow-around] [mode allow-flow-through pool-name] [session-timeout {seconds | nat-default}] [registration-throttle inside-timeout seconds outside-timeout seconds] [vrf-list vrf-name vrf-name | no | exit]
Syntax Description
Command Default
Disabled
Command Modes
Global configuration
Command History
12.4(9)T
This command was introduced.
12.4(15)T
The allow-flow-through and registration-throttle sub commands were added.
Usage Guidelines
The proxy keyword configures the address or port, which the inside phones refer to, and it configures the outside proxy's address or port that the NAT SBC translates the destination IP address or port. This keyword installs an outside static port half-entry with OL as the inside address or port and OG as the outside address or port.
The mode allow-flow-around keyword enables the RTP to be flow around. This keyword is only applicable for traffic between phones in the inside domain.
The optional vrf-list keyword must be followed by a list of VRF names. After the outside static port entry is created, a static route is installed wit the destination IP address as OL and next hop as OG. The NAT entry created is associated with appropriate VRFs as configured by this command.
Examples
The following example shows how to configure a Cisco IOS hosted NAT traversal for SBC:
interface ethernet1/1ip nat insideip forwarding A!interface ethernet1/2ip nat insideip forwarding B!interface ethernet1/3ip nat outside!ip nat pool call-id-pool 1.1.1.1 1.1.1.100ip nat pool outside-pool 2.2.2.1.1.1 2.2.2.1.1.10ip nat pool inside-pool-A 169.1.1.1 169.1.1.10ip nat pool inside-pool-B 170.1.1.1 170.1.1.10ip nat inside source list 1 pool inside-pool-A vrf A overloadip nat inside source list 2 pool inside-pool-B vrf B overloadip nat outside list 3 pool outside-poolip nat inside source list 4 pool call-id-pool!access-list for VRF-A inside-phonesaccess-list 1 permit 10.1.1.0 0.0.0.255access-list 2 permit 172.1.1.0 0.0.0.255!access-=list for call-id-poolaccess-list 4 permit 10.1.1.0 0.0.0.255access-list 4 permit 20.1.1.0 0.0.0.255!ip nat sip-sbcproxy 200.1.1.1 5060 192.1.1.1 5060 protocol udpvrf-listvrf-name Avrf-name Bcall-id-pool call-id-poolsession-timeout 300mode allow-flow-aroundoverride addressRelated Commands
ip nat source
To enable Network Address Translation (NAT) on a virtual interface without inside or outside specification, use the ip nat source command in global configuration mode.
Dynamic NAT
ip nat source {list {access-list-number | access-list-name} interface type number | pool name} [overload | vrf name]
no ip nat source {list {access-list-number | access-list-name} interface type number | pool name} overload | vrf name]
Static NAT
ip nat source {static {esp local-ip interface type number | local-ip global-ip}} [extendable | no-alias | no-payload | vrf name]
no ip nat source {static {esp local-ip interface type number | local-ip global-ip}} [extendable | no-alias | no-payload | vrf name]
Port Static NAT
ip nat source {static {tcp | udp {local-ip local-port global-ip global-port | interface type number global-port}} [extendable | no-alias | no-payload | vrf name]
no ip nat source {static {tcp | udp {local-ip local-port global-ip global-port | interface type number global-port}} [extendable | no-alias | no-payload | vrf name]
Network Static NAT
ip nat source static network local-network global-network mask [extendable | no-alias | no-payload | vrf name]
no ip nat source static network local-network global-network mask [extendable | no-alias | no-payload | vrf name]
Syntax Description
Command Modes
Global Configuration
Command History
Examples
The following example shows how to configure a virtual interface without inside or outside specification for the global address:
ip nat source list 1 pool NAT vrf bank overloadip nat source list 1 pool NAT vrf park overloadip nat source static 192.168.123.1 192.168.125.10 vrf servicesRelated Commands
ip nat enable
Configures an interface connecting VPNs and the Internet for NAT translation.
ip nat pool
Defines a pool of IP addresses for Network Address Translation.
ip nat stateful id
To designate the members of a translation group, use the ip nat stateful id command in global configuration mode. To disable the members of a translation group or reset default values, use the no form of this command.
ip nat stateful id id-number {redundancy name mapping-id map-number [protocol {tcp | udp}] [as-queuing {disable | enable}] | {primary ip-address-primary backup ip-address-backup peer ip-address-peer mapping-id mapping-id-number}
no ip nat stateful id id-number
Syntax Description
Command Modes
Global configuration
Command History
Usage Guidelines
This command has two forms: HSRP stateful NAT and manual stateful NAT. The form that uses the keyword redundancy establishes the HSRP redundancy method. When HSRP mode is set, the primary and backup NAT routers are elected according to the HSRP standby state. To enable stateful NAT manually, configure the primary router and backup router.
In HSRP mode, the default TCP can be changed to UDP by using the optional protocol udp keywords with the redundancy keyword.
To disable the queuing during asymmetric routing in HSRP mode, use the optional as-queuing disable keywords with the redundancy keyword.
Examples
The following example shows how to configure SNAT with HSRP:
!standby delay minimum 30 reload 60standby 1 ip 10.1.1.1standby 1 name SNATHSRPstandby 1 preempt delay minimum 60 reload 60 sync 60!ip nat Stateful id 1redundancy SNATHSRPmapping-id 10as-queuing disableprotocol udpip nat pool SNATPOOL1 10.1.1.1 10.1.1.9 prefix-length 24ip nat inside source route-map rm-101 pool SNATPOOL1 mapping-id 10 overloadip classlessip route 10.1.1.0 255.255.255.0 Null0no ip http serverip pim bidir-enableThe following example shows how to manually configure SNAT:
ip nat stateful id 1primary 10.88.194.17peer 10.88.194.18mapping-id 10ip nat stateful id 2backup 10.88.194.18peer 10.88.194.17mapping-id 10Related Commands
ip nat translation
The ip nat translation command is replaced by the ip nat translation (timeout) and ip nat translation max-entries commands. See these commands for more information.
ip nat translation (timeout)
To change the amount of time after which Network Address Translation (NAT) translations time out, use the ip nat translation command in global configuration mode. To disable the timeout, use the no form of this command.
ip nat translation {arp-ping-timeout | dns-timeout | finrst-timeout | icmp-timeout | port-timeout {tcp port-number | udp port-number} | pptp-timeout | routemap-entry-timeout | syn-timeout | tcp-timeout | timeout | udp-timeout} {seconds | never}
no ip nat translation {arp-ping-timeout | dns-timeout | finrst-timeout | icmp-timeout | port-timeout {tcp port-number | udp port-number} | pptp-timeout | routemap-entry-timeout | syn-timeout | tcp-timeout | timeout | udp-timeout}
Syntax Description
Defaults
timeout: 86,400 seconds (24 hours)
udp-timeout: 300 seconds (5 minutes)
dns-timeout: 60 seconds (1 minute)
tcp-timeout: 86,400 seconds (24 hours)
finrst-timeout: 60 seconds (1 minute)
icmp-timeout: 60 seconds (1 minute)
pptp-timeout: 86,400 seconds (24 hours)
syn-timeout: 60 seconds (1 minute)Command Modes
Global configuration (config)
Command History
Usage Guidelines
When port translation is configured, each entry contains more context about the traffic that is using it, which gives you finer control over translation entry timeouts. Non-DNS UDP translations time out after 5 minutes, and DNS times out in 1 minute. TCP translations time out in 24 hours, unless an rapid spanning-tree (RST) or FIN bit is seen on the stream, in which case they will time out in 1 minute.
Examples
The following example shows how to configure the router to cause UDP port translation entries to time out after 10 minutes (600 seconds):
Router# configure terminalRouter(config)# ip nat translation udp-timeout 600Related Commands
ip nat translation max-entries
To limit the size of a Network Address Translation (NAT) table to a specified maximum, use the ip nat translation max-entries command in global configuration mode. To remove a specified limit, use the no form of this command.
ip nat translation max-entries [all-host | all-vrf | host ip-address | list {listname | listnumber} | vrf name] number
no ip nat translation max-entries [all-host | all-vrf | host ip-address | list {listname | listnumber} | vrf name] number
Syntax Description
Command Default
No maximum size is specified for the NAT table.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Before you configure a NAT rate limit, you must first classify the current NAT usage and determine the sources of requests for NAT translations. If a specific host, an access control list, or a VRF instance is generating an unexpectedly high number of NAT requests, it may be the source of a virus or worm attack.
Once you have identified the source of excess NAT requests, you can set a NAT rate limit that constrains a specific host, access control list, or VRF instance, or you can set a general limit for the maximum number of NAT requests allowed regardless of their source.
Note
Examples
The following examples show how to configure the rate-limiting NAT translation.
Setting a General NAT Limit
The following example shows how to limit the maximum number of allowed NAT entries to 300:
ip nat translation max-entries 300Setting NAT Limits for VRF Instances
The following example shows how to limit each VRF instance to 200 NAT entries:
ip nat translation max-entries all-vrf 200The following example shows how to limit the VRF instance named vrf1 to 150 NAT entries:
ip nat translation max-entries vrf vrf1 150The following example shows how to limit the VRF instance named vrf2 to 225 NAT entries, but limit all other VRF instances to 100 NAT entries each:
ip nat translation max-entries all-vrf 100ip nat translation max-entries vrf vrf2 225Setting NAT Limits for Access Control Lists
The following example shows how to limit the access control list named vrf3 to 100 NAT entries:
ip nat translation max-entries list vrf3 100Setting NAT Limits for an IP Address
The following example shows how to limit the host at IP address 10.0.0.1 to 300 NAT entries:
ip nat translation max-entries host 10.0.0.1 300Related Commands
name
To configure the redundancy group with a name, use the name command in redundancy application group configuration mode. To remove the name of a redundancy group, use the no form of this command.
name group-name
no name group-name
Syntax Description
Command Default
The redundancy group is not configured with a name.
Command Modes
Redundancy application group configuration (config-red-app-grp)
Command History
Examples
The following example shows how to configure the redundancy group name as group1:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)# group 1Router(config-red-app-grp)# name group1Related Commands
application redundancy
Enters redundancy application configuration mode.
group
Enters redundancy application group configuration mode.
shutdown
Shuts down a group manually.
nat64 enable
To enable stateless Network Address Translation 64 (NAT64) on an interface, use the nat64 enable command in interface configuration mode. To disable the NAT64 configuration on an interface, use the no form of this command.
nat64 enable
no nat64 enable
Syntax Description
This command has no arguments or keywords.
Command Default
NAT64 is not enabled on an interface.
Command Modes
Interface configuration (config-if)
Command History
Examples
The following example shows how to enable stateless NAT64 on a Gigabit Ethernet interface:
Router# configure terminalRouter(config)# interface gigabitethernet0/0/0Router(config-if)# nat64 enableRouter(config-if)# endRelated Commands
nat64 prefix
To assign a global or interface-specific Network Address Translation 64 (NAT64) stateless prefix, use the nat64 prefix command in global configuration or interface configuration mode. To disable the configuration, use the no form of this command.
nat64 prefix stateless ipv6-prefix/prefix-length
no nat64 prefix stateless
Syntax Description
Command Default
No NAT64 translation is performed.
Command Modes
Global configuration (config)
Interface configuration (config-if)Command History
Usage Guidelines
The nat64 prefix stateless command uses a prefix and prefix length for IPv4-translatable IPv6 addresses. Use the nat64 prefix stateless command in global configuration mode to assign a global NAT64 stateless prefix or in interface configuration mode to assign an unique NAT64 stateless prefix for each interface. In interface configuration mode, a stateless prefix should be configured on an IPv6-facing interface.
All packets coming to an IPv6 interface are matched against the configured prefix, and the matched packets are translated to IPv4. Similarly, the packets that the IPv6 interface sends use the stateless prefix to construct the source and destination IPv6 address.
Note
If NAT64 is enabled on an interface that does not have a stateless prefix configured, then the global stateless prefix is used. However, if a global prefix and an interface prefix are configured, then the interface prefix is used for stateless NAT64 translation. The use of a stateless prefix on an interface has priority over the configured global stateless prefix.
Examples
The following example shows how to configure a global NAT64 stateless prefix:
Router# configure terminalRouter(config)# nat64 prefix stateless 2001::7001:10A/96Router(config)# endThe following example shows how to assign a NAT64 stateless prefix for a Gigabit Ethernet interface:
Router# configure terminalRouter(config)# interface gigabitethernet0/0/0Router(config-if)# nat64 prefix stateless 2001:0DB8:0:1::/96Router(config-if# endRelated Commands
nat64 route
To specify the Network Address Translation 64 (NAT64) stateless prefix to which an IPv4 prefix should be translated, use the nat64 route command in global configuration mode. To disable the configuration, use the no form of this command.
nat64 route ipv4-prefix/mask interface-type interface-number
no nat64 route ipv4-prefix/mask
Syntax Description
Command Default
No NAT64 routing is performed.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
A prefix that is configured on an interface is used as the stateless prefix on that interface. If no interface-specific prefix is configured, the configured global prefix is used for NAT64 translation.
Examples
The following example shows how to assign an IPv4 prefix and mask to an interface:
Router# configure terminalRouter(config)# nat64 route 192.168.0.0/24 gigabitethernet0/0/1Router(config)# exitRelated Commands
nat64 prefix stateless
Assigns a global or interface-specific NAT64 stateless prefix.
show nat64 routes
Displays information about the configured NAT64 routes.
preempt
To enable preemption on the redundancy group, use the preempt command in redundancy application group configuration mode. To disable the group's preemption, use the no form of this command.
preempt
no preempt
Syntax Description
This command has no arguments or keywords.
Command Default
Preemption is disabled on the redundancy group.
Command Modes
Redundancy application group configuration (config-red-app-grp)
Command History
Usage Guidelines
When the preemption is enabled, it means that a standby redundancy group should preempt an active redundancy group if its priority is higher than the active redundancy group.
Examples
The following example shows how to enable preemption on the redundancy group:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)# group 1Router(config-red-app-grp) preemptRelated Commands
priority
To specify a group priority and failover threshold value in a redundancy group, use the priority command in redundancy application group configuration mode. To disable the priority value of a group, use the no form of this command.
priority value [failover-threshold value]
no priority value [failover-threshold value]
Syntax Description
value
The priority value. The range is from 1 to 255.
failover-threshold value
(Optional) Specifies the failover threshold value. The range is from 1 to 255.
Command Default
The default priority value is 100.
Command Modes
Redundancy application group configuration (config-red-app-grp)
Command History
Usage Guidelines
The priority of the redundancy group is used to determine a redundancy group's active or standby role on the configured node. The failover threshold is used to determine when a switchover must occur. After the priority is set under threshold, the active redundancy group gives up its role.
Examples
The following example shows how to configure the priority value and threshold value for the redundancy group named group1:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)# group 1Router(config-red-app-grp) priority 100 failover-threshold 90Related Commands
protocol
To define a protocol instance in a redundancy group, use the protocol command in redundancy application group configuration mode. To remove the protocol instance from the redundancy group, use the no form of this command.
protocol id
no protocol id
Syntax Description
Command Default
Protocol instance is not defined in a redundancy group.
Command Modes
Redundancy application group configuration (config-red-app-grp)
Command History
Usage Guidelines
Protocol configuration is used to configure timers and authentication method for a control interface. Thus, a protocol instance is attached to the control interface.
Examples
The following example shows how to configure a protocol named protocol 1 to a redundancy group:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)# protocol 1Related Commands
redundancy application reload group
To manually force a state switchover for the redundancy group, use the redundancy application reload group command in user EXEC or privileged EXEC mode. To remove virtual IP address from the redundancy group, use the no form of this command.
redundancy application reload group id [peer | self ]
Syntax Description
id
Redundancy group ID.
peer
Force the peer in the redundancy group to reload.
self
Force this member of the redundancy group to reload.
Command Default
Forces this member of the redundancy group to reload.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
You can use this command to reload the peer only on the active member of the redundancy group to reload the standby member of the redundancy group.
Examples
The following example shows how to reload the standby peer in a redundancy group:
Router# redundancy application reload group 2 peerRelated Commands
redundancy group
To configure the virtual IP address for the redundancy group, use the redundancy group command in interface configuration mode. To remove virtual IP address from the redundancy group, use the no form of this command.
redundancy group id ip address exclusive [decrement value]
no redundancy group id ip address exclusive [decrement value]
Syntax Description
Command Default
Virtual IP address is not configured.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
The virtual IP address and the physical address must in the same subnet.
Examples
The following example shows how to configure the redundancy group redundancy traffic interface:
Router# configure terminalRouter(config)# interface GigabitEthernet0/1/1Router(config-if)# redundancy group 2 ip 1.2.3.4 exclusiveRelated Commands
redundancy rii
To configure the redundancy interface identifier (RII) for the redundancy group protected traffic interfaces, use the redundancy rii command in interface configuration mode. To remove the control interface from the redundancy group, use the no form of this command.
redundancy rii id
no redundancy rii id
Syntax Description
Command Default
RII is not configured.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Every interface associated with one or more Redundancy Groups must have a unique RII assigned to it. RII allows interfaces to have a one-to-one mapping between peers.
Examples
The following example shows how to configure the RII for the Gigabit Ethernet interface:
Router# configure terminalRouter(config)# interface GigabitEthernet 0/0/0Router(config-if)# redundancy rii 100Related Commands
show ip nat nvi statistics
To display NAT virtual interface (NVI) statistics, use the show ip nat nvi statistics command in user EXEC or privileged EXEC mode.
show ip nat nvi statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Examples
The following is sample output from the show ip nat nvi statistics command:
Router# show ip nat nvi statisticsTotal active translations: 0 (0 static, 0 dynamic; 0 extended) NAT Enabled interfaces:Hits: 0 Misses: 0CEF Translated packets: 0, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings:-- Inside Source[Id: 1] access-list 1 pool pool1 refcount 1213 pool pool1: netmask 255.255.255.0start 192.168.1.10 end 192.168.1.253start 192.168.2.10 end 192.168.2.253start 192.168.3.10 end 192.168.3.253start 192.168.4.10 end 192.168.4.253type generic, total addresses 976, allocated 222 (22%), misses 0[Id: 2] access-list 5 pool pool2 refcount 0 pool pool2: netmask 255.255.255.0start 192.168.5.2 end 192.168.5.254type generic, total addresses 253, allocated 0 (0%), misses 0[Id: 3] access-list 6 pool pool3 refcount 3 pool pool3: netmask 255.255.255.0start 192.168.6.2 end 192.168.6.254type generic, total addresses 253, allocated 2 (0%), misses 0[Id: 4] access-list 7 pool pool4 refcount 0 pool pool4 netmask 255.255.255.0start 192.168.7.30 end 192.168.7.200type generic, total addresses 171, allocated 0 (0%), misses 0[Id: 5] access-list 8 pool pool5 refcount 109195 pool pool5: netmask 255.255.255.0start 192.168.10.1 end 192.168.10.253start 192.168.11.1 end 192.168.11.253start 192.168.12.1 end 192.168.12.253start 192.168.13.1 end 192.168.13.253start 192.168.14.1 end 192.168.14.253start 192.168.15.1 end 192.168.15.253start 192.168.16.1 end 192.168.16.253start 192.168.17.1 end 192.168.17.253start 192.168.18.1 end 192.168.18.253start 192.168.19.1 end 192.168.19.253start 192.168.20.1 end 192.168.20.253start 192.168.21.1 end 192.168.21.253start 192.168.22.1 end 192.168.22.253start 192.168.23.1 end 192.168.23.253start 192.168.24.1 end 192.168.24.253start 192.168.25.1 end 192.168.25.253start 192.168.26.1 end 192.168.26.253type generic, total addresses 4301, allocated 3707 (86%),misses 0 Queued Packets:0Table 36 describes the fields shown in the display.
Related Commands
show ip nat nvi translations
Displays active NAT virtual interface translations.
show ip nat nvi translations
To display active NAT virtual interface (NVI) translations, use the show ip nat nvi translations command in user EXEC or privileged EXEC mode.
show ip nat nvi translations [protocol [global | vrf vrf-name] | vrf vrf-name | global] [verbose]
Syntax Description
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Examples
The following is sample output from the show ip nat nvi translations command:
Router# show ip nat nvi translationsPro Source global Source local Destin local Destin globalicmp 172.20.0.254:25 172.20.0.130:25 172.20.1.1:25 10.199.199.100:25icmp 172.20.0.254:26 172.20.0.130:26 172.20.1.1:26 10.199.199.100:26icmp 172.20.0.254:27 172.20.0.130:27 172.20.1.1:27 10.199.199.100:27icmp 172.20.0.254:28 172.20.0.130:28 172.20.1.1:28 10.199.199.100:28Table 37 describes the fields shown in the display.
Related Commands
show ip nat statistics
To display Network Address Translation (NAT) statistics, use the show ip nat statistics command in EXEC mode.
show ip nat statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Examples
The following is sample output from the show ip nat statistics command:
Router# show ip nat statisticsTotal translations: 2 (0 static, 2 dynamic; 0 extended)Outside interfaces: Serial0Inside interfaces: Ethernet1Hits: 135 Misses: 5Expired translations: 2Dynamic mappings:-- Inside Sourceaccess-list 1 pool net-208 refcount 2pool net-208: netmask 255.255.255.240start 172.16.233.208 end 172.16.233.221type generic, total addresses 14, allocated 2 (14%), misses 0Table 38 describes the significant fields shown in the display.
Related Commands
show ip nat translations
To display active Network Address Translation (NAT) translations, use the show ip nat translations command in EXEC mode.
show ip nat translations [inside global-ip] [outside local-ip] [esp] [icmp] [pptp] [tcp] [udp] [verbose] [vrf vrf-name]
Syntax Description
Command Modes
EXEC
Command History
Examples
The following is sample output from the show ip nat translations command. Without overloading, two inside hosts are exchanging packets with some number of outside hosts.
Router# show ip nat translationsPro Inside global Inside local Outside local Outside global--- 10.69.233.209 192.168.1.95 --- ------ 10.69.233.210 192.168.1.89 --- --With overloading, a translation for a Domain Name Server (DNS) transaction is still active, and translations for two Telnet sessions (from two different hosts) are also active. Note that two different inside hosts appear on the outside with a single IP address.
Router# show ip nat translationsPro Inside global Inside local Outside local Outside globaludp 10.69.233.209:1220 192.168.1.95:1220 172.16.2.132:53 172.16.2.132:53tcp 10.69.233.209:11012 192.168.1.89:11012 172.16.1.220:23 172.16.1.220:23tcp 10.69.233.209:1067 192.168.1.95:1067 172.16.1.161:23 172.16.1.161:23The following is sample output that includes the verbose keyword:
Router# show ip nat translations verbosePro Inside global Inside local Outside local Outside globaludp 172.16.233.209:1220 192.168.1.95:1220 172.16.2.132:53 172.16.2.132:53create 00:00:02, use 00:00:00, flags: extendedtcp 172.16.233.209:11012 192.168.1.89:11012 172.16.1.220:23 172.16.1.220:23create 00:01:13, use 00:00:50, flags: extendedtcp 172.16.233.209:1067 192.168.1.95:1067 172.16.1.161:23 172.16.1.161:23create 00:00:02, use 00:00:00, flags: extendedThe following is sample output that includes the vrf keyword:
Router# show ip nat translations vrf abcPro Inside global Inside local Outside local Outside global--- 10.2.2.1 192.168.121.113 --- ------ 10.2.2.2 192.168.122.49 --- ------ 10.2.2.11 192.168.11.1 --- ------ 10.2.2.12 192.168.11.3 --- ------ 10.2.2.13 172.16.5.20 --- ---Pro Inside global Inside local Outside local Outside global--- 10.2.2.3 192.168.121.113 --- ------ 10.2.2.4 192.168.22.49 --- ---The following is sample output that includes the esp keyword:
Router# show ip nat translations espPro Inside global Inside local Outside local Outside globalesp 192.168.22.40:0 192.168.122.20:0 192.168.22.20:0 192.168.22.20:28726CD9esp 192.168.22.40:0 192.168.122.20:2E59EEF5 192.168.22.20:0 192.168.22.20:0The following is sample output that includes the esp and verbose keywords:
Router# show ip nat translation esp verbosePro Inside global Inside local Outside local Outside globalesp 192.168.22.40:0 192.168.122.20:0 192.168.22.20:0 192.168.22.20:28726CD9create 00:00:00, use 00:00:00,flags:extended, 0x100000, use_count:1, entry-id:192, lc_entries:0esp 192.168.22.40:0 192.168.122.20:2E59EEF5 192.168.22.20:0 192.168.22.20:0create 00:00:00, use 00:00:00, left 00:04:59, Map-Id(In):20,flags:extended, use_count:0, entry-id:191, lc_entries:0The following is sample output that includes the inside keyword:
Router# show ip nat translations inside 10.69.233.209Pro Inside global Inside local Outside local Outside globaludp 10.69.233.209:1220 192.168.1.95:1220 172.16.2.132:53 172.16.2.132:53Table 39 describes the significant fields shown in the display.
Related Commands
show ip snat
To display active Stateful Network Address Translation (SNAT) translations, use the show ip snat command in EXEC mode.
show ip snat [distributed [verbose] | peer ip-address]
Syntax Description
Command Modes
EXEC
Command History
Examples
The following is sample output from the show ip snat distributed command for stateful NAT connected peers:
Router# show ip snat distributedStateful NAT Connected PeersSNAT: Mode PRIMARY:State READY:Local Address 192.168.123.2:Local NAT id 100:Peer Address 192.168.123.3:Peer NAT id 200:Mapping List 10The following is sample output from the show ip snat distributed verbose command for stateful NAT connected peers:
Router# show ip snat distributed verboseSNAT: Mode PRIMARYStateful NAT Connected Peers:State READY:Local Address 192.168.123.2:Local NAT id 100:Peer Address 192.168.123.3:Peer NAT id 200:Mapping List 10:InMsgs 7, OutMsgs 7, tcb 0x63EBA408, listener 0x0show nat64 adjacency
To display information about the stateless Network Address Translation 64 (NAT64) managed adjacencies, use the show nat64 adjacency command in user EXEC or privileged EXEC mode.
show nat64 adjacency {all | count | ipv4 | ipv6}
Syntax Description
all
Displays all adjacencies.
count
Displays the adjacency count.
ipv4
Displays IPv4 adjacencies.
ipv6
Displays IPv6 adjacencies.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
An adjacency is a node that can be reached by one Layer 2 hop. The stateless NAT64 adjacencies include adjacency addresses and the total number of adjacencies.
Examples
The following is sample output from the show nat64 adjacency all command:
Router# show nat64 adjacency allAdjacency CountsIPv4 Adjacencies: 2IPv6 Adjacencies: 1Stateless Prefix Adjacency Ref Count: 1AdjacenciesIPv6 Adjacencies::42IPv4 Adjacencies0.0.19.137 (5001)0.0.19.140 (5004)Table 40 describes the significant fields shown in the display.
Table 40 show nat64 adjacency all Field Descriptions
Adjacency Counts
Count of all adjacencies.
Adjacencies
Types of adjacencies.
Related Commands
show nat64 ha status
To display information about the stateless Network Address Translation 64 (NAT64) high availability (HA) status, use the show nat64 ha status command in user EXEC or privileged EXEC mode.
show nat64 ha status
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Examples
The following is sample output from the show nat64 ha status command:
Router# show nat64 ha statusNAT64 HA StatusRole: activePeer is ready: TRUEPeer is compatible: TRUESynchronization enabled: TRUEIs hot (standby): FALSEBulk sync PID: NO_PROCESSISSU negotiation status: IPC, CFISSU context IDs: IPC(198), CF(197)Synchronization capabilities: 0x00000001Adjacency mappings: TRUECF info: handle(0x0000011B), peer ready(TRUE),flow control(TRUE)(FALSE)(0x0)Initialized: HA(TRUE) ISSU(TRUE)Message stats:Adjacency mapping: rx(0) tx(5001) tx err(0)Bulk sync done: rx(0) tx(1) tx err(0)Errors:Bulk sync: 0CF tx: 0Table 41 describes the significant fields shown in the display.
Table 41 show nat64 ha status Field Descriptions
NAT64 HA Status
Status of stateless NAT64 HA.
Message stats
Status of the messages.
Errors
Types of errors.
Related Commands
clear nat64 ha statistics
Clears stateless NAT64 HA statistics.
nat64 enable
Enables stateless NAT64 on an interface.
show nat64 prefix stateless
To display information about the configured Network Address Translation 64 (NAT64) stateless prefixes, use the show nat64 prefix stateless command in user EXEC or privileged EXEC mode.
show nat64 prefix stateless {global | {interfaces | static-routes} [prefix ipv6-prefix/prefix-length]}
Syntax Description
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
The output of the show nat64 prefix stateless command displays the interfaces that use a specific prefix and the number of prefixes that use a static route.
Examples
The following is sample output from the show nat64 prefix stateless global command:
Router# show nat64 prefix stateless globalGlobal Prefix: is valid, 2001::/96IFs Using Global PrefixFa0/3/4Fa0/3/5Table 42 describes the significant fields shown in the display.
The following is sample output from the show nat64 prefix stateless interfaces command.
Router# show nat64 prefix stateless interfacesInterface NAT64 Enabled Global Stateless PrefixFastEthernet0/3/4 TRUE FALSE 2001::/96Table 41 describes the significant fields shown in the display.
The following is sample output from the show nat64 prefix stateless static-routes command. The output fields are self-explanatory.
Router# show nat64 prefix stateless static-routesStateless Prefix Static Route Ref Count2001::/96 1Related Commands
show nat64 routes
To display information about the configured Network Address Translation 64 (NAT64) routes, use the show nat64 routes command in privileged EXEC mode.
show nat64 routes [adjacency address | interface type number | prefix prefix-length]
Syntax Description
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
The output of the show nat64 routes command displays the stateless prefix and adjacency used by the routes and information on whether the routes are enabled.
Examples
The following is sample output from the show nat64 routes command:
Router# show nat64 routesIPv4 Prefix Adj. Address Enabled Output IF Global IPv6 Prefix192.0.2.1/24 0.0.19.137 FALSE Fa0/3/4198.51.100.253/24 0.0.19.140 TRUE Fa0/3/0 FALSE 3001::/96Table 41 describes the significant fields shown in the display.
Related Commands
nat64 route
Specifies the NAT64 stateless prefix to which an IPv4 prefix should be translated.
show nat64 statistics
To display Network Address Translation 64 (NAT64) packet count statistics, use the show nat64 statistics command in user EXEC or privileged EXEC mode.
show nat64 statistics [global | interface type number | prefix ipv6-prefix/prefix-length]
Syntax Description
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
The output of the show nat64 statistics command displays the interfaces configured for stateless NAT64 and the packets that were translated or dropped.
Examples
The following is sample output from the show nat64 statistics command:
Router# show nat64 statisticsNAT64 StatisticsGlobal Stats:Packets translated (IPv4 -> IPv6): 21Packets translated (IPv6 -> IPv4): 15GigabitEthernet0/0/1 (IPv4 configured, IPv6 configured):Packets translated (IPv4 -> IPv6): 5Packets translated (IPv6 -> IPv4): 0Packets dropped: 0GigabitEthernet1/2/0 (IPv4 configured, IPv6 configured):Packets translated (IPv4 -> IPv6): 0Packets translated (IPv6 -> IPv4): 5Packets dropped: 0Table 45 describes the significant fields shown in the display.
Related Commands
show platform hardware qfp feature
To display feature specific information in the Cisco Quantum Flow Processor (QFP), use the show platform hardware qfp feature command in privileged EXEC mode.
show platform hardware qfp {active | standby} feature alg {memory | statistics [protocol [clear]]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
The show platform hardware qfp feature command when used with the netbios keyword displays the NetBIOS ALG memory usage and statistics information of the processor.
Examples
The following example displays the NetBIOS ALG statistics information of the processor:
Router# show platform hardware qfp active feature alg statistics netbiosNetBIOS ALG Statistics:No. of allocated chunk elements in L7 data pool:0No. of times L7 data is allocated:0 No. of times L7 data is freed:0Datagram Service statisticsTotal packets :0Direct unique packets :0Direct group packets :0Broadcast packets :0DGM Error packets :0Query request packets :0Positive Qry response packets :0Netgative Qry response packets:0Unknown packets :0Total error packets :0Name Service statisticsTotal packets :0Query request packets :0Query response packets :0Registration req packets :0Registration resp packets:0Release request packets :0Release response packets :0WACK packets :0Refresh packets :0Unknown packets :0Total error packets :0Session Service statisticsTotal packets :0Message packets :0Request packets :0Positive response packets:0Negative response packets:0Retarget response packets:0Keepalive packets :0Unknown packets :0Total error packets :0Table 46 describes the significant fields shown in the display.
Related Commands
show platform software trace message
To display trace messages for a module, enter the show platform software trace message command in privileged EXEC mode or diagnostic mode.
show platform software trace message process hardware-module slot
Syntax Description
Command Modes
Privileged EXEC (#)
Diagnostic (diag)Command History
Usage Guidelines
The show platform software trace message command is used to display trace messages from an in-memory message ring of a module's process that keeps a condensed historical record of all messages. Although all messages are saved in a trace log file unmodified, only the first 128 bytes of a message are saved in the message ring. The size limitation does not apply to the traceback portion of a message.
Examples
The following example shows how to display the trace messages for the Host Manager process in RP slot 0 using the show platform software trace message command:
Router# show platform software trace message host-manager R008/23 12:09:14.408 [uipeer]: (info): Looking for a ui_req msg08/23 12:09:14.408 [uipeer]: (info): Start of request handling for con 0x100a61c808/23 12:09:14.399 [uipeer]: (info): Accepted connection for 14 as 0x100a61c808/23 12:09:14.399 [uipeer]: (info): Received new connection 0x100a61c8 on descriptor 1408/23 12:09:14.398 [uipeer]: (info): Accepting command connection on listen fd 708/23 11:53:57.440 [uipeer]: (info): Going to send a status update to the shell manager in slot 008/23 11:53:47.417 [uipeer]: (info): Going to send a status update to the shell manager in slot 0The following example shows a truncated message that has a traceback. The truncated portion of the message is indicated by an ellipsis (...):
03/02 15:47:44.002 [errmsg]: (ERR): %EVENTLIB-3-TIMEHOG: read asyncon 0x100a9260: 60618ms, Traceback=1#862f8780825f93a618ecd9 ...Traceback=1#862f8780825f93a618ecd9dd48b3be96 evlib:FCAF000+CC00 evlib:FCAF000+A6A8 evutil:FFCA000+ADD0 evutil:FFCA000+5A80 evutil:FFCA000+A68C uipeer:FF49000+10AFC evlib:FCAF000+D28C evlib:FCAF000+F4C4 :10000000+1B24C c:EF44000+1D078 c:EF44000+1D220Related Commands
set platform software trace
Sets the trace level for a specific module.
show platform software trace levels
Displays trace levels for a module.
show redundancy application group
To display the redundancy group information, use the show redundancy application group command in privileged EXEC mode.
show redundancy application group [group-id | all]
Syntax Description
group-id
(Optional) redundancy group group is. Valid values are 1 and 2.
all
(Optional) Display the redundancy group information.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show redundancy application group command to display the current state of each interbox redundancy group on the device and the peer device.
Examples
The following is sample output from the show redundancy application group all command:
Router# show redundancy application group allFaults states Group 1 info:Runtime priority: [200]RG Faults RG State: Up.Total # of switchovers due to faults: 3Total # of down/up state changes due to faults: 2Group ID:1Group Name:grp2Administrative State: No ShutdownAggregate operational state : UpMy Role: ACTIVEPeer Role: UNKNOWNPeer Presence: NoPeer Comm: NoPeer Progression Started: NoRF Domain: btob-oneRF state: ACTIVEPeer RF state: DISABLEDRG Protocol RG 1------------------Role: ActiveNegotiation: EnabledPriority: 200Protocol state: ActiveCtrl Intf(s) state: DownActive Peer: LocalStandby Peer: Not existLog counters:role change to active: 2role change to standby: 0disable events: rg down state 1, rg shut 0ctrl intf events: up 0, down 2, admin_down 1reload events: local request 3, peer request 0RG Media Context for RG 1--------------------------Ctx State: ActiveProtocol ID: 1Media type: DefaultControl Interface: GigabitEthernet0/1/0Hello timer: 5000Effective Hello timer: 5000, Effective Hold timer: 15000LAPT values: 0, 0Stats:Pkts 0, Bytes 0, HA Seq 0, Seq Number 0, Pkt Loss 0Authentication not configuredAuthentication Failure: 0Reload Peer: TX 0, RX 0Resign: TX 1, RX 0Standby Peer: Not Present.Faults states Group 2 info:Runtime priority: [150]RG Faults RG State: Up.Total # of switchovers due to faults: 2Total # of down/up state changes due to faults: 2Group ID:2Group Name:name1Administrative State: No ShutdownAggregate operational state : UpMy Role: ACTIVEPeer Role: UNKNOWNPeer Presence: NoPeer Comm: NoPeer Progression Started: NoRF Domain: btob-twoRF state: ACTIVEPeer RF state: DISABLEDRG Protocol RG 2------------------Role: ActiveNegotiation: EnabledPriority: 150Protocol state: ActiveCtrl Intf(s) state: DownActive Peer: LocalStandby Peer: Not existLog counters:role change to active: 1role change to standby: 0disable events: rg down state 1, rg shut 0ctrl intf events: up 0, down 2, admin_down 1reload events: local request 2, peer request 0RG Media Context for RG 2--------------------------Ctx State: ActiveProtocol ID: 2Media type: DefaultControl Interface: GigabitEthernet0/1/0Hello timer: 5000Effective Hello timer: 5000, Effective Hold timer: 15000LAPT values: 0, 0Stats:Pkts 0, Bytes 0, HA Seq 0, Seq Number 0, Pkt Loss 0Authentication not configuredAuthentication Failure: 0Reload Peer: TX 0, RX 0Resign: TX 0, RX 0Standby Peer: Not Present.Table 47 describes the significant fields shown in the display.
Related Commands
show redundancy application transport
To display transport specific information for a redundancy group, use the show redundancy application transport command in privileged EXEC mode.
show redundancy application transport {client | group [group-id ]}
Syntax Description
client
Displays transport client specific information.
group-id
(Optional) Redundancy group group is. Valid values are 1 and 2.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
The show redundancy application transport command shows information for redundancy group transport.
Examples
The following is sample output from the show redundancy application transport group command:
Router# show redundancy application transport group 1Transport Information for RG (1)Related Commands
show redundancy application control-interface
To display control-interface information for a redundancy group, use the show redundancy application control-interface command in privileged EXEC mode.
show redundancy application control-interface group [group-id]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
The show redundancy application control-interface command shows information of the redundancy group control interfaces
Examples
The following is sample output from the show redundancy application control-interface command:
Router# show redundancy application control-interface group 2The control interface for rg[2] is GigabitEthernet0/1/0Interface is Control interface associated with the following protocols: 2 1BFD EnabledInterface Neighbors:Related Commands
show redundancy application faults
To display faults specific information for a redundancy group, use the show redundancy application faults command in privileged EXEC mode.
show redundancy application faults group [group-id]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
The show redundancy application faults command shows information returned by redundancy group faults.
Examples
The following is sample output from the show redundancy application faults command:
Router# show redundancy application faults group 2Faults states Group 2 info:Runtime priority: [150]RG Faults RG State: Up.Total # of switchovers due to faults: 2Total # of down/up state changes due to faults: 2Table 48 describes the significant fields shown in the display.
Related Commands
show redundancy application protocol
To display protocol specific information for a redundancy group, use the show redundancy application protocol command in privileged EXEC mode.
show redundancy application protocol {protocol-id | group [group-id]
Syntax Description
protocol-id
Protocol ID. The range is from 1 to 8.
group
Redundancy group.
group-id
(Optional) Redundancy group ID. Valid values are 1 and 2.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
The show redundancy application protocol command shows information returned by redundancy group protocol.
Examples
The following is sample output from the show redundancy application protocol command:
Router# show redundancy application protocol 3Protocol id: 3, name:BFD: ENABLEHello timer in msecs: 0Hold timer in msecs: 0Table 49 describes the significant fields shown in the display.
Related Commands
show redundancy application if-mgr
To display interface manager information for a redundancy group, use the show redundany application if-mgr command in privileged EXEC mode.
show redundancy application if-mgr group [group-id]
Syntax Description
group
(Optional) Specifies the redundancy group.
group-id
(Optional) Redundancy group ID. The range is from 1 to 2.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
The show redundancy application if-mgr command shows information of traffic interfaces protected by Redundancy Groups. When a traffic interface is functioning with the redundancy group, the state is no shut on the active device, and shut on the standby device. On the other hand, it is always shut on the standby device.
Examples
The following is sample output from the show redundancy application if-mgr command:
Router# show redundancy application if-mgr group 2RG ID: 2Interface VIP VMAC Shut Decrement==========================================================GigabitEthernet0/1/7 10.1.1.3 0007.b422.0016 no shut 50GigabitEthernet0/3/1 11.1.1.3 0007.b422.0017 no shut 50Table 50 describes the significant fields shown in the display.
Related Commands
show redundancy application data-interface
To display data interface specific information, use the show redundancy application data-interface command in privileged EXEC mode.
show redundancy application data-interface group [group-id]
Syntax Description
group
Specifies the redundancy group.
group-id
(Optional) Redundancy group ID. Valid values are 1 and 2.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
The show redundancy application data-interface command displays information about the redundancy group data interfaces.
Examples
The following is sample output from the show redundancy application data-interface command:
Router# show redundancy application data-interface group 1The data interface for rg[1] is GigabitEthernet0/1/1Related Commands
shutdown
To shut down a group manually, use the shutdown command in redundancy application group configuration mode. To enable a redundancy group, use the no form of this command.
shutdown
no shutdown
Syntax Description
This command has no arguments or keywords.
Command Default
The group is active.
Command Modes
Redundancy application group configuration (config-red-app-grp)
Command History
Usage Guidelines
When a group is shutdown, it does not participate in the role negotiation. The group remains in the shutdown state until you execute the no shutdown command.
Examples
The following example shows how to shut down a group named group1:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)# group 1Router(config-red-app-grp)# shutdownRelated Commands
timers hellotime
To configure timers for hellotime and holdtime messages for a redundancy group, use the timers hellotime command in redundancy application protocol configuration mode. To disable the timers in the redundancy group, use the no form of this command.
timers hellotime [msec] seconds holdtime [msec] seconds
no timers hellotime [msec] seconds holdtime [msec] seconds
Syntax Description
Command Default
The default value for the hellotime interval is 3 seconds and for the holdtime interval is 10 seconds.
Command Modes
Redundancy application group protocol configuration (config-red-app-prtc)
Command History
Usage Guidelines
The hello time is an interval in which hello messages are sent. The holdtime is the time before the active or the standby device is declared to be in down state. Use the msec keyword to configure the timers in milliseconds.
Examples
The following example shows how to configure the hellotime and holdtime messages:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)# protocol 1Router(config-red-app-prtcl)# timers hellotime 100 holdtime 100Related Commands
