CGv6 Configuration Guide for Cisco ASR 9000 Series Routers, IOS XR Release 6.2.x

Parameter Name	Value per VSM	Value per ASR9K Chassis with VSM
Number of CGN or CGv6 Instances	1	8
Number of Service Infra Interfaces	1	8
Number of Service App interfaces	512
Number of NAT44 instances	1	8
Number of Stateful Translation	80 Millions
Number of NAT session	80 Million
Number of NAT users	4 Million
Number of Static Port Forwarding Entries	6000
Number of Public IPv4 addresses	65536 or 16
Number of VRF per NAT44 instance	128 (inside) + 128 (outside)
BNG	32k per np
VRF	8000

GDOI (There are 15 Groups per Node. Two nodes for S2S VPN.)	15 Groups per Node
DS-Lite Sessions	80 Million
NAT64 Sessions	80 Million
6RD (ASR 9000 Enhanced Ethernet Line Card is inline with 6RD with an expectation rate of 90 percent.)

Parameter Name	Value per VSM	Value per ASR9K Chassis with VSM
Number of CGN or CGv6 Instances	1	8
Number of Service Infra Interfaces	1	8
Number of Service App interfaces	512
Number of NAT44 instances	1	8
Number of Stateful Translation	80 Millions	80 x Number of Installed VSM cards based on type of chassis. Max 8 number of VSM cards supported per chassis.
Number of NAT session	80 Million	80 x Number of Installed VSM cards based on type of chassis. Max 8 number of VSM cards supported per chassis.
Number of NAT users	4 Million	4 x Number of Installed VSM cards based on type of chassis. Max 8 number of VSM cards supported per chassis.
Number of Static Port Forwarding Entries	6000	6000 x Number of Installed VSM cards based on type of chassis. Max 8 number of VSM cards supported per chassis.
Number of Public IPv4 addresses	65536 or 16
Number of VRF per NAT44 instance	128 (inside) + 128 (outside)

Parameter Name	Value per VSM	Value per ASR9K Chassis with VSM
NAT64 Sessions	80 Millions

Parameter Name	Value per VSM	Value per ASR9K Chassis with VSM
DS-Lite Sessions	80 Millions

Implementing NAT44 or NAT64 over VSM

This section explains the implementation of NAT44 or NAT64 on VSM.

Configuring NAT44 over VSM

Perform the following tasks to configure NAT44 on VSM:

Configuring a NAT44 Instance
Configuring the Application Service Virtual Interface (NAT44)
Configuring an Inside and Outside Address Pool Map (NAT44)

Configuring a NAT44 Instance

Perform this task to configure a NAT44 instance.

Note

The system does not support deleting VRF on live traffic in the following scenarios:

If you are in the global configuration mode.
If you are within the CGN instance.
If you are in the static route table.

SUMMARY STEPS

configure
service cgn nat44instance-name
service-location preferred-active VSM location
service-type nat44 nat1
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn nat44`instance-name` Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 NAT44 application and enters CGv6 configuration mode.
Step 3	service-location preferred-active `VSM location` Example: `RP/0/RP0/CPU0:router(config-cgn)# service-location preferred-active 0/3/CPU0`	Configures the NAT preferred active VSM location.
Step 4	service-type nat44 nat1 Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1`	Configures the service type keyword definition for CGv6 NAT44 application.
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn)# end or RP/0/RP0/CPU0:router(config-cgn)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: `Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]:` Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the Application Service Virtual Interface (NAT44)

Perform this task to configure the application service virtual interface (SVI) to forward data traffic.

SUMMARY STEPS

configure
interface ServiceApp value
service cgn instance-name service-type nat44
vrf vrf-name
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	interface ServiceApp value Example: `RP/0/RP0/CPU0:router(config)# interface ServiceApp 1 RP/0/RP0/CPU0:router(config-if)#`	Configures the application SVI as 1 and enters interface configuration mode.
Step 3	service cgn instance-name service-type nat44 Example: `RP/0/RP0/CPU0:router(config-if)# service cgn cgn1`	Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.
Step 4	vrf vrf-name Example: `RP/0/RP0/CPU0:router(config-if)# vrf insidevrf1`	Configures the VPN routing and forwarding (VRF) for the Service Application interface
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-if)# end or RP/0/RP0/CPU0:router(config-if)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring an Inside and Outside Address Pool Map (NAT44)

Perform this task to configure an inside and outside address pool map with the following scenarios:

Note

Do not configure multiple outside address-pools to be mapped to a single inside-vrf. If you have multiple outside address-pools to be mapped, then create multiple inside-vrfs and map each outside address-pool to a single inside-vrf inside the NAT44 configuration.

The designated address pool is used for CNAT.
One inside VRF is mapped to only one outside VRF.
Multiple non-overlapping address pools can be used in a specified outside VRF mapped to different inside VRF.
Max Outside public pool per CGSE/CGN instance is 64 K or 65536 addresses. That is, if a /16 address pool is mapped, then we cannot map any other pool to that particular CGSE.
Multiple inside vrf cannot be mapped to same outside address pool.
While Mapping Outside Pool Minimum value for prefix is 16 and maximum value is 26.

SUMMARY STEPS

configure
service cgn instance-name
service-type nat44 nat1
inside-vrf vrf-name
map [outside-vrf outside-vrf-name] address-pool address/prefix
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.
Step 3	service-type nat44 nat1 Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1`	Configures the service type keyword definition for CGN NAT44 application.
Step 4	inside-vrf vrf-name Example: `RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)#`	Configures an inside VRF named insidevrf1 and enters CGN inside VRF configuration mode.
Step 5	map [outside-vrf outside-vrf-name] address-pool address/prefix Example: `RP/0/RP0/CPU0:router(config-cgn-invrf)# map outside-vrf outside vrf1 address-pool 10.10.0.0/16 or RP/0/RP0/CPU0:router(config-cgn-invrf)# map address-pool 100.1.0.0/16`	Configures an inside VRF to an outside VRF and address pool mapping.
Step 6	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-invrf-afi)# end or RP/0/RP0/CPU0:router(config-cgn-invrf-afi)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Predefined NAT

In classic NAT, the process of mapping a private IP to a public IP or a private port to an outside port is random. Therefore, it becomes difficult to track the subscribers using an IP and a port at a given time. Predefined NAT avoids this random process by mapping a private IP address to a range of ports associated with the corresponding public IP address. This is done through an algorithm that helps the user to recognize a private IP address without having to refer to the massive CGN logs. The address and port translation is done in accordance with the algorithm.

In a predefined NAT configuration, if you want to trace a subscriber’s private IP address from a public IP address and the associated port, perform the following steps:

Whenever NAT is configured on a router or when there is a change in the existing configuration, use the following command to get the complete mapping information of private to public users:

show cgn nat44 instance-name mapping {inside-address | outside-address} inside-vrfvrf-instance start-addr start address [ end-addrend address]

In the above command, specify the lowest address of the configured public IP pool as start address and the highest address of the pool as end address. This command dumps all the mapping for each private IP, the translated public IP, and port range. It is recommended that you divert this output in to a file and save it for future reference. Save this output to separate files each time you change the NAT44 configuration parameters and note down the time at which the changes were made and the corresponding file name.
Whenever there is a request to trace back the subscriber’s private IP address, access the right file based on the timestamp provided. The file will have the public IP and port range to which the specified port belongs. The private IP address in that row will help identify the subscriber.

Considerations and Limitations of Predefined NAT

The considerations and the limitations of the predefined mode for NAT 44 are as follows:

You can configure the predefined mode for each of the inside VRF instance.
A new parameter, private address range, has been added to the NAT 44 configuration for the predefined mode. You can specify a minimum of one private address range to a maximum of eight private address ranges. Ensure that you specify atleast one private address range because the available public addresses and the associated ports are mapped to the private addreses specified in this range. If the incoming packet has an address that is outside the private address range, then the packet is discarded. Ensure that the sum of all addresses should not exceed one million across all predefined mode-enabled VRFs.
The Bulk Port Allocation configuration is not available in the predefined mode. If you try to configure Bulk Port Allocation on an inside VRF that has the predefined mode enabled, the configuration is rejected during verification.
The port-preservation option is not available in the predefined mode.
The global port limit parameter is not available for the predefined mode. Even though you will be allowed to configure the global port limit, the inside VRF, which has predefined mode enabled, ignores that port limit and uses the port limit configured by the algorithm.
If you turn the predefined mode on or off for an inside VRF during the active translations, all the translations on that VRF are deleted.
If a request for configuring static port on a private address that is not in the address range is made, the request is rejected.
Ensure that you configure NetFlow or syslog only if it is very much required.
Any configuration change that results in changes in mapping deletes the existing translations. Therefore, ensure that you record such configuration changes. You might need this information to trace the port usage by a subscriber.
Ensure uniform port allocation uniform for all subscribers.

Configuring the Predefined Mode for NAT44

Perform these tasks to configure the predefined mode for NAT44.

SUMMARY STEPS

configure
service cgn instance-name
service-type nat44 nat1
inside-vrf vrf-name
map address-pool address/prefix
nat-mode
predefined ipaddress/prefix
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.
Step 3	service-type nat44 nat1 Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1`	Configures the service type keyword definition for CGN NAT44 application.
Step 4	inside-vrf vrf-name Example: `RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)#`	Configures an inside VRF named insidevrf1 and enters CGv6 inside VRF configuration mode.
Step 5	map address-pool address/prefix Example: `RP/0/RP0/CPU0:router(config-cgn-invrf)# map address-pool 10.10.0.0/16`	Maps an inside VRF to an outside VRF and address pool mapping.
Step 6	nat-mode Example: `RP/0/RP0/CPU0:router(config-cgn-invrf)# nat-mode`	Specifies the predefined mode for NAT44.
Step 7	predefined ipaddress/prefix Example: `RP/0/RP1/CPU0:router(config-cgn-invrf-natmode)# predefined private-pool 192.1.106.0/24 RP/0/RP1/CPU0:router(config-cgn-invrf-natmode)# predefined private-pool 192.1.107.0/26 RP/0/RP1/CPU0:router(config-cgn-invrf-natmode)# predefined private-pool 192.1.107.128/26`	Specifies the private address range for the predefined mode. You can specify a minimum of one address range to eight addess ranges.
Step 8	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-invrf-natmode)# end or RP/0/RP0/CPU0:router(config-cgn-invrf-natmode)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring NAT64 over VSM

Perform the following tasks to configure NAT64 on VSM:

Configuring a NAT64 Instance
Configuring the Application Service Virtual Interface (NAT64)
Configuring an Inside and Outside Address Pool Map (NAT64)

Configuring a NAT64 Instance

Perform this task to configure a NAT64 instance.

SUMMARY STEPS

configure
service cgn instance-name
service-location preferred-active VSM location
service-type nat64 stateful instance-name
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn `instance-name` Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 NAT64 application and enters CGv6 configuration mode.
Step 3	service-location preferred-active `VSM location` Example: `RP/0/RP0/CPU0:router(config-cgn)# service-location preferred-active 0/3/CPU0`	Configures the NAT preferred active VSM location.
Step 4	service-type nat64 stateful instance-name Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type nat64 stateful nat64-inst`	Configures the service type keyword definition for CGv6 Stateful NAT64 application.
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)# end or RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: `Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]:` Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the Application Service Virtual Interface (NAT64)

Perform this task to configure the application service virtual interface (SVI) to forward data traffic.

SUMMARY STEPS

configure
interface ServiceApp value
vrf vrf-name
ipv6 addressaddress
service cgn instance-name service-type nat64 stateful
commit
interface ServiceApp value
vrf vrf-name
ipv4 address address
service cgn instance-name service-type nat64 stateful
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	interface ServiceApp value Example: `RP/0/RP0/CPU0:router(config)# interface ServiceApp 1 RP/0/RP0/CPU0:router(config-if)#`	Configures the application SVI as 1 and enters interface configuration mode.
Step 3	vrf vrf-name Example: `RP/0/RP0/CPU0:router(config-if)# vrf insidevrf1`	Configures the VPN routing and forwarding (VRF) for the Service Application interface
Step 4	ipv6 addressaddress Example: `RP/0/RP0/CPU0:router(config-if)# ipv6 address 5001::5555/96`	Configures the IPv6 address.
Step 5	service cgn instance-name service-type nat64 stateful Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 service-type nat64 stateful RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)#`	Configures the instance named cgn1 and the service type keyword definition for CGv6 Stateful NAT64 application.
Step 6	commit Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)# commit`	Saves configuration changes.
Step 7	interface ServiceApp value Example: `RP/0/RP0/CPU0:router(config)# interface ServiceApp 2 RP/0/RP0/CPU0:router(config-if)#`	Configures the application SVI as 2 and enters interface configuration mode.
Step 8	vrf vrf-name Example: `RP/0/RP0/CPU0:router(config-if)# vrf outsidevrf1`	Configures the VPN routing and forwarding (VRF) for the Service Application interface
Step 9	ipv4 address address Example: `RP/0/RP0/CPU0:router(config-if)# ipv4 address 211.1.1.1 255.255.255.0`	Configures the IPv4 address.
Step 10	service cgn instance-name service-type nat64 stateful Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 service-type nat64 stateful RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)#`	Configures the instance named cgn1 and the service type keyword definition for CGv6 Stateful NAT64 application.
Step 11	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)# end or RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring an Inside and Outside Address Pool Map (NAT64)

Perform this task to configure an inside and outside address pool map with the following scenarios:

The designated address pool is used for CNAT.
One inside VRF is mapped to only one outside VRF.
Multiple non-overlapping address pools (up to a maximum of eight) can be used in a specified outside VRF mapped to different inside VRF.
Max Outside public pool per CGSE/CGN instance is 64 K or 65536 addresses. That is, if a /16 address pool is mapped, then we cannot map any other pool to that particular CGSE.
Multiple inside vrf cannot be mapped to same outside address pool.
While Mapping Outside Pool Minimum value for prefix is 16 and maximum value is 26.

SUMMARY STEPS

configure
service cgn instance-name
service-type nat64 stateful instance-name
ipv6-prefix address/prefix
ipv4-address-pool address/prefix
dynamic-port-range start port-number
address-family ipv4
interface ServiceApp value
address-family ipv6
interface ServiceApp value
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)#service cgn cgn1`	Configures the instance named cgn1 for the CGv6 application and enters the CGv6 configuration mode.
Step 3	service-type nat64 stateful instance-name Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type nat64 stateful nat64_1`	Configures the service type keyword definition for CGv6 Stateful NAT64 application.
Step 4	ipv6-prefix address/prefix Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)# ipv6-prefix 3301:db8:1::/96`	Configures the IPv6 prefix that is used to convert destination IPv6 address to an external destination IPv4 address.
Step 5	ipv4-address-pool address/prefix Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)# ipv4 address-pool 62.1.0.0/18`	Defines the IPv4 address pool.
Step 6	dynamic-port-range start `port-number` Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)#dynamic-port-range start 1`	Configures the port range from 1 to 65535.
Step 7	address-family ipv4 Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)# address-family ipv4`	Enters the address family IPv4 configuration mode.
Step 8	interface ServiceApp value Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stful-afi)# interface ServiceApp2`	Specifies the ServiceApp on which IPv4 traffic enters and leaves.
Step 9	address-family ipv6 Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stful-afi)# address-family ipv6`	Enters the address family IPv6 configuration mode.
Step 10	interface ServiceApp value Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stful-afi)# interface ServiceApp1`	Specifies the ServiceApp on which IPv6 traffic enters and leaves.
Step 11	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stful-afi)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring DS-Lite

Perform these tasks to configure DS-Lite.

Configuring the Application Service Virtual Interface

Perform this task to configure the application service virtual interface (SVI) to forward data traffic.

SUMMARY STEPS

configure
interface ServiceApp value
service cgn instance-name service-type ds-lite
vrf vrf-name
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	interface ServiceApp value Example: `RP/0/RP0/CPU0:router(config)# interface ServiceApp 1 RP/0/RP0/CPU0:router(config-if)#`	Configures the application SVI as 1 and enters interface configuration mode.
Step 3	service cgn instance-name service-type ds-lite Example: `RP/0/RP0/CPU0:router(config-if)# service cgn cgn1 service-type ds-lite`	Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.
Step 4	vrf vrf-name Example: `RP/0/RP0/CPU0:router(config-if)# vrf insidevrf1`	Configures the VPN routing and forwarding (VRF) for the Service Application interface
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-if)# end or RP/0/RP0/CPU0:router(config-if)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring Dual Stack Lite Instance

Perform this task to configure dual stack lite application.

SUMMARY STEPS

configure
service cgn instance-name
service-location preferred-active node-id [preferred-standby node-id]
service-type ds-lite instance
portlimit value
bulk-port-alloc size value
map address-pool address
aftr-tunnel-endpoint-address <address>
address-family ipv4
interface ServiceApp41
address-family ipv6
interface ServiceApp61
protocol tcp
session {initial | active} timeout seconds
msssize
external-logging netflow9
server
address A.B.C.D port port-number
external-logging syslog
server
address A.B.C.D port port-number
end or commit

DETAILED STEPS

Command or Action Purpose

Step 1

configure

Example:

RP/0/RP0/CPU0:router# configure

Enters global configuration mode.

Step 2

service cgn instance-name

Example:

RP/0/RP0/CPU0:router(config)# service cgn cgn1
RP/0/RP0/CPU0:router(config-cgn)#

Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.

Step 3

service-location preferred-active node-id [preferred-standby node-id]

Example:

RP/0/RP0/CPU0:router(config-cgn)# service-location preferred-active 0/2/CPU0 preferred-standby 0/4/CPU0

Specifies the global command applied per cgn instance. It initiates the particular instance of the cgn application on the active and standby locations.

Step 4

service-type ds-lite instance

Example:

RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite dsl1

Configures the service type keyword definition for the DS LITE application.

Step 5

portlimit value

Example:

RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite dsl1

Configures the service type keyword definition for the DS LITE application.

Step 6

bulk-port-alloc size value

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite)# bulk-port-alloc size 128

Enables bulk port allocation and sets bulk size that is used to reduce logging data volume.

Step 7

map address-pool address

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite)# map address-pool 52.52.52.0/24

Specifies the address pool for the DS LITE instance.

Note

52.52.52.0/24 is the IPv4 public address pool assigned to the DS Lite instance.

Step 8

aftr-tunnel-endpoint-address <address>

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite)# aftr-tunnel-endpoint address 3001:DB8:EOE:E01::

Specifies the IPv6 address of the tunnel end point. The IPv4 elements must address their IPV6 packets to this address.

Step 9

address-family ipv4

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite)# address-family ipv4

Enters the address family IPv4 configuration mode.

Step 10

interface ServiceApp41

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite-afi)# interface ServiceApp41

Specifies the ServiceApp on which IPv4 traffic enters and leaves.

Step 11

address-family ipv6

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite)# address-family ipv6

Enters the address family IPv6 configuration mode.

Step 12

interface ServiceApp61

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite-afi)# interface ServiceApp61

Specifies the ServiceApp on which IPv6 traffic enters and leaves.

Step 13

protocol tcp

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite-afi)# protocol tcp

Configures the TCP protocol session.

Step 14

session {initial | active} timeout seconds

Example:

RP/0/RP0/CPU0:router(config-cgn-proto)# session initial timeout 90

This command configures the timeout value in seconds for ICMP,TCP or UDP sessions for a service instance. For TCP and UDP, you can configure the initial and active session timeout values. For ICMP, there are no such options. This configuration is applicable to all the IPv4 addresses that belong to a particular service instance. This example configures the initial session timeout value as 90 for the TCP session.

Step 15

msssize

Example:

RP/0/RP0/CPU0:router(config-cgn-proto)# mss 1100

Configures the adjustment MSS value as 1100.

Step 16

external-logging netflow9

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite)# external-logging netflowv9

Configures the external-logging facility for the DS LITE instance named dsl1 and enters the external logging configuration mode.

Step 17

server

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)# server

Configures the logging server information for the IPv4 address and port for the server that is used for the netflow-v9 based external-logging facility and enters external logging server configuration mode.

Step 18

address A.B.C.D port port-number

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog-server)# address 90.1.1.1 port 99

Configures the netflow server address and port number to use for netflow version 9 based external logging facility for DS LITE instance.

Step 19

external-logging syslog

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite)# external-logging syslog

Configures the external-logging facility for the DS LITE translation entries that can be logged in syslog servers to analyze and debug the information.

Step 20

server

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)# server
RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog-server)#

Configures the logging server information for the IPv4 address and port for the server that is used for the syslog based external-logging facility.

Step 21

address A.B.C.D port port-number

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog-server)# address 90.1.1.1 port 514

Configures the syslog server address and port number to use for syslog based external logging facility for DS LITE instance.

Step 22

end or commit

Example:

RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog-server)# end
or
RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog-server)# commit

Saves configuration changes.

When you issue the end command, the system prompts you to commit changes:

Uncommitted changes found, commit them before exiting (yes/no/cancel)?

[cancel]:
- Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode.
- Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes.
- Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes.
Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the Policy Functions

Perform these tasks to configure the policy functions.

Configuring IPv6 Tunnel Endpoint Address

Perform this task to configure the IPv6 tunnel endpoint address:

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite instance name
aftr-tunnel-endpoint-address X:X::X IPv6 address
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type ds-lite instance name Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1`	Configures the service type keyword definition for CGv6 DS-Lite application.
Step 4	aftr-tunnel-endpoint-address X:X::X IPv6 address Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# aftr-tunnel-endpoint-address 10:2::10 RP/0/RP0/CPU0:router(config-cgn-ds-lite)`	Configures an IPv6 tunnel endpoint address.
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# end or RP/0/RP0/CPU0:router(config-cgn-ds-lite)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the Port Limit per Subscriber

Perform this task to configure the port limit per subscriber for the system that includes TCP, UDP, and ICMP.

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite ds-lite1
portlimit value
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.
Step 3	service-type ds-lite ds-lite1 Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1`	Configures the service type keyword definition for CGv6 DS-Lite application.
Step 4	portlimit value Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# portlimit 10`	Configures the port value that restricts the number of translations for the ds-lite instance.
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn)# end or RP/0/RP0/CPU0:router(config-cgn)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the Timeout Value for ICMP, TCP and UDP Sessions

Perform this task to configure the timeout value for ICMP, TCP or UDP sessions for a Dual Stack Lite (DS Lite) instance:

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite instance-name
protocol tcp session {active | initial} timeout value or protocol {icmp | udp} timeout value
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type ds-lite instance-name Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite-inst RP/0/RP0/CPU0:router(config-cgn-ds-lite)#`	Configures the service type keyword definition for CGv6 DS-Lite application.
Step 4	protocol tcp session {active \| initial} timeout value or protocol {icmp \| udp} timeout value Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)#protocol tcp session active timeout 90 or protocol icmp timeout 90 RP/0/RP0/CPU0:router(config-cgn-ds-lite)`	Configures the initial and active session timeout values for TCP. Configures the timeout value in seconds for ICMP and UDP.
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# end or RP/0/RP0/CPU0:router(config-cgn-ds-lite)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the FTP ALG for DS-Lite Instance

Perform this task to configure the FTP ALG for the specified DS-Lite instance.

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite ds-lite1
alg ftp
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.
Step 3	service-type ds-lite ds-lite1 Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1`	Configures the service type keyword definition for NAT44 or DS-Lite application.
Step 4	alg ftp Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# alg ftp`	Configures the FTP ALG on the DS-Lite instance.
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn)# end or RP/0/RP0/CPU0:router(config-cgn)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the RTSP ALG for DS-Lite Instance

Perform this task to configure the ALG for the rtsp for the specified DS-Lite instance. RTSP packets are usually destined to port 554. But this is not always true because RTSP port value is configurable.

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite ds-lite1
alg rtsp [server-port] value
end or commit

DETAILED STEPS

Command or Action Purpose

Step 1

configure

Example:

RP/0/RP0/CPU0:router# configure

Enters global configuration mode.

Step 2

service cgn instance-name

Example:

RP/0/RP0/CPU0:router(config)# service cgn cgn1
RP/0/RP0/CPU0:router(config-cgn)#

Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.

Step 3

service-type ds-lite ds-lite1

Example:


RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1

Configures the service type keyword definition for DS-Lite application.

Step 4

alg rtsp [server-port] value

Example:

RP/0/RP0/CPU0:router(config-cgn-nat44)# alg rtsp server-port 5000

Configures the rtsp ALG on the DS-Lite instance for server port 5000. The range is from 1 to 65535. The default port is 554.

Caution

The option of specifying a server port) is currently not supported. Even if you configure some port, RTSP works only on the default port (554).

Step 5

end or commit

Example:

RP/0/RP0/CPU0:router(config-cgn)# end
or
RP/0/RP0/CPU0:router(config-cgn)# commit

Saves configuration changes.

When you issue the end command, the system prompts you to commit changes:

Uncommitted changes found, commit them before exiting (yes/no/cancel)?

[cancel]:
- Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode.
- Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes.
- Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes.
Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

TCP Maximum Segment Size Adjustment

When a host initiates a TCP session with a server, the host negotiates the IP segment size by using the maximum segment size (MSS) option. The value of the MSS option is determined by the maximum transmission unit (MTU) that is configured on the host.

Configuring an Address Pool Map

Perform this task to configure an address pool map.

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite instance-name
map address-pool address/prefix
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type ds-lite instance-name Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1`	Configures the service type keyword definition for CGv6 DS-Lite application.
Step 4	map address-pool address/prefix Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# map address-pool 10.10.0.0/16 or RP/0/RP0/CPU0:router(config-cgn-ds-lite)# map address-pool 100.1.0.0/16`	Configures an address pool mapping.
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog-server)# end or RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog-server)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the Path Maximum Transmission Unit

Before you begin

DS-Lite

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite ds-lite1
path-mtu value
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.
Step 3	service-type ds-lite `ds-lite1` Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1 RP/0/RP0/CPU0:router(config-cgn-ds-lite)#`	Configures the service type keyword definition for DS-Lite application.
Step 4	path-mtu value Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# path-mtu 2000 RP/0/RP0/CPU0:router(config-cgn-ds-lite)`	Configures the path MTU with the value of 2900 for the DS-Lite instance.
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# end or RP/0/RP0/CPU0:router(config-cgn-ds-lite)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring External Logging for DS-Lite Entries

Perform the following to configure external logging for DS-Lite entries.

Netflow Logging

Perform the following tasks to configure Netflow Logging for NAT table entries.

Configuring the Server Address and Port for Syslog Logging

Perform this task to configure the server address and port to log DS-Lite entries for Syslog logging.

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-liteinstance_name
external-logging syslog
server
addressaddressportnumber
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type ds-lite`instance_name` Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1`	Configures the service type keyword definition for the DS-Lite application.
Step 4	external-logging syslog Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)#external-logging syslog RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)#`	Configures the external-logging facility for the CGv6 instance named cgn1 and enters CGv6 external logging configuration mode.
Step 5	server Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)# server RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#`	Configures the logging server information for the IPv4 address and port for the server that is used for the syslog-based external-logging facility and enters CGv6 external logging server configuration mode.
Step 6	addressaddressportnumber Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#address 2.3.4.5 port 45`	Configures the IPv4 address and port number 45 to log Netflow entries.
Step 7	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#end or RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the Path Maximum Transmission Unit

Before you begin

DS-Lite

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite ds-lite1
path-mtu value
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.
Step 3	service-type ds-lite `ds-lite1` Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1 RP/0/RP0/CPU0:router(config-cgn-ds-lite)#`	Configures the service type keyword definition for DS-Lite application.
Step 4	path-mtu value Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# path-mtu 2000 RP/0/RP0/CPU0:router(config-cgn-ds-lite)`	Configures the path MTU with the value of 2900 for the DS-Lite instance.
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# end or RP/0/RP0/CPU0:router(config-cgn-ds-lite)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the Refresh Rate for Netflow Logging

Perform this task to configure the refresh rate at which the Netflow-v9 logging templates are refreshed or resent to the Netflow-v9 logging server.

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite ds-lite1
external-logging netflowv9
server
refresh-rate value
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.
Step 3	service-type ds-lite ds-lite1 Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1 RP/0/RP0/CPU0:router(config-cgn-ds-lite)#`	Configures the service type keyword definition for CGv6 DS-Lite application..
Step 4	external-logging netflowv9 Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# external-logging netflow9 RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog) #`	Configures the external-logging facility for the CGN instance named cgn1 and enters CGN external logging configuration mode.
Step 5	server Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog) # server RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#`	Configures the logging server information for the IPv4 address and port for the server that is used for the netflow9-based external-logging facility and enters CGv6 external logging server configuration mode..
Step 6	refresh-rate value Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)# refresh-rate 200 RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)`	Configures the refresh rate value of 200 to log Netflow-based external logging information.
Step 7	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)# end or RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the Timeout for Netflow Logging

Perform this task to configure the frequency in minutes at which the Netflow-V9 logging templates are to be sent to the Netflow-v9 logging server.

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite ds-lite1
external-logging netflowv9
server
timeoutvalue
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.
Step 3	service-type ds-lite ds-lite1 Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1`	Configures the service type keyword definition for DS-Lite application.
Step 4	external-logging netflowv9 Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# external-logging netflow9 RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog) #`	Configures the external-logging facility for the CGv6 instance named cgn1 and enters CGv6 external logging configuration mode.
Step 5	server Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)# server RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#`	Configures the logging server information for the IPv4 address and port for the server that is used for the netflow9-based external-logging facility and enters CGv6 external logging server configuration mode.
Step 6	timeoutvalue Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)# timeout 200 RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)`	Configures the timeout value of 200 for Netflow logging of the DS-Lite instance.
Step 7	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)# end or RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

(Only NAT44) Syslog Logging

Perform the following tasks to configure Syslog Logging for NAT table entries.

Configuring the Server Address and Port for Syslog Logging

Perform this task to configure the server address and port to log DS-Lite entries for Syslog logging.

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-liteinstance_name
external-logging syslog
server
addressaddressportnumber
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type ds-lite`instance_name` Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1`	Configures the service type keyword definition for the DS-Lite application.
Step 4	external-logging syslog Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)#external-logging syslog RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)#`	Configures the external-logging facility for the CGv6 instance named cgn1 and enters CGv6 external logging configuration mode.
Step 5	server Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)# server RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#`	Configures the logging server information for the IPv4 address and port for the server that is used for the syslog-based external-logging facility and enters CGv6 external logging server configuration mode.
Step 6	addressaddressportnumber Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#address 2.3.4.5 port 45`	Configures the IPv4 address and port number 45 to log Netflow entries.
Step 7	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#end or RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the Host-Name for Syslog Logging

Perform this task to configure the host name to be filled in the Netflow header for the syslog logging.

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite ds-lite1
external-logging syslog
server
host-namename
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type ds-lite `ds-lite1` Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1`	Configures the service type keyword definition for the DS-Lite application.
Step 4	external-logging syslog Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)#external-logging syslog RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)#`	Configures the external-logging facility for the CGv6 instance named cgn1 and enters CGv6 external logging configuration mode.
Step 5	server Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)# server RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#`	Configures the logging server information for the IPv4 address and port for the server that is used for the syslog-based external-logging facility and enters CGv6 external logging server configuration mode.
Step 6	host-namename Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#host-name host1`	Configures the host name for the syslog-based external-logging facility.
Step 7	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#end or RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the Path Maximum Transmission Unit for Syslog Logging

Perform this task to configure the path maximum transmission unit (MTU) for the syslog-based external-logging facility.

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite instance_name
external-logging syslog
server
path-mtuvalue
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type ds-lite `instance_name` Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1`	Configures the service type keyword definition for the DS-Lite application.
Step 4	external-logging syslog Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)#external-logging syslog RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)#`	Configures the external-logging facility for the CGv6 instance named cgn1 and enters CGv6 external logging configuration mode.
Step 5	server Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)# server RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#`	Configures the logging server information for the IPv4 address and port for the server that is used for the syslog-based external-logging facility and enters CGv6 external logging server configuration mode.
Step 6	path-mtuvalue Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#path-mtu 200`	Configures the path MTU with the value of 200 for the syslog-based external-logging facility.
Step 7	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#end or RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Bulk Port Allocation

Perform this task to configure bulk port allocation to reduce Netflow or Syslog data volume.

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite instance_name
bulk-port-alloc size number of ports
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type ds-lite `instance_name` Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1`	Configures the service type keyword definition for the DS-Lite application.
Step 4	bulk-port-alloc size number of ports Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)#bulk-port-alloc size 64 RP/0/RP0/CPU0:router(config-cgn-ds-lite)`	Allocate ports in bulk to reduce Netflow/Syslog data volume.
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# end or RP/0/RP0/CPU0:router(config-cgn-ds-lite)#commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Destination-Based Logging for DS-Lite

Perform these tasks to configure destination-based logging for DS-Lite entries.

Configuring the Session-Logging for Netflow Logging

Perform this task to configure session-logging if destination IP and Port information needs to logged in the Netflow records.

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite instance_name
external-logging netflow9
server
session-logging
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type ds-lite `instance_name` Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1`	Configures the service type keyword definition for the DS-Lite application.
Step 4	external-logging netflow9 Example: `RP/0/RP0/CPU0:router(config-cgn)#external-logging netflow9 RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)#`	Configures the external-logging facility for the DS-Lite instance.
Step 5	server Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)# server RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#`	Configures the logging server information for the IPv4 address and port for the server that is used for the netflow-v9 based external-logging facility.
Step 6	session-logging Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#session-logging`	Configures the session logging for a DS-Lite instance.
Step 7	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#end or RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the Session-Logging for Syslog Logging

Perform this task to configure session-logging if destination IP and Port information needs to logged in the Netflow records.

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite instance_name
external-logging syslog
server
session-logging
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type ds-lite `instance_name` Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1`	Configures the service type keyword definition for the DS-Lite application.
Step 4	external-logging syslog Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)#external-logging syslog RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)#`	Configures the external-logging facility for the DS-Lite instance.
Step 5	server Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlog)# server RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#`	Configures the logging server information for the IPv4 address and port for the server that is used for the netflow-v9 based external-logging facility.
Step 6	session-logging Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#session-logging`	Configures the session logging for a DS-Lite instance.
Step 7	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#end or RP/0/RP0/CPU0:router(config-cgn-ds-lite-extlogserver)#commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Example

Policy Functions

Configuring Port Limit per Subscriber

Perform this task to restrict the number of ports used by an IPv6 address.

SUMMARY STEPS

configure
service cgn instance-name
service-type nat64 stateful instance-name
portlimit value
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type nat64 stateful instance-name Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type nat64 stateful nat64-inst RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)#`	Configures the service type keyword definition for CGv6 Stateful NAT64 application.
Step 4	portlimit value Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)#portlimit 66 RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)`	Configures a value to restrict the number of ports used by an IPv6 address.
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)# end or RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

Configuring the Timeout Value for ICMP, TCP and UDP Sessions

Perform this task to configure the timeout value for ICMP, TCP or UDP sessions for a Dual Stack Lite (DS Lite) instance:

SUMMARY STEPS

configure
service cgn instance-name
service-type ds-lite instance-name
protocol tcp session {active | initial} timeout value or protocol {icmp | udp} timeout value
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type ds-lite instance-name Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite-inst RP/0/RP0/CPU0:router(config-cgn-ds-lite)#`	Configures the service type keyword definition for CGv6 DS-Lite application.
Step 4	protocol tcp session {active \| initial} timeout value or protocol {icmp \| udp} timeout value Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)#protocol tcp session active timeout 90 or protocol icmp timeout 90 RP/0/RP0/CPU0:router(config-cgn-ds-lite)`	Configures the initial and active session timeout values for TCP. Configures the timeout value in seconds for ICMP and UDP.
Step 5	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ds-lite)# end or RP/0/RP0/CPU0:router(config-cgn-ds-lite)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

FTP-ALG

CGN supports both passive and active FTP. FTP clients are supported with inside (private) address and servers with outside (public) addresses. Passive FTP is provided by the basic NAT function. Active FTP is used with the ALG.

RTSP-ALG

CGN supports the Real Time Streaming Protocol (RTSP), an application-level protocol for control over the delivery of data with real-time properties. RTSP provides an extensible framework to enable controlled, on-demand delivery of real-time data, such as audio and video. Sources of data can include both live data feeds and stored clips.

PPTP-ALG

PPTP is a network protocol that enables secure transfer of data from a remote client to a private enterprise server by creating a Virtual Private Network (VPN). It is used to provide IP security at the network layer. PPTP uses a control channel over TCP and a GRE tunnel operating to encapsulate PPP packets.

PPTP-ALG is a CGN solution that allows traffic from all clients through a single PPTP tunnel.

A PPTP tunnel is instantiated on the TCP port. This TCP connection is then used to initiate and manage a second GRE tunnel to the same peer.

PPTP uses an access controller and network server to establish a connection.

PPTP Access Controller (PAC)

A device attached to one or more PSTN or ISDN lines capable of PPP operation and handling the PPTP protocol. It terminates the PPTP tunnel and provides VPN connectivity to a remote client.

PPTP Network Server (PNS)

A device which provides the interface between the Point-to-Point Protocol (encapsulated in the PPTP protocol) and a LAN or WAN. The PNS uses the PPTP protocol to support tunneling between a PPTP PAC and the PNS. It requests to establish a VPN connectivity using PPTP tunnel.

Control Connection

A control connection is established between a PAC and a PNS for TCP.

Tunnel

A tunnel carries GRE encapsulated PPP datagrams between a PAC and a PNS

Note

Active FTP, PPTP ALG, and RTSP ALG are supported on NAT44 applications. Active FTP and RTSP ALG are supported on DS-Lite applications.

TCP Maximum Segment Size Adjustment

Static Port Forwarding

Static port forwarding helps in associating a private IP address and port with a statically allocated public IP and port. After you have configured static port forwarding, this association remains intact and does not get removed due to timeouts until the CGSE is rebooted. In case of redundant CGSE cards, it remains intact until both of the CGSEs are reloaded together or the router is reloaded. There are remote chances that after a reboot, this association might change. This feature helps in cases where server applications running on the private network needs access from public internet.

Note

NAT64 on VSM does not support static port forwarding.

Configuring Dynamic Port Range

Perform this task to configure a dynamic port range.

SUMMARY STEPS

configure
service cgn instance-name
service-type nat64 stateful instance-name
dynamic-port-range start port-number
endor commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn `instance-name` Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type nat64 stateful `instance-name` Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type nat64 stateful nat64-inst RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)`	Configures the service type keyword definition for CGv6 Stateful NAT64 application.
Step 4	dynamic-port-range start `port-number` Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)#dynamic-port-range start 66 RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)`	Configures the port range from 1 to 65535.
Step 5	endor commit Example: `RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)# end or RP/0/RP0/CPU0:router(config-cgn-nat64-stateful)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: `Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]:` Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

(Only NAT44) Configuring One-to-One Mapping

Perform this task to configure one-to-one mapping for private addresses.

SUMMARY STEPS

configure
service cgn instance-name
service-type nat44 nat1
inside-vrf vrf-name
map ip one-to-one
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type nat44 nat1 Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1`	Configures the service type keyword definition for CGv6 NAT44 application.
Step 4	inside-vrf vrf-name Example: `RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)#`	Configures the inside VRF for the CGv6 instance named cgn1 and enters CGv6 inside VRF configuration mode.
Step 5	map ip one-to-one Example: `RP/0/RP0/CPU0:router(config-cgn-invrf)# map ip one-to-one`	Configures one-to-one mapping for a CGv6 NAT44 instance.
Step 6	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-invrf-afi)# end or RP/0/RP0/CPU0:router(config-cgn-invrf-afi)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

(Only NAT44) Configuring TCP Sequence Check

Perform the following steps for checking the sequence numbers of the packets in a TCP session:

SUMMARY STEPS

configure
service cgn instance-name
service-type nat44 nat1
inside-vrf vrf-name
firewall protocol tcp
sequence-check
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.
Step 3	service-type nat44 nat1 Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1`	Configures the service type keyword definition for NAT44 application.
Step 4	inside-vrf vrf-name Example: `RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)#`	Configures the inside VRF for the CGN instance named cgn1 and enters CGN inside VRF configuration mode.
Step 5	firewall protocol tcp Example: `RP/0/RP0/CPU0:router(config-cgn-invrf)# protocol tcp RP/0/RP0/CPU0:router(config-cgn-invrf-proto)#`	Enters the firewall mode and the protocol tcp submode.
Step 6	sequence-check Example: `RP/0/RP0/CPU0:router(config-cgn-invrf)# sequence-check 10`	Enables checking of the sequence numbers. The optional diff-window keyword allows user to configure a value equal to the difference between the expected and received sequence numbers. The range for this value is 0 to 1,073,725,440.
Step 7	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-ivrf-sport-inside)# end or RP/0/RP0/CPU0:router(config-cgn-ivrf-sport-inside)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

(Only NAT44) Enabling Address and Port-Dependent Filtering

Perform the following steps to enable address and port-dependent filtering in a NAT44 configuration.

SUMMARY STEPS

configure
service cgn instance-name
service-type nat44 instance-name
inside-vrf instance-name
filter-policy ignore-port
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type nat44 instance-name Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1`	Configures the service type keyword definition for CGv6 NAT44 application.
Step 4	inside-vrf instance-name Example: `RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)#`	Configures an inside VRF named insidevrf1 and enters CGv6 inside VRF configuration mode.
Step 5	filter-policy ignore-port Example: To enable address and port-dependent filtering `RP/0/RP0/CPU0:router(config-cgn-invrf)# filter-policy` To enable address and port-dependent filtering when the port is not checked: `RP/0/RP0/CPU0:router(config-cgn-invrf)# filter-policy ignore-port`	Enables the address and port-dependent filtering. The optional ignore-port keyword is used to disable the port-dependent filtering.
Step 6	end or commit Example: `RP/0/RP0/CPU0:router(config-if)# end or RP/0/RP0/CPU0:router(config-if)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

(Only NAT44) Configuring NAT0 Mode

Perform these tasks to configure the NAT0 mode for NAT44.

SUMMARY STEPS

configure
service cgn instance-name
service-type nat44 nat1
inside-vrf vrf-name
map [outside-vrf outside-vrf-name] address-pool address/prefix
nat-mode no-nat
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.
Step 3	service-type nat44 nat1 Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1`	Configures the service type keyword definition for CGN NAT44 application.
Step 4	inside-vrf vrf-name Example: `RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)#`	Configures an inside VRF named insidevrf1 and enters CGv6 inside VRF configuration mode.
Step 5	map [outside-vrf outside-vrf-name] address-pool address/prefix Example: `RP/0/RP0/CPU0:router(config-cgn-invrf)# map outside-vrf ovrf outsideServiceApp ServiceApp2 address-pool 0.0.0.0/0`	Configures an inside VRF to an outside VRF and address pool mapping.
Step 6	nat-mode no-nat Example: `RP/0/RP0/CPU0:router(config-cgn-invrf)# nat-mode no-nat`	Specifies the NAT0 or NAT bypass mode for NAT44.
Step 7	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-invrf-natmode)# end or RP/0/RP0/CPU0:router(config-cgn-invrf-natmode)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

(Only NAT44) Configuring the Static Destination Address Translation

Perform the following steps to configure static destination address translation:

SUMMARY STEPS

configure
service cgn instance-name
service-type nat44 nat1
inside-vrf vrf-name
map [outside-vrf outside-vrf-name] address-pool address/prefix
static-mapping-file direction i2o-dst path of the .csv file
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGN application and enters CGN configuration mode.
Step 3	service-type nat44 nat1 Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1`	Configures the service type keyword definition for CGN NAT44 application.
Step 4	inside-vrf vrf-name Example: `RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)#`	Configures an inside VRF named insidevrf1 and enters CGN inside VRF configuration mode.
Step 5	map [outside-vrf outside-vrf-name] address-pool address/prefix Example: `RP/0/RP0/CPU0:router(config-cgn-invrf)# map outside-vrf outside vrf1 address-pool 10.10.0.0/16 or RP/0/RP0/CPU0:router(config-cgn-invrf)# map address-pool 100.1.0.0/16`	Configures an inside VRF to an outside VRF and address pool mapping.
Step 6	static-mapping-file direction i2o-dst path of the .csv file Example: `RP/0/RP0/CPU0:router(config-cgn-invrf-afi)# static-mapping-file direction i2o-dst /disk0:/30K.CSV`	Configures static destination address translation using the static mapping configuration file (.csv). In this example, the file is stored in disk0: location.
Step 7	end or commit Example: `RP/0/RP0/CPU0:router(config-cgn-invrf-afi)# end or RP/0/RP0/CPU0:router(config-cgn-invrf-afi)# commit`	Saves configuration changes. When you issue the end command, the system prompts you to commit changes: Uncommitted changes found, commit them before exiting (yes/no/cancel)? [cancel]: Entering yes saves configuration changes to the running configuration file, exits the configuration session, and returns the router to EXEC mode. Entering no exits the configuration session and returns the router to EXEC mode without committing the configuration changes. Entering cancel leaves the router in the current configuration session without exiting or committing the configuration changes. Use the commit command to save the configuration changes to the running configuration file and remain within the configuration session.

(Only NAT44) Configuring Multiple NetFlow Servers

Perform this task to configure multiple NetFlow servers. Repeat the same task to configure multiple servers.

SUMMARY STEPS

configure
service cgn instance-name
service-type nat44 nat1
inside-vrf vrf-name
external-logging netflow
server
address address port number
ath-mtu value
refresh-rate value
timeout value
session-logging
end or commit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure Example: `RP/0/RP0/CPU0:router# configure`	Enters global configuration mode.
Step 2	service cgn instance-name Example: `RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#`	Configures the instance named cgn1 for the CGv6 application and enters CGv6 configuration mode.
Step 3	service-type nat44 nat1 Example: `RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1`	Configures the service type keyword definition for CGv6 NAT44 application.
Step 4	inside-vrf vrf-name Example: `RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-nat44-invrf)#`	Configures the inside VRF for the CGv6 instance named cgn1 and enters CGv6 inside VRF configuration mode.
Step 5	external-logging netflow Example: `RP/0/RP0/CPU0:router(config-cgn-invrf)# external-logging netflow version 9 RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog)#`	Configures the external-logging facility for the NAT44 instance.
Step 6	server

Results

Chapter: Carrier Grade IPv6 over Virtualized Services Module (VSM)

Carrier Grade IPv6 over Virtualized Services Module (VSM)

Virtualized Services Module

VSM Components

Features and Considerations

Installing CGv6 on VSM

Prerequisites

Installing CGv6 OVA Package

Activating CGv6 VM

Uninstalling CGv6 on VSM

Deactivating CGv6 VM

Uninstalling CGv6 OVA Package

Disabling the Service Enablement Feature

Upgrading CGv6 OVA Package

Saving the Virtual Service Configuration

Deactivating CGv6 VM

Uninstalling CGv6 OVA Package

Upgrading Cisco IOS XR

Installing the CGv6 OVA Package

Restoring the Virtual Service Configuration

VSM scale numbers

Implementing NAT 64 over VSM

NAT44 and NAT 64 over VSM

VSM scale numbers supported in NAT 44

VSM Scale numbers supported in NAT 64

TCP Sequence Check

Address and Port-Dependent Filtering

NAT0 or NAT Bypass Mode

Considerations

Static Destination Address Translation

About the Static Mapping Configuration File

Considerations

High Availability Support for the Route Switch Processor (RSP) Switchover

VSM High Availability Support

CGN and BNG Interoperability through NAT44 over VSM

Multiple NetFlow and Syslog Servers for CGN Logging

Dual Stack Lite

VSM scale numbers supported in Dual Stack Lite

Scalability and Performance of DS Lite

Implementing NAT44 or NAT64 over VSM

Configuring NAT44 over VSM

Configuring a NAT44 Instance

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example:

Example:

Example:

Configuring the Application Service Virtual Interface (NAT44)

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example:

Example:

Example:

Configuring an Inside and Outside Address Pool Map (NAT44)

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example:

Example:

Example:

Example:

Predefined NAT

Considerations and Limitations of Predefined NAT

Configuring the Predefined Mode for NAT44

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example:

Example:

Example:

Example:

Example: