The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This chapter describes the commands used to configure and use the Carrier Grade NAT (CGN) .
For detailed information about CGN concepts, configuration tasks, and examples, see Cisco IOS XR Software Carrier Grade NAT Configuration Guide for the Cisco CRS Router .
To enable the IPv4 address of the server that is used for logging the entries for the Network Address Translation (NAT) table, use the address command in CGN inside VRF external logging server configuration mode. To disable the Netflow server configuration, use the no form of this command.
address address port number
no address address port number
address |
IPv4 address of the server. |
port |
Configures the port that is used for logging. The address corresponds to the IPv4 address of the NetflowV9 logging server port, which corresponds to the UDP port number in which the NetflowV9 logging server listens for the Netflow logs. |
number |
Port number. Range is from 1 to 65535. |
If the address command is not configured, NAT44 NetflowV9 logging is disabled.
CGN inside VRF external logging server configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.1.0 |
The usage guidelines was updated. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The CGN NetflowV9-based translation entry is used to create and delete the logs. This NAT44 specific command will configure the ipv4 address and port number for the netflowV9 external logging facility. The address corresponds to the IPv4 address of the NetflowV9 logging server port, which in turn corresponds to the UDP port number in which the NetflowV9 logging server listens for the Netflow logs. The configurations for path-mtu, refresh-rate and timeout is applicable only when the ipv4 address and port number for the logging server has been configured.
Task ID |
Operations |
---|---|
cgn |
read, write |
The following example shows how to configure the IPv4 address and port number 45 for NetFlow logging of the NAT table entries:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)# external-logging netflow version 9 RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog)# server RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog-server)# address 2.3.4.5 port 45
Command | Description |
| Enables external logging of a NAT44 instance. |
| Enters inside VRF configuration mode for a NAT44 instance. |
| Enables the logging server information for the IPv4 address and port for the server that is used for the netflowv9-based external-logging facility. |
| Enables an instance for the CGN application. |
To enable the inside IPv4 address and port number for static forwarding for a NAT44 instance, use the address command in NAT44 inside VRF static port inside configuration mode. To disable this feature, use the no form of this command.
address address port number
no address address port number
address |
IPv4 address of an inside host server. |
port |
Configures the inside port for static forwarding. The port keyword allows a specific UDP, TCP, or ICMP port on a global address to be translated to a specific port on a local address. |
number |
Inside port number. For TCP and UDP, range is from 1 to 65535. For ICMP, range is from and 0 to 65535. |
None
NAT44 inside VRF static port inside configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.1.0 |
The usage guidelines section was updated. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
This NAT44 command configures the static port forwarding for an inside-ipv4 address and inside-port number combination. With this configuration, packets received inside with the configured inside-ipv4 address and inside-port number are forwarded using the displayed outside-ipv4address and outside-port number.
CGN can dynamically allocate one free public IP address and port number from the configured outside address pool for an inside address and port.
Task ID |
Operations |
---|---|
cgn |
read, write |
This example shows how to configure the inside IPv4 address and port for static forwarding. CGN can dynamically allocate one free public IP address and port number from the configured outside address pool for an inside address and port.
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf v1 RP/0/RP0/CPU0:router(config-cgn-invrf)# protocol tcp RP/0/RP0/CPU0:router(config-cgn-invrf-proto)# static-forward inside RP/0/RP0/CPU0:router(config-cgn-invrf-sport-inside)# address 10.20.30.10 port 1000
Command | Description |
protocol (NAT44) |
|
| Enters ICMP, TCP, and UDP protocol configuration mode for a given CGN instance. |
| Enables an instance for the CGN application. |
| Displays the translation table entries for an inside-address to outside-address for a specified NAT44 CGN instance. |
To bind an ipv4 or ipv6 ServiceApp interface to a 6rd instance, use the address-family command in 6RD configuration mode. To unbind the ServiceApp interface, use the no form of this command.
address-family { ipv4 | ipv6 } interface ServiceApp value
no address-family { ipv4 | ipv6 } interface ServiceApp value
ipv4 |
Specifies the IPv4 address family. |
ipv6 |
Specifies the IPv6 address family. |
interface |
Specifies the ServiceApp interface to be used. |
ServiceApp |
Specifies the SVI interface. |
value |
Interface value. The range is from 1 to 2000. |
None
6RD configuration
Release | Modification |
---|---|
Release 4.3.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to bind ipv4 ServiceApp interface to a 6RD instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn-inst RP/0/RP0/CPU0:router(config-cgn)# service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# address-family ipv4 RP/0/RP0/CPU0:router(config-cgn-6rd-afi)#interface ServiceApp 100
This example shows how to bind ipv6 ServiceApp interface to a 6RD instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn-inst RP/0/RP0/CPU0:router(config-cgn)# service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# address-family ipv6 RP/0/RP0/CPU0:router(config-cgn-6rd-afi)#interface ServiceApp 120
To enter the IPv4 address family configuration mode while configuring the Carrier Grade NAT (CGN), use the address-family ipv4 command in an appropriate configuration mode. To disable support for an address family, use the no form of this command.
address-family ipv4 { interface ServiceApp | tcp mss | tos }
no address-family ipv4
interface
|
Specifies the ServiceApp interface to be used. |
ServiceApp
|
Specifies the SEAPP SVI interface. The number of service application interfaces to be configured ranges from 1 to 2000. |
tcp
|
Specifies the TCP protocol. |
mss
|
Specifies the maximum segment size for TCP in bytes. The value of maximum segment size ranges from 28 to 1500. |
tos
|
Type of service to be set when translating IPv6 to IPv4. The value of type of service ranges from 0 to 255. |
None
CGN-NAT64
Release | Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.1.0 |
Updated the Syntax and Usage Guidelines sections. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
This command configures the ipv4 address family for NAT64 stateless XLAT.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows the tcp mss for the ipv4 address family:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat64 stateless xlat RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# address-family ipv4 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless-afi)# tcp mss 200
To enter the IPv6 address family configuration mode, use the address-family ipv6 command. To disable support for an address family, use the no form of this command.
address-family ipv6{interface ServiceApp <1-2000>} { df override } { protocol | { icmp | reset-mtu } } tcp mss<28-1500>traffic-class<0-255>
no address-family ipv6
interface |
Indicates the ServiceApp interface to be used. |
ServiceApp |
SEAPP SVI Interface. |
<1-2000> |
Number of service application interfaces to be configured. Range is from 1 to 2000. |
df-override |
Override DF bit. |
protocol |
Select a protocol. |
icmp |
(Optional) ICMP protocol. |
reset-mtu |
(Optional) Reset maximum transmission unit when packet is too big. |
tcp |
TCP protocol. |
mss |
Maximum segment size for TCP in bytes. |
<28-1500> |
Maximum segment size to be used in bytes. |
traffic-class |
Traffic class to be set when translating from IPv4 to IPv6. |
None
CGN-NAT64
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
This command configures the ipv6 address family for NAT64 stateless XLAT.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows the traffic-class setting for the ipv6 address family:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat64 stateless xlat1 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# address-family ipv6 RP/0/RP0/CPU0:router(config-cgn-nat64-stless-afi)# traffic-class 25
Command | Description |
| Sets the do not fragment bit |
| Resets the received packet size. |
| Enables an instance for the CGN application. |
| Configures the traffic class value to be used when translating a packet from IPv4 to IPv6 |
To enable the Application-Level Gateway (ALG) of Active FTP for a NAT44 instance, use the alg ActiveFTP command in NAT44 configuration mode. To disable the support of ALG for the Active FTP, use the no form of this command.
alg ActiveFTP
no alg ActiveFTP
This command has no arguments or keywords.
By default, ActiveFTP ALG is disabled.
NAT44 Configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.1.0 |
The Usage Guidelines section was updated. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID |
Operations |
---|---|
cgn |
read, write |
The following example shows how to configure ALG for the active FTP connection for the NAT44 instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# alg ActiveFTP
To enable the support for FTP Application-Level Gateway (ALG) for a DS-Lite instance, use the alg command in DS-Lite configuration mode. To disable, use the no form of this command.
alg ftp
no alg ftp
ftp |
Enables the FTP ALG. |
None
DS-Lite configuration mode
Release | Modification |
---|---|
Release 4.2.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to enable support for FTP ALG:
RP/0/RP0/CPU0:router# config RP/0/RP0/CPU0:router(config)#service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#service-type ds-lite ds-lite1 RP/0/RP0/CPU0:router(config-cgn-ds-lite)#alg ftp RP/0/RP0/CPU0:router(config-cgn-ds-lite)#
To configure Point-to-Point Tunneling Protocol (PPTP) as the Application-Level Gateway (ALG) for a NAT44 instance, use the alg pptpalg command in NAT44 configuration mode. To undo the configuration, use the no form of this command.
alg pptpalg
no alg pptpalg
This command has no arguments or keywords.
By default, PPTP ALG is disabled.
NAT44 configuration mode
Release |
Modification |
---|---|
Release 4.3.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID |
Operations |
---|---|
cgn |
read, write |
This example shows how to configure ALG for the PPTP connection on NAT44 instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat441 RP/0/RP0/CPU0:router(config-cgn-nat44)# alg pptpalg
Command | Description |
Enables the Application-Level Gateway (ALG) of Active FTP for a NAT44 instance. | |
Enables the support for Application-Level Gateway (ALG) Real Time Streaming Protocol (RTSP). |
To enable support for the Application-Level Gateway (ALG) Real Time Streaming Protocol (RTSP), use the alg rtsp command in the DS-Lite configuration mode. To disable the support, use the no form of this command.
alg rtsp
no alg rtsp
rtsp |
Specifies the real time streaming protocol. |
server-port |
Specifies the port to be used for RTSP. The range is from 1 to 65535.The default port is 554. |
By default, the alg rtsp is disabled.
DS-Lite Configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The application has to be directed to identify RTSP packets. The alg rtsp configuration command allows enabling of RTSP scan.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the alg rtsp command for a DS-Lite instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite1 RP/0/RP0/CPU0:router(config-cgn-ds-lite)# alg rtsp
Command | Description |
| Enters the IPv4 address family configuration mode. |
| Enables the Application-Level Gateway (ALG) of Active FTP for a NAT44 instance. |
| Enters inside VRF configuration mode for a NAT44 instance. |
| Limits the number of translation entries per source address. |
protocol (NAT44) |
|
| Enables an instance for the CGN application. |
| Enables a NAT44 instance for the CGN application. |
| Configures the Network Address Translation (NAT) mapping refresh direction for the specified CGN instance. |
To configure Real Time Streaming Protocol (RTSP) as the Application-Level Gateway (ALG), use the alg rtsp command in the NAT44 configuration mode. To undo the configuration, use the no form of this command.
alg rtsp server-port value
no alg rtsp
server-port |
Specifies the port to be used for RTSP. |
value |
Specifies the port number. The default port is 554. The range is from 1 to 65535 |
By default, the alg rtsp is disabled.
NAT44 Configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The application has to be directed to identify RTSP packets. The alg rtsp configuration command allows enabling of RTSP scan.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the alg rtsp command for the CGN instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# alg rtsp server-port 666
Command | Description |
| Enables the Application-Level Gateway (ALG) of Active FTP for a NAT44 instance. |
To attach the port-set to the NAT inside-vrf instance, use the attach port-set command in the CGN inside VRF configuration mode. To remove the port-set from the inside-vrf instance, use the no form of this command.
attach port-set name
name |
Specifies the port-set created. |
None
CGN inside VRF configuration mode.
Release | Modification |
---|---|
Release 5.3.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
A port-set is attached to the VRF instance that handles packets from the subscriber network (inside-VRF). Users can attach only one port-set to the NAT inside-vrf instance. If multiple port-sets are attached to the inside-vrf instance, then only the last attached port-set is considered for the NAPT operation. However, a port-set can be attached to multiple inside-vrf instances. If a port-set is in use by one or more NAT inside-vrf instances, users cannot delete that port-set until the associations with all NAT inside-vrf instances are removed. However, the user can modify the contents of port-set while they are in use and have the modifications take effect immediately.Task ID | Operation |
---|---|
cgn |
read, write |
The following example shows how to attach the port-set to an inside VRF instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)#map-address pool 100.1.1.0/24 RP/0/RP0/CPU0:router(config-cgn-invrf-afi)#attach port-set set1
To enable the Border Relay(BR) configuration, use the br command in 6RD configuration mode. To disable this feature, use the no form of this command.
br { ipv4 | ipv6-prefix | source-address | unicast }
no br
ipv4 |
Specifies the IPv4 related configuration. |
ipv6-prefix |
Specifies the IPv6 prefix. |
source-address | Specifies the source address for the tunnel. |
unicast | Specifies the IPv6 unicast address. |
None
6RD configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the unicast address using the br configuration level commands :
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# br RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# ipv6-prefix 2001:db8::/32 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# source-address 10.2.2.2 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# ipv4 prefix length 0 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# ipv4 suffix length 0 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd-br)# unicast address 2001:db8:a02:202::1
Command | Description |
Assigns a value for the ipv4-prefix length to be used as part of both ends of tunnel. | |
Assigns a value for the ipv4-suffix length to be used as part of both ends of a tunnel. | |
Generates the delegated ipv6 prefix for a IPv6 Rapid Deployment (6RD) application. | |
Assigns an ipv4 address as the tunnel source address. | |
Assigns an IPv6 address to be used for a IPv6 Rapid Deployment (6RD) Border Relay (BR) unicast configuration. |
To pre-allocate a number of contiguous outside ports in bulk and to reduce Netflow/Syslog data volume, use the bulk-port-alloc command in NAT44 configuration mode. To undo the bulk port allocation, use the no form of this command.
bulk-port-alloc size size-value
no bulk-port-alloc size size-value
size size-value |
Specifies the port size for allocation. The value should be greater than or equal to one fourth of the port limit and less than twice the port limit. The allowed values are , 16, 32, 64, 128, 256, 512, 1024, 2048, and 4096. |
None
NAT44 Inside VRF configuration
Release | Modification |
---|---|
Release 4.2.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to allocate ports in bulk to reduce the syslog data volume:
RP/0/RP0/CPU0:router# config RP/0/RP0/CPU0:router(config)#service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#service-type nat44 nat441 RP/0/RP0/CPU0:router(config-cgn)#inside-vrf vrf1 RP/0/RP0/CPU0:router(config-cgn-ds-lite-invrf)#bulk-port-alloc size 64 RP/0/RP0/CPU0:router(config-cgn-ds-lite-invrf)#
Command | Description |
| Enables external logging of a NAT44 instance. |
protocol (NAT44) |
|
To clear all translation database entries that are created dynamically for the specific CGN instance, use the clear cgn nat44 command in EXEC mode.
clear cgn nat44 instance-name
instance-name |
Instance name for NAT44. |
None
EXEC
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.0.0 |
NAT44 instance was included in the command syntax. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Caution | Because the clear cgn nat44 command clears all translation database entries and impacts the traffic on those translation entries, use this command with caution. |
Task ID |
Operations |
---|---|
cgn |
read |
The following example shows how to clear all the translation entries for the cgn1 instance:
RP/0/RP0/CPU0:router# show cgn nat44 nat2 statistics Statistics summary of NAT44 instance: 'nat2' Number of active translations: 45631 Translations create rate: 5678 Translations delete rate: 6755 Inside to outside forward rate: 977 Outside to inside forward rate: 456 Inside to outside drops port limit exceeded: 0 Inside to outside drops system limit reached: 0 Inside to outside drops resorce depletion: 0 Outside to inside drops no translation entry: 0 Pool address totally free: 195 RP/0/RP0/CPU0:router# clear cgn nat44 nat2 RP/0/RP0/CPU0:router# show cgn nat44 nat2 statistics Statistics summary of NAT44 Instance: 'nat2' Number of active translations: 0 <<<<<<<<<<<<<< All the entries are deleted and provided no new translation entires are created Translations create rate: 5678 Translations delete rate: 6755 Inside to outside forward rate: 977 Outside to inside forward rate: 456 Inside to outside drops port limit exceeded: 0 Inside to outside drops system limit reached: 0 Inside to outside drops resorce depletion: 0 Outside to inside drops no translation entry: 0 Pool address totally free: 195
Command | Description |
| Enables an instance for the CGN application. |
| Displays the translation table entries for an inside-address to outside-address for a specified NAT44 CGN instance. |
| Displays the outside-address to inside-address translation details for a specified NAT44 instance. |
To clear the counters for sequence-check, use the clear cgn nat44 inside-vrf counters in EXEC mode.
clear cgn nat44 instance-name inside-vrf instance-name counters
counters |
Lists the counters for TCP sequence check |
None
EXEC
Release | Modification |
---|---|
Release 5.1.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
The following example clears the counters for TCP sequence check.
RP/0/RP0/CPU0:router# clear cgn nat44 nat1 inside-vrf vrf1 counters
To clear translation database entries that are created dynamically for the specified inside VRF, use the clear cgn nat44 inside-vrf command in EXEC mode.
clear cgn nat44 instance-name inside-vrf vrf-name
instance-name |
Instance name for NAT44. |
vrf-name |
Name for the inside VRF. |
None
EXEC
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.0.0 |
NAT44 instance was included in the command syntax. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Caution | Because the clear cgn nat44 inside-vrf command clears all translation database entries for the specified inside-vrf and impacts the traffic on those translation entries, use this command with caution. |
Task ID |
Operations |
---|---|
cgn |
read |
This example shows how to clear the translation database entries for the inside VRF named ivrf:
RP/0/RP0/CPU0:router# show cgn nat44 nat2 inside-translation protocol tcp inside-vrf insidevrf1 inside-address 192.168.6.23 port start 23 end 56 Inside-translation details ----------------------------------- NAT44 instance : nat2 Inside-VRF : insidevrf1 ------------------------------------------------------------------------------------------ Outside Protocol Inside Outside Translation Inside Outside Address Source Source Type to to Port Port Outside Inside Packets Packets ------------------------------------------------------------------------------------------ 12.168.6.231 tcp 34 2356 alg 875364 65345 12.168.6.98 tcp 56 8972 static 78645 56343 12.168.2.12 tcp 21 2390 static 45638 89865 12.168.2.123 tcp 34 239 dynamic 809835 67854 RP/0/RP0/CPU0:router# clear cgn nat44 nat2 inside-vrf insidevrf1 RP/0/RP0/CPU0:router# show cgn nat44 nat2 inside-translation protocol tcp inside-vrf insidevrf1 inside-address 192.168.6.23 port start 23 end 56 Inside-translation details ----------------------------------- NAT44 instance : nat2 Inside-VRF : insidevrf1 ------------------------------------------------------------------------------------------ Outside Protocol Inside Outside Translation Inside Outside Address Source Source Type to to Port Port Outside Inside Packets Packets ------------------------------------------------------------------------------------------
Command | Description |
| Displays the translation table entries for an inside-address to outside-address for a specified NAT44 CGN instance. |
| Displays the outside-address to inside-address translation details for a specified NAT44 instance. |
To clear translation database entries that are created dynamically for the specified IPv4 address, use the clear cgn nat44 ipaddress command in EXEC mode.
clear cgn nat44 instance-name ipaddress address
instance-name |
Instance name for NAT44. |
address |
Specifies the IPv4 address for which the translation entries must be cleared. |
None
EXEC
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.0.0 |
NAT44 instance was included in the command syntax. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Caution | Because the clear cgn nat44 ipaddress command clears all translation database entries for the specified IPv4 address and impacts the traffic on those translation entries, use this command with caution. |
Task ID |
Operations |
---|---|
cgn |
read |
The following example shows how to clear the translation database entries for the specified IPv4 address:
RP/0/RP0/CPU0:router# show cgn nat44 nat1 inside-translation protocol tcp inside-vrf insidevrf1 inside-address 192.168.6.23 port start 23 end 56 Inside-translation details ----------------------------------- NAT44 instance : nat1 Inside-VRF : insidevrf1 ------------------------------------------------------------------------------------------ Outside Protocol Inside Outside Translation Inside Outside Address Source Source Type to to Port Port Outside Inside Packets Packets ------------------------------------------------------------------------------------------ 12.168.6.231 tcp 34 2356 alg 875364 65345 12.168.2.123 tcp 34 239 dynamic 809835 67854 RP/0/RP0/CPU0:router# clear cgn nat44 nat1 ipaddress 10.0.0.0 RP/0/RP0/CPU0:router# show cgn nat44 nat1 inside-translation protocol tcp inside-vrf insidevrf1 inside-address 192.168.6.23 port start 23 end 56 Inside-translation details ----------------------------------- NAT44 instance : nat1 Inside-VRF : insidevrf1 ------------------------------------------------------------------------------------------ Outside Protocol Inside Outside Translation Inside Outside Address Source Source Type to to Port Port Outside Inside Packets Packets ------------------------------------------------------------------------------------------
Command | Description |
| Displays the translation table entries for an inside-address to outside-address for a specified NAT44 CGN instance. |
| Displays the outside-address to inside-address translation details for a specified NAT44 instance. |
To clear the translation database entries that are created dynamically for the specified inside port number, use the clear cgn nat44 port command in EXEC mode.
clear cgn nat44 instance-name port number
instance-name |
Instance name for NAT44. |
number |
Port number. Range is from 1 to 65535. |
None
EXEC
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.0.0 |
NAT44 instance was included in the command syntax. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Caution | Because the clear cgn nat44 port command clears all translation database entries for the specified port and impacts the traffic on those translation entries, use this command with caution. |
Task ID |
Operations |
---|---|
cgn |
read |
This example shows how to clear the translation database entries for port number 1231:
RP/0/RP0/CPU0:router# show cgn nat44 nat2 inside-translation protocol tcp inside-vrf insidevrf1 inside-address 192.168.6.23 port start 1231 end 1231 Inside-translation details ----------------------------------- NAT44 instance : nat2 Inside-VRF : insidevrf1 ------------------------------------------------------------------------------------------ Outside Protocol Inside Outside Translation Inside Outside Address Source Source Type to to Port Port Outside Inside Packets Packets ------------------------------------------------------------------------------------------ 12.168.6.231 tcp 1231 2356 alg 875364 65345 RP/0/RP0/CPU0:router# clear cgn nat44 nat2 port 1231 RP/0/RP0/CPU0:router# show cgn nat44 nat2 inside-translation protocol tcp inside-vrf insidevrf1 inside-address 192.168.6.23 port start 1231 end 1231 Inside-translation details ----------------------------------- NAT44 instance : nat2 Inside-VRF : insidevrf1 ------------------------------------------------------------------------------------------ Outside Protocol Inside Outside Translation Inside Outside Address Source Source Type to to Port Port Outside Inside Packets Packets ------------------------------------------------------------------------------------------
Command | Description |
| Displays the translation table entries for an inside-address to outside-address for a specified NAT44 CGN instance. |
| Displays the outside-address to inside-address translation details for a specified NAT44 instance. |
To clear translation database entries that are created dynamically for the specified protocol, use the clear cgn nat44 pptpCounters command in EXEC mode.
clear cgn nat44 instance-name pptpCounters
instance-name |
Name for the NAT44 CGN instance. |
pptpCounters |
Specifies the PPTP counters that must be cleared. |
None
EXEC
Release |
Modification |
---|---|
Release 4.3.0 | This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Caution | Because the clear cgn nat44 pptpCounters command clears all the PPTP counters, use this command with caution. |
Task ID |
Operations |
---|---|
cgn |
read |
To clear translation database entries that are created dynamically for the specified protocol, use the clear cgn nat44 protocol command in EXEC mode.
clear cgn nat44 instance-name protocol { gre | udp | tcp | icmp }
instance-name |
Name for the NAT44 CGN instance. |
protocol |
Specifies the protocol for which the translation entries must be cleared. |
None
EXEC
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.0.0 |
NAT44 instance was included in the command syntax. |
Release 4.3.0 |
The keyword, gre was added. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Caution | Because the clear cgn nat44 protocol command clears all translation database entries for the specified protocol and impacts the traffic on those translation entries, use this command with caution. |
Task ID |
Operations |
---|---|
cgn |
read |
This example shows how to clear the translation database entries for the TCP protocol:
RP/0/RP0/CPU0:router# show cgn nat44 nat2 inside-translation protocol tcp inside-vrf insidevrf1 inside-address 192.168.6.23 port start 1231 end 1231 Inside-translation details ----------------------------------- NAT44 instance : nat2 Inside-VRF : insidevrf1 ------------------------------------------------------------------------------------------ Outside Protocol Inside Outside Translation Inside Outside Address Source Source Type to to Port Port Outside Inside Packets Packets ------------------------------------------------------------------------------------------ 12.168.6.231 tcp 1231 2356 alg 875364 65345 RP/0/RP0/CPU0:router# clear cgn nat44 nat2 protocol tcp RP/0/RP0/CPU0:router# show cgn nat44 nat2 inside-translation protocol tcp inside-vrf insidevrf1 inside-address 192.168.6.23 port start 1231 end 1231 Inside-translation details ----------------------------------- NAT44 instance : nat2 Inside-VRF : insidevrf1 ------------------------------------------------------------------------------------------ Outside Protocol Inside Outside Translation Inside Outside Address Source Source Type to to Port Port Outside Inside Packets Packets ------------------------------------------------------------------------------------------
Command | Description |
protocol (NAT44) |
|
| Displays the translation table entries for an inside-address to outside-address for a specified NAT44 CGN instance. |
| Displays the outside-address to inside-address translation details for a specified NAT44 instance. |
To clear all the statistics of a IPv6 Rapid Deployment (6RD) instance, use the clear cgn tunnel v6rd statistics command in EXEC mode.
clear cgn tunnel v6rd instance-name statistics
instance-name |
Specifies the name of the 6rd instance. |
statistics |
6rd instance statistics. |
None
Exec
Release | Modification |
---|---|
Release 4.3.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Caution | Because the clear cgn tunnel v6rd statistics command clears all statistics counters, use this command with caution. |
Task ID | Operation |
---|---|
cgn |
read |
This example shows the statistics entries for a 6RD instance:
RP/0/RP0/CPU0:router# show cgn tunnel v6rd 6rd1 statistics Tunnel 6rd configuration ========================= Tunnel 6rd name: 6rd1 IPv6 Prefix/Length: 2001:db8::/32 Source address: 9.1.1.1 BR Unicast address: 2001:db8:901:101::1 IPv4 Prefix length: 0 IPv4 Suffix length: 0 TOS: 0, TTL: 255, Path MTU: 1280 Tunnel 6rd statistics ====================== IPv4 to IPv6 ============= Incoming packet count : 2296951183 Incoming tunneled packets count : 2296951183 Decapsulated packets : 0 ICMP translation count : 0 Insufficient IPv4 payload drop count : 0 Security check failure drops : 0 No DB entry drop count : 0 Unsupported protocol drop count : 0 Invalid IPv6 source prefix drop count : 2296951183 IPv6 to IPv4 ============= Incoming packet count : 0 Encapsulated packets count : 0 No DB drop count : 0 Unsupported protocol drop count : 0 IPv4 ICMP ========== Incoming packets count : 0 Reply packets count : 0 Throttled packet count : 0 Nontranslatable drops : 0 Unsupported icmp type drop count : 0 IPv6 ICMP ========== Incoming packets count : 0 Reply packets count : 0 Packet Too Big generated packets count : 0 Packet Too Big not generated packets count : 0 NA generated packets count : 0 TTL expiry generated packets count : 0 Unsupported icmp type drop count : 0 Throttled packet count : 0 IPv4 to IPv6 Fragments ======================= Incoming fragments count : 0 Reassembled packet count : 0 Reassembled fragments count : 0 ICMP incoming fragments count : 0 Total fragment drop count : 0 Fragments dropped due to timeout : 0 Reassembly throttled drop count : 0 Duplicate fragments drop count : 0 Reassembly disabled drop count : 0 No DB entry fragments drop count : 0 Fragments dropped due to security check failure : 0 Insufficient IPv4 payload fragment drop count : 0 Unsupported protocol fragment drops : 0 Invalid IPv6 prefix fragment drop count : 0 IPv6 to IPv4 Fragments ======================= Incoming ICMP fragment count : 0 RP/0/RP1/CPU0:# ================================================================================= The RP/0/RP0/CPU0:router# clear cgn tunnel v6rd 6rd1 statistics command clears the output shown above.
Command | Description |
Displays the statistics information for an IPv6 Rapid Deployment (6RD) instance. |
To test the integrity of the ServiceApp data path and to shut down the SVI in case of a failure, use the datapath-test command in the 6rd configuration mode. To undo the detection of the failure and shutdown, use the no form of this command.
datapath-test [ shut-down-on-failure ]
no datapath-test [ shut-down-on-failure ]
shut-down-on-failure |
(Optional) If configured, the ServiceApp Interfaces for IPv4 and IPv6 are shut down when any of these interfaces fails. Use this option only if redundant CGSEs capable of handling the traffic, when the failed ServiceApp interfaces are shutdown, are configured. |
None
6RD configuration
Release | Modification |
---|---|
Release 5.2.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to shut down the interface:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn-inst RP/0/RP0/CPU0:router(config-cgn)# service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# address-family ipv4 RP/0/RP0/CPU0:router(config-cgn-6rd-afi)#interface ServiceApp 100 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# address-family ipv6 RP/0/RP0/CPU0:router(config-cgn-6rd-afi)#interface ServiceApp 101 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd-afi)# exit RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# datapath-test shut-down-on-failure
To set the DF (Do not Fragment) bit to 0, use the df-override command . To restore the default behavior, use the no form of this command.
df-override
no df-override
df-override |
Specifies the df-override bit. |
The df-override bit is set to 1.
CGN-NAT64
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Use the df-override command to set the DF bit to 0 when translating IPv6 packets to IPv4 packets, provided the original IPv6 packet size is less than 1280 bytes and there is no Fragment header.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the df-override command for the NAT64 stateless configuration.
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type nat64 stateless xlat1 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# ipv6-prefix 2010:db8:ff00::/40 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# address-family ipv6 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless-afi)# df-override
Command | Description |
| Enters the IPv6 address family configuration mode. |
| Enables the application SVI interface. |
| Resets the received packet size. |
| Enables an instance for the CGN application. |
| Creates a nat64 stateless application |
| Adjusts the TCP maximum segment size value for a ServiceApp interface. |
| Configures the traffic class value to be used when translating a packet from IPv4 to IPv6 |
To configure the dynamic port range start value for a CGN NAT 44 instance, use the dynamic port range start command in the EXEC mode. These ports include TCP, UDP, and ICMP.
dynamic port range start value
value |
The value ranges between 1 to 65535. |
When the value is not configured, then the dynamic translations start from 1024.
CGN-NAT44 Configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to execute the dynamic port range start value as 1048 for a NAT44 instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type nat44 nat1 RP/0/RP0/CPU0:router#(config-cgn-nat44)dynamic port range start 1048
To enable the external-logging facility for an inside VRF of a CGN instance, use the external-logging command in CGN inside VRF NAT44 configuration mode. To disable external-logging, use the no form of this command.
external-logging netflow version 9
no external-logging netflow version 9
netflow version 9 |
Netflow version 9 protocol is used for external logging. |
By default, external-logging is disabled.
CGN Inside VRF NAT44 configuration mode
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.0.0 |
The keyword netflow v9 has been modified to netflow version 9 . |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The external-logging command enters CGN inside VRF address family external logging configuration mode.
You can use NetFlow to export NAT table entries.
The external-logging facility supports only netflow version 9.
Task ID |
Operations |
---|---|
cgn |
read, write |
This example shows how to enter the configuration mode for the netflow version 9 external-logging facility:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)# external-logging netflow version 9 RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog)# server RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog-server)# address 10.10.0.0 port 50
To enable the external-logging facility for syslog data, use the external-logging command in CGN inside VRF NAT44 configuration mode. To disable external-logging, use the no form of this command.
external-logging syslog server { address |{ address port number} host-name |{ name} path-mtu value protocol protocol-type }
no external-logging syslog server { address |{ address port number} host-name |{ name} path-mtu value protocol protocol-type }
syslog |
Logs syslog information to an external server. |
server |
Specifies the location of the server to log the syslog information. |
address |
Specifies the IPv4 or IPv6 address of the server. |
host-name |
Specifies the host name used in syslog header. |
path-mtu |
Specifies the mtu of the path used for logging information. |
protocol |
Specifies the layer 4 protocol used for logging information. |
By default, external-logging is disabled.
CGN Inside VRF NAT44 configuration mode
Release | Modification |
---|---|
Release 4.2.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example show how to log syslog information for a NAT44 instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)# external-logging syslog RP/0/RP0/CPU0:router(config-cgn-invrf-syslog)# server RP/0/RP0/CPU0:router(config-cgn-invrf-syslog-server)# address 10.10.0.0 port 50 RP/0/RP0/CPU0:router(config-cgn-invrf-syslog-server)#
To enable a CGN service role on a specified location, use the hw-module service cgn location command in global configuration mode. To disable the CGN service role at the specified location, use the no form of this command.
hw-module service cgn location node-id
no hw-module service cgn location node-id
node-id |
Location of the service card for CGN that you want to configure. The node-id argument is entered in the rack/slot/module notation. |
None
Global configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID |
Operations |
---|---|
cgn |
read, write |
root-lr |
read, write |
This example shows how to configure the CGN service for location 0/2/CPU0:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# hw-module service cgn location 0/2/CPU0
Command | Description |
| Enables the application SVI interface. |
| Enables the infrastructure SVI interface. |
| Enables an instance for the CGN application. |
| Enables the particular instance of the CGN application on the active and standby locations. |
To enter inside VRF configuration mode for a NAT44 instance, use the inside-vrf command in NAT44 configuration mode. To disable this feature, use the no form of this command.
inside-vrf vrf-name
no inside-vrf vrf-name
vrf-name |
Name for the inside VRF. |
None
NAT44 configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The inside-vrf command enters NAT44 inside VRF configuration mode.
Task ID |
Operations |
---|---|
cgn |
read, write |
The following example shows how to enter inside VRF configuration mode:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)#
Command | Description |
| Enables external logging of a NAT44 instance. |
protocol (NAT44) |
|
| Enables an instance for the CGN application. |
| Displays the translation table entries for an inside-address to outside-address for a specified NAT44 CGN instance. |
| Displays the outside-address to inside-address translation details for a specified NAT44 instance. |
To enable the application SVI interface, use the interface ServiceApp command in global configuration mode. To disable a particular service application interface, use the no form of this command.
interface ServiceApp value
no interface ServiceApp value
value |
Total number of service application interfaces to be configured. Range is from 1 to 244. |
None
Global configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The total number of service application interfaces per multi-service PLIM card cannot exceed 889.
The name of the serviceapp interfaces is serviceapp n where n can be a number between 1 to 244.
Task ID |
Operations |
---|---|
interface |
read, write |
This example shows how to configure a nat64 stateless service application interface:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#service-type nat64 stateless xlat1 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)#ipv6-prefix 2010:db8:ff00::/40 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)#address-family ipv6 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless-afi)#interface ServiceApp 461
This example shows how to configure 6rd service application interface:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)#address-family ipv6 RP/0/RP0/CPU0:router(config-cgn-6rd-afi)#interface ServiceApp 46
This example shows how to configure a nat44service application interface:
RP/0/RP0/CPU0:router#configure RP/0/RP0/CPU0:router(config)#interface ServiceApp 1 RP/0/RP0/CPU0:router(config)#service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#service type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)#address-family ipv4
To enable the infrastructure SVI interface, use the interface ServiceInfra command in global configuration mode. To disable a particular service infrastructure interface, use the no form of this command.
interface ServiceInfra value
no interface ServiceInfra value
value |
Total number of service infrastructure interfaces to be configured. Range is from 1 to 2000. |
None
Global configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Only one service infrastructure interface can be configured per ISM.
Note | The Infra SVI interface and its IPv4 address configuration are required to boot the CGSE. The IPv4 address is used as the source address of the netflow v9 logging packet. |
Task ID |
Operations |
---|---|
interface |
read, write |
This example shows how to configure one service infrastructure interface:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# interface ServiceInfra 1 RP/0/RP0/CPU0:router(config-if)#ipv4 address 3.1.1.1 255.255.255.248 RP/0/RP0/CPU0:router(config-if)#service-location 0/1/CPU0
To assign a value for the ipv4-prefix length to be used as part of both ends of tunnel, use the ipv4 prefix command in 6RD configuration mode. To remove the ipv4 prefix, use the no form of this command.
ipv4 prefix length value
no ipv4 prefix length value
length |
Indicates the IPv4 prefix length to be used while deriving the delegated IPv6 prefix. |
value |
IPv4 prefix length value. The range is from 0 to 31. |
None
6RD configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
This command assigns a value for the common ipv4 prefix length to be used as part of both ends of the tunnel. This is an optional br (Border Relay) tunnel configuration parameter. If this parameter is added or modified, the unicast address must be modified.
The sum of the ipv4 prefix length and ipv4 suffix length must not exceed 31. This value is used to calculate 6RD delegated prefix.
Once configured, the ipv4 prefix cannot be deleted individually. It must be deleted along with all the br tunnel configuration. If you want to ignore the prefix length, alternatively you can set it to zero along with the updated unicast address.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the ipv4 prefix length:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# br RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd-br)# ipv4 prefix length 16
Command | Description |
Assigns a value for the ipv4-suffix length to be used as part of both ends of a tunnel. | |
Generates the delegated ipv6 prefix for a IPv6 Rapid Deployment (6RD) application. | |
Assigns an ipv4 address as the tunnel source address. | |
Assigns an IPv6 address to be used for a IPv6 Rapid Deployment (6RD) Border Relay (BR) unicast configuration. |
To assign a value for the ipv4-suffix length to be used as part of both ends of a tunnel, use the ipv4 suffix command in 6RD configuration mode. To remove the ipv4 suffix, use the no form of this command.
ipv4 suffix length value
no ipv4 suffix length value
ipv4 suffix length |
Specifies the IPv4 suffix length to be used while deriving the delegated IPv6 prefix. |
value |
Length of the IPv4 suffix. The range is from 0 to 31. |
None
6RD configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
This command assigns a value for the common ipv4 suffix length to be used as part of both ends of the tunnel. This is an optional br (Border Relay) tunnel configuration parameter. If this parameter is added or modified, the unicast address should also be modified.
Note | The sum of the ipv4 prefix length and ipv4 suffix length must not exceed 31. This value is used to calculate 6RD delegated prefix. |
Note | Once configured, the ipv4 suffix cannot be deleted individually. It must be deleted along with all the br tunnel configuration. If you want to ignore the prefix length, alternatively you can set it to zero along with the updated unicast address. |
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the ipv4 suffix length:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# br RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd-br)# ipv4 suffix length 15
Command | Description |
Assigns a value for the ipv4-prefix length to be used as part of both ends of tunnel. | |
Generates the delegated ipv6 prefix for a IPv6 Rapid Deployment (6RD) application. | |
Assigns an ipv4 address as the tunnel source address. | |
Assigns an IPv6 address to be used for a IPv6 Rapid Deployment (6RD) Border Relay (BR) unicast configuration. |
To generate the delegated ipv6 prefix for a IPv6 Rapid Deployment (6RD) application, use the ipv6-prefix command in 6RD configuration mode. To remove the ipv6 prefix assigned for the application, use the no form of this command.
ipv6-prefix X:X::X/length IPV6 subnet mask
no ipv6-prefix X:X::X/length IPV6 subnet mask
X:X::X/length |
IPv6 address. |
None
6RD configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The ipv6-prefix command is used for Border Relay (BR) tunnel configurations. It is used to generate a delegated ipv6 prefix for the BR-related configuration. This is a mandatory br tunnel parameter. All mandatory parameters must be added or deleted at the same time.
Note | For a given 6RD domain, there is exactly one 6RD prefix. The ipv6-prefix command is used to convert the ipv4 address into ipv6 address for use by the 6RD domain. |
Note | For a 6RD tunnel, configure the ipv6-prefix, ipv4 source-address, and unicast IPv6 address in a single commit operation. Once configured, the ipv6-prefix cannot be deleted individually. It must be deleted along with all the br tunnel configuration parameters. |
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to enter the ipv6-prefix for the 6RD CGN instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# br RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd-br)# ipv6-prefix 2010:db8:ff00::/40
Command | Description |
Assigns a value for the ipv4-prefix length to be used as part of both ends of tunnel. | |
Assigns a value for the ipv4-suffix length to be used as part of both ends of a tunnel. | |
Assigns an ipv4 address as the tunnel source address. | |
Assigns an IPv6 address to be used for a IPv6 Rapid Deployment (6RD) Border Relay (BR) unicast configuration. |
To enable the TCP maximum segment size (MSS) adjustment value for an inside VRF of a specified CGN instance and to adjust the MSS value of the TCP SYN packets going through, use the mss command in CGN inside VRF NAT44 protocol configuration mode. To disable the packets to override the TCP MSS value, use the no form of this command.
mss size
no mss size
size |
Size, in bytes, to be applied for the MSS value. Range is from 28 to 1500. |
Default is disabled for the TCP maximum segment size (MSS) adjustment.
CGN inside VRF NAT44 protocol configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The MSS value, which is configured using the mss command, overrides the MSS value that is set in the received TCP packets. The range for MSS value is from 28 to 1500.
The mss command adjusts the MSS value of the TCP SYN packets.
Task ID |
Operations |
---|---|
cgn |
read, write |
The following example shows how to configure TCP MSS value as 1100 for the CGN instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)# protocol tcp RP/0/RP0/CPU0:router(config-cgn-invrf-proto)# mss 1100
To enter the predefined mode for NAT44, use the nat-mode command. To disable this mode, use the no nat-mode command.
nat-mode { predefined }
no nat-mode { predefined }
predefined |
Maps a private IP address to a specific port range of the corresponding public IP address. This keyword is for the predefined mode. |
None
Global configuration mode
Release | Modification |
---|---|
Release 4.3.2 |
This command was introduced. |
Release 5.2.0 |
This command was modified. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
Applicable until Release 5.1.x. RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)# map address-pool 198.12.0.0/24 RP/0/RP0/CPU0:router(config-cgn-invrf)# nat-mode predefined RP/0/RP0/CPU0:router(config-cgn-invrf-natmode)#
Applicable for Release 5.2.x and above. RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)#inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)#map outside-vrf blue address-pool 100.0.0.0/24 RP/0/RP0/CPU0:router(config-cgn-invrf)#nat-mode RP/0/RP0/CPU0:router(config-cgn-invrf-natmode)#predefined private-pool 103.1.106.0/24
To configure the ipv4 tunnel MTU (Maximum Transmission Unit) size in bytes, use the path-mtu command in 6RD configuration mode. To reset the MTU to its default value, use the no form of this command.
path-mtu value
no path-mtu
value |
Path-MTU value, in bytes. The range is from 1280 to 1480. |
None
6RD configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
This command configures the path MTU size, in bytes, for the ipv4 tunnel. If the size of any incoming packet is more than this path MTU, then an ICMP error is sent as a response.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the path-mtu with the value of 1500:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# path-mtu 1500
To configure the path Maximum Transmission Unit (MTU) for the netflowv9-based external-logging facility for the inside VRF of a NAT44 instance, use the path-mtu command in NAT44 inside VRF address family external logging server configuration mode. To revert back to the default of 1500, use the no form of this command. This command restricts the maximum size of the Netflow-version 9 logging packet
path-mtu value
no path-mtu value
value |
Value, in bytes, of the path-mtu for the netflowv9-based external-logging facility. Range is from 100 to 9200. |
By default, the value of the path-mtu for the netflowv9-based external-logging facility is set to 1500.
NAT44 inside VRF address family external logging server configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
This NAT44 specific command configures the value of the path-mtu for the netflowv9 based external logging facility for an inside-VRF of NAT44 instance.
This command restricts the maximum size of the Netflow-v9 logging packet. The path-mtu value ranges from 100 to 9200. The netflowv9-based external-logging facility is exported by using the NAT table entries.
Note | Only when the ipv4 address and port number for the logging server has been configured, the configurations for path-mtu, refresh-rate and timeout are applied. |
Task ID |
Operations |
---|---|
cgn |
read, write |
The following example shows how to configure the path-mtu with the value of 2900 for the netflowv9-based external-logging facility:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)# external-logging netflow version 9 RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog)# server RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog-server)# path-mtu 2900
Command | Description |
| Enables external logging of a NAT44 instance. |
| Enters inside VRF configuration mode for a NAT44 instance. |
| Enables the logging server information for the IPv4 address and port for the server that is used for the netflowv9-based external-logging facility. |
| Enables an instance for the CGN application. |
To configure a PCP server for a DS-Lite instance, use the pcp-server command in DS-Lite configuration mode. To undo the configuration, use the no form of this command.
pcp-server port port number
no pcp-server port port number
pcp-server |
Specifies the PCP server to be configured. |
port |
Specifies the port of the PCP server. |
port number |
The port number range is from 1 to 65535. The default port number is 5351. |
None
DS-Lite configuration mode
Release | Modification |
---|---|
Release 4.3.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure a PCP server for a DS-Lite instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn-inst RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite-inst RP/0/RP0/CPU0:router(config-cgn-ds-lite)# pcp-server port 66
To configure a PCP server for a NAT44 instance, use the pcp-server command in NAT44 configuration mode. To undo the configuration, use the no form of this command.
pcp-server address IPv4 address port port number
no pcp-server address IPv4 address port port number
pcp-server |
Specifies the PCP server to be configured. |
address | Specifies the address of the PCP server. |
IPv4 address | IPv4 address. |
port | Specifies the port of the PCP server. |
port number |
The port number range is from 1 to 65535. The default port number is 5351. |
None
Exec
Release | Modification |
---|---|
Release 4.3.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure a PCP server for a NAT44 instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn-inst RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat-44-inst RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf vrf-inst RP/0/RP0/CPU0:router(config-cgn-invrf)# pcp-server address 10.2.2.30 port 66
Command | Description |
Configures a Port Control Protocol (PCP) server for a DS-Lite instance. |
To limit the number of translation entries per source address, use the portlimit command in CGN configuration mode. To revert back to the default value of 100, use the no form of this command.
portlimit value
no portlimit value
value |
Value for the port limit. Range is from 1 to 65535. |
If the port limit is not configured, the default value is 100 per CGN instance.
CGN configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
This is a NAT44 service type specific command to be applied for each CGN instance.
The portlimit command configures the port limit per subscriber for the system, including TCP, UDP, and ICMP. In addition, the portlimit command restricts the number of ports that is used by an IPv4 address; for example, it limits the number of CNAT entries per IPv4 address in the CNAT table.
Task ID |
Operations |
---|---|
cgn |
read, write |
This example shows how the port-limit needs can increased from the default value of 100 to a higher value of 500:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# portlimit 500
Command | Description |
| Enables an instance for the CGN application. |
To limit the number of translation entries of each source address, for each VRF instance, use the portlimit command in Inside-VRF configuration mode. To return to the default value of 100, use the no form of this command.
portlimit value
no portlimit
value |
Value for the port limit. The range is from 1 to 65535. |
By default, there are 100 translation entries for each VRF instance.
Inside-VRF configuration
Release |
Modification |
---|---|
Release 4.3.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID |
Operations |
---|---|
cgn |
read, write |
This example shows how to set the port-limit of 500 for a VRF instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf invrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)# portlimit 500
Command | Description |
| Allocates a number of contiguous outside ports in bulk to reduce Netflow/Syslog data volume. |
| Enables external logging of a NAT44 instance. |
| Enables external logging of the syslog data for a NAT44 instance. |
To create a port-set with a unique name, use the port-set command in the Carrier Grade NAT (CGN) configuration mode. To delete the port-set, use the no form of this command.
port-set name
no port-set
name |
Specifies the name of the port-set to be created. |
None
CGN configuration mode
Release | Modification |
---|---|
Release 5.3.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Each port-set can contain up to 20 ports per UDP or TCP transport protocol. If a port-set is in use by one or more NAT inside-vrf instances, users cannot delete that port-set until the associations with all NAT inside-vrf instances are removed. However, the user can modify the contents of port-set while they are in use and the modifications take effect immediately.Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to create a port-set for a CGN instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# port-set set1 RP/0/RP0/CPU0:router(config-cgn-portset)#
To enter ICMP, TCP, and UDP protocol configuration mode for a given CGN instance, use the protocol command in the appropriate configuration mode. To remove all the features that are enabled under the protocol configuration mode, use the no form of this command.
protocol { icmp | tcp | udp } { mss | <28-1500> } { static-forward inside address | <A.B.C.D> | port | <1-65535> }
no protocol { icmp | tcp | udp }
icmp |
Enters ICMP protocol configuration mode. |
tcp |
Enters TCP protocol configuration mode. |
udp |
Enters UDP protocol configuration mode. |
<28-1500> |
Maximum segment size to be used in bytes. |
static-forward |
Configures a static port. |
inside |
Specifies inside network configuration.. |
address |
Specifies the inside address for static-forward. |
<A.B.C.D> |
Specifies the inside IP address. |
address |
Specifies the port number for static-forward. |
None
CGN inside VRF NAT44 configuration mode
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The protocol command enters the appropriate CGN NAT44 configuration mode.
Task ID |
Operations |
---|---|
cgn |
read, write |
This example shows how to configure the ICMP protocol for a CGN instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)# protocol icmp RP/0/RP0/CPU0:router(config-cgn-invrf-icmp)# static-forward inside address 192.0.2.1 port 650
Command | Description |
| Enables an instance for the CGN application. |
| Displays the translation table entries for an inside-address to outside-address for a specified NAT44 CGN instance. |
| Displays the outside-address to inside-address translation details for a specified NAT44 instance. |
To enter the TCP and UDP protocol configuration mode and specify the ports to be preserved, use the protocol command in the port-set configuration mode. To remove the ports that are preserved, use the no form of this command.
protocol { udp | tcp } {preserve-ports port-number}
no protocol { udp | tcp } {preserve-ports port-number}
udp |
Enters the UDP protocol configuration mode. |
tcp |
Enters the TCP protocol configuration mode. |
preserve-ports |
Preserves the ports. |
port number |
Port number. The range is from 1 to 4294967295. Users can enter up to 20 port numbers separated by space per protocol. |
None
Port-set configuration mode.
Release | Modification |
---|---|
Release 5.3.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The no form of the protocol command must not be used when the port-set is in use by an inside-vrf instance. However, users can modify the port-numbers under the TCP or UDP protocol.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to enter the protocol configuration mode and specify the ports to be preserved:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# port-set set1 RP/0/RP0/CPU0:router(config-cgn-portset)# protocol udp RP/0/RP0/CPU0:router(config-cgn-proto)# preserve-port 1021 1031 1041 1101 1202 1303 1404 15015 1606 RP/0/RP0/CPU0:router(config-cgn-portset)# protocol tcp RP/0/RP0/CPU0:router(config-cgn-proto)# preserve-port 1020 1050 1100 1200 1300 1400 1500 1600
To enter the ICMP, TCP, and UDP protocol configuration mode, use the protocol command. To remove all features that are enabled under the protocol configuration mode, use the no form of this command.
protocol { gre | icmp | tcp | udp } { session | active | initial } {timeout value}
no protocol { gre | icmp | tcp | udp }
gre |
Enters the GRE protocol configuration mode. |
icmp |
Enters the ICMP protocol configuration mode. |
tcp |
Enters the TCP protocol configuration mode. |
udp |
Enters the UDP protocol configuration mode. |
session |
Session related configuration. |
active |
Active session timeout |
initial |
Initial session timeout |
timeout |
Session timeout |
value |
Timeout in seconds. The range is from 1 to 65535. |
None
NAT44 configuration mode
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
Release 4.3.0 |
The keyword, gre was added. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The protocol command enters the appropriate CGN AFI configuration mode.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the ICMP protocol for a CGN instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# protocol icmp timeout 120
This example shows how to configure the UDP protocol for a CGN instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# protocol udp session initial timeout 120 RP/0/RP0/CPU0:router(config-cgn-nat44)# protocol udp session active timeout 180
This example shows how to configure the TCP protocol for a CGN instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# protocol tcp session active timeout 180
RP/0/RP0/CPU0:router#configure RP/0/RP0/CPU0:router(config)#service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#service-type nat44 nat44-1 RP/0/RP0/CPU0:router(config-cgn-nat44)# protocol gre RP/0/RP0/CPU0:router(config-cgn-nat44-proto)#
To reset the received packet size to 1280 when the received ipv4 ICMP packet size is less than 1280 bytes, use the protocol icmp reset-mtu command . To copy the received icmp packet size when translating ipv4 to ipv6 packets, use the no form of this command.
protocol icmp reset-mtu
no protocol icmp reset-mtu
This command has no keywords or arguments.
Received packet size will be copied when translating ipv4 to ipv6 for icmp packets.
CGN-NAT64
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
When the icmp reset-mtu protocol is enabled, the ICMP packet size is reset to 1280.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the icmp reset-mtu protocol for a CGN instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type nat64 stateless xlat1 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# ipv6-prefix 2010:db8:ff00::/40 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# address-family ipv6 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless-afi)# protocol icmp RP/0/RP0/CPU0:router(config-cgn-nat64-stateless-icmp)# reset-mtu
Command | Description |
| Enters the IPv6 address family configuration mode. |
| Generates the delegated ipv6 prefix for a IPv6 Rapid Deployment (6RD) application. |
| Enables an instance for the CGN application. |
| Creates a nat64 stateless application |
| Configures a range of ipv4 addresses that are to be used for mapping when a non-translatable ipv6 address is received. |
| Reserves the bits 64 to 71 for the IPv6 addresses. |
To reassemble fragmented packets, use the reassembly-enable command in 6RD configuration mode. To disable the reassembly of fragmented packets, use the no form of this command.
reassembly-enable
no reassembly-enable
This command has no keywords or arguments.
By default, reassembly is not allowed.
6RD configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to apply the reassembly-enable command for a 6RD tunnel:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# reassembly-enable
To configure the Network Address Translation (NAT) mapping refresh direction for the specified CGN instance, use the refresh-direction command in NAT44 configuration mode. To revert back to the default value of the bidirection, use the no form of this command.
refresh-direction Outbound
no refresh-direction Outbound
Outbound |
Configures only the refresh direction for outbound. |
If the NAT refresh direction is not configured, the default is bidirectional.
NAT44 configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
This is a NAT44 service type specific command to be applied for each CGN instance.
Translation entries that do not have traffic flowing for specific time period are timed out and deleted to prevent unnecessary usage of system resources. Any traffic for a particular translation entry refreshes the entry and prevents it getting timed out. Usually, the refresh is based on packets coming from both inside and outside. This is referred to as bi-directional refresh mechanism. However, bidirectional refresh can lead to denial of service (DoS) attacks because someone from the outside can periodically refresh the entries even though there is no inside traffic.
When NAT refresh direction is configured as Outbound, the translation entries are refreshed only by traffic flowing from inside to outside and prevent DoS attacks.
Task ID |
Operations |
---|---|
cgn |
read, write |
The following example shows how to configure the mapping refresh direction for outbound:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# refresh-direction outbound
Command | Description |
| Enables an instance for the CGN application. |
To configure the refresh rate to log NetFlow-based external logging information for an inside VRF of a CGN instance, use the refresh-rate command in CGN inside VRF external logging server configuration mode. To revert back to the default value of 500 packets, use the no form of this command.
refresh-rate value
no refresh-rate value
value |
Value, in packets, for the refresh rate. Range is from 1 to 600. |
value : 500
CGN inside VRF external logging server configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The netflowv9-based logging facility requires that a logging template be sent to the server periodically. The refresh-rate value implies that after sending that number of packets to the server, the template is resent. The timeout value implies that after that number of minutes have elapsed since the template was last sent, the template is resent to the logging server. The refresh-rate and timeout values are mutually exclusive; that is, the one that expires first, is the one taken into consideration for resending the template.
Note | Only when the ipv4 address and port number for the logging server has been configured, the configurations for path-mtu, refresh-rate and timeout are applied. |
Task ID |
Operations |
---|---|
cgn |
read, write |
This example shows how to configure the refresh rate value of 50 for NetFlow logging for the NAT table entries:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)# external-logging netflow version 9 RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog)# server RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog-server)# refresh-rate 50
Command | Description |
| Enables external logging of a NAT44 instance. |
| Enters inside VRF configuration mode for a NAT44 instance. |
| Enables the logging server information for the IPv4 address and port for the server that is used for the netflowv9-based external-logging facility. |
| Enables an instance for the CGN application. |
| Displays the contents of the NAT44 CGN instance statistics. |
To reset the Do Not Fragment (DF) bit to enable anycast mode, use the reset-df-bit command in 6RD configuration mode. To disable the anycast mode, use the no form of this command.
reset-df-bit
no reset-df-bit
This command has no keywords or arguments.
Anycast mode is disabled.
6RD configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to reset the DF bit:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# reset-df-bit
To configure sequence number check in the TCP configuration, use the sequence-check command. To disable this sequence check, use the no sequence-check command.
sequence-check
no sequence-check
diff-window |
This optional keyword allows user to configure a value equal to the difference between the expected and received sequence numbers. The range for this value is 0 to 1,073,725,440. If this keyword is not specified, then the difference is automatically computed for each TCP session based on the negotiated window size while establishing a connection. It is recommended that the user does not configure a specific diff-window. This value will be decided based on the client-server negotiation for every TCP session. But if there are particular deployment scenarios, the diff-window can be configured with a value from the specified range. |
None
NAT44 Configuration Mode
Release | Modification |
---|---|
Release 5.1.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
If a packet's sequence number is not the same as the expected value (which is equal to expected sequence number +/- diff-window), even then the packet is accepted. This is because there could be a packet loss along the way. If the value of diff-window is 0, then the sequence number of each packet should be an exact match of the expected sequence number.
Task ID | Operation |
---|---|
cgn |
read, write |
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)#firewall protocl tcp RP/0/RP0/CPU0:router(config-cgn-invrf)#sequence-check
To enable the logging server information for the IPv4 address and port for the server that is used for the netflowv9-based external-logging facility, use the server command in NAT44 inside-VRF external logging configuration mode. To disable this feature, use the no form of this command. External logging of NAT Entries gets disabled.
server
no server
This command has no arguments or keywords.
NAT44 inside VRF external logging configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The server command enters NAT44 inside VRF address family external logging server configuration mode.
The NAT44 server command configures the ipv4 address and port number for the server to be used for netflowv9 based external logging facility for an inside-VRF of a NAT44 instance.
Note | Only when the ipv4 address and port number for the logging server has been configured, the configurations for path-mtu, refresh-rate and timeout are applied. |
Task ID |
Operations |
---|---|
cgn |
read, write |
This example shows how to configure the logging information for the IPv4 address and server:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)# external-logging netflow version 9 RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog)# server RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog-server)# address 10.10.0.0 port 50
Command | Description |
| Enables the IPv4 address of the server that is used for logging the entries for the Network Address Translation (NAT) table. |
| Enables external logging of a NAT44 instance. |
| Enters inside VRF configuration mode for a NAT44 instance. |
| Configures the path Maximum Transmission Unit (MTU) for the netflowv9-based external-logging facility for the inside VRF of a NAT44 instance. |
| Configures the refresh rate to log NetFlow-based external logging information for an inside VRF of a CGN instance. |
| Enables an instance for the CGN application. |
| Displays the contents of the NAT44 CGN instance statistics. |
| Configures the frequency at which the netflow-v9 template is refreshed or resent to the netflow-v9 server. |
To enable an instance for the CGN application, use the service cgn command in global configuration mode. To disable the instance of the CGN application, use the no form of this command.
service cgn instance-name
no service cgn instance-name
instance-name |
Name of the CGN instance that is configured. |
None
Global configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The service cgn command enters CGN configuration mode.
Task ID |
Operations |
---|---|
cgn |
read, write |
The following example shows how to configure the instance named cgn1 for the CGN application:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)#
To enable the particular instance of the CGN application on the active and standby locations, use the service-location command in CGN configuration mode. To disable the instance that runs at the location of the CGN application, use the no form of this command.
service-location preferred-active node-id [ preferred-standby node-id ]
no service-location preferred-active node-id [ preferred-standby node-id ]
preferred-active node-id |
Specifies the location in which the active CGN application starts. The node-id argument is entered in the rack/slot/module notation. |
preferred-standby node-id |
(Optional) Specifies the location in which the standby CGN application starts. The node-id argument is entered in the rack/slot/module notation. |
None
CGN configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID |
Operations |
---|---|
cgn |
read, write |
The following example shows how to specify active and standby locations for the CGN application:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn-nat44)# service-location preferred-active 0/1/CPU0 preferred-standby 0/4/CPU0
Command | Description |
| Enables a CGN service role on a specified location. |
| Enables the application SVI interface. |
| Enables the infrastructure SVI interface. |
| Enables an instance for the CGN application. |
To configure the location of a service for the infrastructure service virtual interface (SVI), use the service-location command in interface configuration mode. To disable this feature, use the no form of this command.
service-location node-id
no service-location node-id
node-id |
Specifies the ID of the node. The node-id argument is entered in the rack/slot/module notation. |
Interface configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID |
Operations |
---|---|
interface |
read, write |
The following example shows how to configure the service location for 0/1/CPU0:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# interface ServiceInfra 1 RP/0/RP0/CPU0:router(config-if)# service-location 0/1/CPU0
To initiate failover services to the preferred standby location, use the service redundancy failover service-type command in EXEC mode.
service redundancy failover service-type secgn preferred-active node-id
secgn |
Specifies the CGN service. |
preferred-active node-id |
Specifies the location from where the failover must start. The node-id argument is entered in the rack/slot/module notation. |
None
EXEC
Release |
Modification |
---|---|
Release 4.0.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID |
Operations |
---|---|
cgn |
read, write |
The following example shows how to initiate the failover services for the preferred standby location:
RP/0/RP0/CPU0:router# service redundancy failover service-type secgn preferred-active 0/1/cpu0 RP/0/RP0/CPU0:router#
To revert failed over services back to their preferred active location, use the service redundancy revert service-type command in EXEC mode.
service redundancy revert service-type secgn preferred-active node-id
secgn |
Specifies the CGN service. |
preferred-active node-id |
Specifies the location from where the failover must start. The node-id argument is entered in the rack/slot/module notation. |
None
EXEC
Release |
Modification |
---|---|
Release 4.0.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID |
Operations |
---|---|
cgn |
read, write |
The following example shows how to revert the failed over services for the preferred active location:
RP/0/RP0/CPU0:router# service redundancy revert service-type secgn preferred-active 0/1/cpu0 RP/0/RP0/CPU0:router#
To enable a NAT 44 instance for the CGN application, use the service-type nat44 command in CGN submode. To disable the NAT44 instance of the CGN application, use the no form of this command.
service-type nat44 instance-name [ alg | inside-vrf | portlimit | protocol | refresh-direction ]
no service-type nat44 instance-name
instance-name |
Name of the NAT44 instance that is configured. |
alg |
Configures the Application Level Gateway type to be used. |
inside-vrf |
Configures inside VRF. |
portlimit |
Limits the number of entries per address. |
protocol |
Specifies the Transport protocol. |
refresh-direction |
NAT refresh direction to be used. |
None
CGN submode (CONFIG-CGN)
Release |
Modification |
---|---|
Release 4.0.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The NAT44 instance name must be unique across all CGN NAT44 and NAT64 stateless instance names.
Task ID |
Operations |
---|---|
cgn |
read, write |
This example shows how to configure the NAT44 instance named nat1 for the CGN application:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1
Use the service-type nat64 command to create a nat64 stateless application. To delete the nat64 stateless application, use the no form of this command.
service-type nat64 stateless instance [ address-family | traceroute | ipv6-prefix | ubit-reserved ]
no service-type nat64 statelessinstance
stateless |
Specifies the IPv4 to IPv6 Stateless translation. |
instance |
Indicates the name of the NAT64 stateless instance. |
address-family |
Specifies the address-family related configuration. |
traceroute |
Indicates the traceroute related configuration. |
ipv6-prefix |
Specifies the IPv6 prefix to be used to translate IPv4 address to IPv6 address. |
ubit-reserved |
Enables reserving ubits in IPv6 address. |
None
CONFIG-CGN
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The NAT64 stateless instance name must be unique across all the CGN NAT44 and NAT64 stateless instance names. There can only be 64 service-type NAT64 configurations per Roddick line card or chassis spanning over different cards.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the nat64 stateless instance named xlat1for the CGN application:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat64 stateless xlat1
To create an IPv6 Rapid Deployment (6RD) tunnel application, use the service-type tunnel command in CGN submode. To delete this instance of the 6RD tunnel application, use the no form of this command.
service-type tunnel v6rd instance address-family | br | path-mtu | reassembly-enable | reset-df-bit | tos | ttl
no service-type tunnel v6rd instance
v6rd |
Specifies the 6RD configuration. |
instance |
Name of the 6RD instance. |
address-family |
Specifies the address-family related configuration. |
br |
Specifies the border relay related configuration. |
path-mtu |
Specifies the IPv6 MTU value. |
reassembly-enable |
Enables the reassembly operation. |
reset-df-bit |
Enables resetting of DF bit. |
tos |
Specifies the type of service to be used for IPv4 tunnel. |
ttl |
Specifies the time to live value to be used for IPv4 tunnel. |
None
CGN submode
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
There can be 64 service-type 6RD tunnel configurations for each line card or chassis spanning over different cards.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the 6RD tunnel instance for the CGN application:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)#
To configure the timeout values for both active and initial sessions for TCP or UDP, use the session command in NAT44 protocol configuration mode. To revert to the default value for the TCP or UDP session timeouts, use the no form of this command.
session { active | initial } timeout seconds
no session { active | initial } timeout seconds
active |
Configures the active session timeout for both TCP and UDP. The default value for UDP active session timeout is 120 seconds. |
initial |
Configures the initial session timeout. |
timeout |
Configures the timeout for either active or initial sessions. |
seconds |
Timeout for either active or initial sessions. Range is from 1 to 65535. |
If the value for the UDP initial session timeout is not configured, the default value for the UDP initial session timeout is 30.
If the value for the UDP active session timeout is not configured, the default value for the UDP active session timeout is 120.
If the value for the TCP initial session timeout is not configured, the default value for the TCP initial session timeout is 120.
If the value for the TCP active session timeout is not configured, the default value for the TCP active session timeout is 1800 (30 minutes).
NAT44 protocol configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
We recommend that you configure the timeout values for the protocol sessions carefully. For example, the values for the protocol and NAT functions must be configured properly.
If the no form of this command is specified, the following guidelines apply:
Task ID |
Operations |
---|---|
cgn |
read, write |
This example shows how to configure the initial session timeout value as 90 for TCP:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# protocol tcp RP/0/RP0/CPU0:router(config-cgn-proto)# session initial timeout 90
This example shows how to configure the active timeout value as 90 for TCP:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# protocol tcp RP/0/RP0/CPU0:router(config-cgn-proto)# session active timeout 90
This example shows how to configure the initial timeout value as 90 for UDP:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# protocol udp RP/0/RP0/CPU0:router(config-cgn-proto)# session initial timeout 90
This example shows how to configure the active timeout value as 90 for UDP:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# protocol udp RP/0/RP0/CPU0:router(config-cgn-proto)# session active timeout 90
Command | Description |
protocol (NAT44) |
|
| Enables an instance for the CGN application. |
| Displays the translation table entries for an inside-address to outside-address for a specified NAT44 CGN instance. |
| Displays the outside-address to inside-address translation details for a specified NAT44 instance. |
| Configures the timeout for the ICMP session for a CGN instance. |
To enable session logging for a DS-Lite instance, use the session-logging command in DS-Lite configuration mode.
To disable session logging, use the no form of this command.session-logging
no session-logging
This command has no keywords or arguments.
By default, session logging is disabled.
DS-Lite configuration mode
Release | Modification |
---|---|
Release 4.3.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to enable session logging for a DS-Lite instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn-inst RP/0/RP0/CPU0:router(config-cgn)# service-type ds-lite ds-lite-inst RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf vrf-inst RP/0/RP0/CPU0:router(config-cgn-invrf)# external-logging netflow version 9 RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog)# server RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog-server)# session logging
Command | Description |
Enables session logging for a NAT44 instance. |
To enable session logging for a NAT44 instance, use the session-logging command in NAT44 configuration mode.
To disable session logging, use the no form of this command.session-logging
no session-logging
This command has no keywords or arguments.
By default, session logging is disabled.
NAT44 configuration mode
Release | Modification |
---|---|
Release 4.3.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to enable session logging for a NAT44 instance:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn-inst RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat-44-inst RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf vrf-inst RP/0/RP0/CPU0:router(config-cgn-invrf)# external-logging netflow version 9 RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog)# server RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog-server)# session logging
Command | Description |
Enables session logging for a DS-Lite instance. |
To display all the active destination sessions for a given source IPv4 address and port number per DS-Lite instance, use the show cgn ds-lite session command in EXEC mode.
show cgn ds-lite instance-name session protocol { icmp | tcp | udp } [ translation-type { alg | all | dynamic | static } ] [ tunnel-v6-source-address IPv6 address inside-address IPv4 address port port number
session |
Specifies the active session for a given source IP address and port. |
instance-name |
Name of the DS-Lite instance that is configured. |
protocol |
Displays the name of the protocols. |
icmp |
Displays the ICMP protocol. |
tcp |
Displays the TCP protocol. |
udp |
Displays the UDP protocol. |
translation-type |
(Optional) Displays the translation type. |
alg |
(Optional) Displays only the ALG translation entries. |
all |
(Optional) Displays all the translation entries, for example, alg, dynamic, and static. |
dynamic |
(Optional) Displays only the dynamic translation entries. |
static |
(Optional) Displays only the static translation entries. |
ipv4 |
(Optional) Displays information for the IPv4 address family. |
tunnel-v6-source-address |
Specifies the source tunnel IPv6 address. |
IPv6 address |
IPv6 address. |
inside-address |
Displays the inside address for the inside Virtual Routing Forwarding (VRF). |
IPv4 address |
IPv4 address of the source. |
port |
Port number of the source. |
port-number |
Specifies the port number range from 1 to 65535. |
None
Exec
Release | Modification |
---|---|
Release 4.3.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read |
This example shows how to display all the active destination sessions for a given source IPv4 address and port number per DS-Lite instance:
RP/0/RP0/CPU0:router#
show cgn ds-lite ds-lite-inst session protocol tcp translation-type alg inside-address 10.1.1.50 port 123
Session details:
-----------------------------------------------------------------
DS-Lite instance: ds-lite-inst
-----------------------------------------------------------------
Outside address: 12.168.6.231
Outside port: 235
Translation type: alg
Protocol: tcp
-----------------------------------------------------------------------
Destination IP Destination Port
209.85.231.104 100
209.85.231.106 200
.
.
.
.
209.85.231.178 579
To display the counters for sequence-check, use the show cgn nat44 inside-vrf counters command in EXEC mode.
show cgn nat44 instance-name inside-vrf instance-name counters
counters |
Lists the counters for TCP sequence check |
instance-name |
The name of the NAT44 instance |
None
EXEC
Release | Modification |
---|---|
Release 5.1.1 |
This command was introduced. |
Release 5.2.0 |
Additional counters were introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
The following example shows the counters for TCP sequence check.
RP/0/RP0/CPU0:router# show cgn nat44 nat1 inside-vrf vrf1 counters
Counters summary of NAT44 instance: 'nat1'
Number of Out2In drops due to TCP sequence mismatch: 0
Number of Outside to inside TCP sequence mismatch: 0
Total number of sessions created due to Out2In packets: 0
Number of Out2In drops due to end point filtering: 0
Number of translations created: 2019
Number of translations deleted: 2017
Number of sessions created: 190000
Number of sessions deleted: 170000
Syslog/Netflow translation create records generated: 0
Syslog/Netflow translation delete records generated: 0
Syslog/Netflow sessions create records generated: 0
Syslog/Netflow sessions delete records generated: 0
Number of Netflow packets generated: 0
Number of Syslog packets generated: 0
Dropped Netflow packets due to congestion: 0
Dropped Syslog packets due to congestion: 0
Average usage of bulk allocated ports: 0
Average number of bulk-allocations made: 0
The following table describes the fields seen in the output of the show cgn nat44 inside-vrf counters as shown in the above example:
Name |
Description |
Number of Out2In drops due to TCP sequence mismatch |
Number of packets dropped for not being in the sequence |
Number of Outside to inside TCP sequence mismatch |
Number of TCP packets dropped for not being in the sequence |
Total number of sessions created due to Out2In packets |
Number of sessions created with both Inside-to-Outside and Outside-to-Inside packets |
Number of Out2In drops due to end point filtering |
Number of packets dropped if Endpoint-Dependent Mapping is configured |
Number of translations created |
Total number of translations created |
Number of translations deleted |
Total number of translations cleared after the timeout |
Number of sessions created |
Total number of sessions created |
Number of sessions deleted |
Total number of sessions deleted |
Syslog/Netflow translation create records generated |
Number of translation create records generated for Syslog or NetFlow |
Syslog/Netflow translation delete records generated |
Number of translation create records deleted for Syslog or NetFlow |
Syslog/Netflow sessions create records generated |
Number of session create records generated for Syslog or NetFlow |
Syslog/Netflow sessions delete records generated |
Number of session delete records generated for Syslog or NetFlow |
Number of Netflow packets generated |
Number of packets generated for NetFlow |
Number of Syslog packets generated |
Number of packets generated for Syslog |
Dropped Netflow packets due to congestion |
Number of NetFlow packets dropped due to system errors |
Dropped Syslog packets due to congestion |
Number of Syslog packets dropped due to system errors |
Average usage of bulk allocated ports |
Percentage of the usage of the bulk allocated ports |
Average number of bulk-allocations made |
Percentage of the bulk allocations made from all the possible locations |
To display the GRE channels of a PPTP tunnel, use the show cgn nat44 greEntries command in EXEC mode.
show cgn nat44 instance-name greEntries inside-vrf vrf-name tunnel-address address pns-port port-number call-id start value end value
instance-name |
Name of the configured NAT44 instance. |
greEntries | GRE channels of the PPTP tunnel. |
inside-vrf | The Virtual Routing Forwarding (VRF) for which the translation details are needed. |
vrf-name | Name of the VRF. |
tunnel-address | Address of the PPTP Network Server (PNS). |
pns-port | Port number of the PNS. The range is from 1 to 65535. |
call-id | Range of call IDs. |
value |
Value of the call IDs. The range is from 0 to 65535. |
None
Exec
Release | Modification |
---|---|
Release 4.3.0 |
This command was introduced. |
Task ID | Operation |
---|---|
cgn |
read |
This example displays the GRE channel details:
RP/0/RP0/CPU0:router# show cgn nat44 nat1 greEntries
GRE-Channel details
---------------------------
NAT44 instance : instname
Inside-VRF : vrf name
-------------------------------------
In Call Id Out Call Id
--------------------------------------
xxxx yyyy
aaaa bbbb
To display the translation table entries for an inside-address to outside-address for a specified NAT44 CGN instance, use the show cgn nat44 inside-translation command in EXEC mode.
show cgn nat44 instance-name { inside-vrf protocol { gre | icmp | tcp | udp } [ translation-type { alg | all | dynamic | pcp-explicit-dynamic | pcp-implicit-dynamic | static } ] inside-vrf vrf-name | tunnel-v6-source-address { source tunnel address | | inside-address | address port | | start | | number | end | | number }
instance-name |
Name of the NAT44 instance that is configured. |
protocol |
Displays the name of the protocols. |
gre |
Displays the GRE protocol. |
icmp |
Displays the ICMP protocol. |
tcp |
Displays the TCP protocol. |
udp |
Displays the UDP protocol. |
translation-type |
(Optional) Displays the translation type. |
alg |
(Optional) Displays only the ALG translation entries. |
all |
(Optional) Displays all the translation entries, for example, alg, dynamic, and static. |
pcp-explicit-dynamic |
Displays Port Control Protocol (PCP) explicit translation entries. |
pcp-implicit-dynamic |
Displays Port Control Protocol (PCP) implicit translation entries |
dynamic |
(Optional) Displays only the dynamic translation entries. |
static |
(Optional) Displays only the static translation entries. |
ipv4 |
(Optional) Displays information for the IPv4 address family. |
inside-vrf |
Displays the information for the inside VPN routing and forwarding (VRF) for the necessary translation details. |
vrf-name |
Name of the inside VRF. |
inside-address |
Displays the inside address for the inside VRF. |
address |
Inside address. |
port |
Displays the range of the port numbers. |
start number |
The start port from which the translation table entries should be displayed. |
end number |
The end port till which the translation table entries should be displayed. |
None
EXEC
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.0.0 |
NAT44 instance was included to the command. |
Release 4.3.0 |
The keyword, gre was added. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The show cgn nat44 inside-translation command displays the translation for entries that are based on the inside-vrf, inside IPv4 address, and the pool of the inside ports. The inside-address keyword must have a /32 address. Each entry is displayed with a field that informs whether it is static, ALG, or dynamic translation.
If the value of the translation type is not specified, all types of entries are displayed.
Task ID |
Operations |
---|---|
cgn |
read |
This example shows sample output from the show cgn inside-translation command:
RP/0/RP0/CPU0:router#
show cgn nat44 nat1 inside-translation protocol tcp inside-vrf insidevrf1 inside-address 192.168.6.23 port-range 23 56
Inside-translation details
-----------------------------------
NAT44 instance : nat1
Inside-VRF : insidevrf1
--------------------------------------------------------------------------------------
Outside Protocol Inside Outside Translation Inside Outside
Address Source Source Type to to
Port Port Outside Inside
Packets Packets
--------------------------------------------------------------------------------------
12.168.6.231 tcp 34 2356 alg 875364 65345
12.168.6.98 tcp 56 8972 static 78645 56343
12.168.2.12 tcp 21 2390 static 45638 89865
12.168.2.123 tcp 34 239 dynamic 809835 67854
.
.
.
.
.
12.168.2.123 tcp 34 3899 dynamic 9835 6785
RP/0/RP0/CPU0:router
show cgn nat44 inst1 inside-translation protocol gre inside-vrf ivrf inside-address 11.11.11.2 port start 1 end 65535
Inside-translation details
---------------------------
NAT44 instance : inst1
Inside-VRF : ivrf
--------------------------------------------------------------------------------------------
Outside Protocol Inside Outside Translation Inside Outside
Address Source Source Type to to
Port Port Outside Inside
Packets Packets
--------------------------------------------------------------------------------------------
52.52.52.215 gre 21 61746 alg 0 359423
52.52.52.215 gre 23 32489 alg 0 359423
52.52.52.215 gre 29 5940 alg 0 359423
Note | There is no Inside-to-Outside accounting during GRE translation. The value is always 'zero'. |
This example shows the sample output for PCP translations:
RP/0/RP0/CPU0:router
show cgn nat44 nat1 inside-translation protocol udp inside-translation inside-vrf
red inside-address 11.11.11.12 port start 1 end 65535
Inside-translation details
---------------------------
NAT44 instance : nat1
Inside-VRF : red
--------------------------------------------------------------------------------------------
Outside Protocol Inside Outside Translation Inside Outside
Address Source Source Type to to
Port Port Outside Inside
Packets Packets
--------------------------------------------------------------------------------------------
100.0.0.217 udp 14 34655 pcp_explicit 7 0
100.0.0.217 udp 14 34655 pcp_implicit 7 0
Field |
Description |
---|---|
CGN instance |
Name of the CGN instance configured |
Inside-VRF |
Name of the inside-vrf configured |
Outside Address |
Outside IPv4 address |
Inside Source Port |
Inside Source Port Number |
Outside Source Port |
Translated Source Port Number |
Translation Type |
Type of Translation (All/ALG/Dynamic/pcp-explicit-dynamic/pcp-implicit-dynamic/Static). |
Inside to Outside Packets |
Outbound Packets. |
Outside to Inside Packets |
Inbound Packets. |
Command | Description |
| Clears translation database entries that are created dynamically for the specified inside VRF. |
| Clears the translation database entries that are created dynamically for the specified inside port number. |
| Clears translation database entries that are created dynamically for the specified protocol. |
protocol (NAT44) |
|
| Enables an instance for the CGN application. |
| Displays the outside-address to inside-address translation details for a specified NAT44 instance. |
To display the mapping from a private IP address to a public IP address or from a public IP address to a private IP address for NAT44 in both the classic mode and the predefined mode, use the show cgn nat44 mapping command.
show cgn nat44 instance-name mapping { inside-address | outside-address} inside-vrf vrf-instance start-addr start address [ end-addr end address]
inside-address |
Displays the IPv4 address from the private pool. |
outside-address |
Displays the public IPv4 address. |
vrf-instance |
Name of the VRF. |
start-addr start address |
Start address for the IPv4 address range for which the mapping has to be displayed. |
end-addr end address |
Last address of the IPv4 address range for which the mapping has to be displayed. |
None
Exec
Release | Modification |
---|---|
Release 4.3.2 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read |
RP/0/RP0/CPU0:router#
show cgn nat44 nat1 mapping inside-address inside-vrf ins1 start-addr 192.1.106.0 end-addr 192.1.107.37
Session details:
-----------------------------------------------------------------
NAT44 instance: nat1
VRF : ins1
-----------------------------------------------------------------
-----------------------------------------------------------------------------------------------
Inside Ip Outside IP Type Port Range Ports Used
Address Address
-----------------------------------------------------------------------------------------------
192.1.107.0 198.12.0.28 Predefined 29696-36863 0
192.1.107.1 198.12.0.29 Predefined 29696-36863 1
.
.
.
.
192.1.107.37 198.12.0.57 Predefined 29696-36863 0
Field |
Description |
---|---|
NAT44 instance |
Name of the NAT44 instance configured |
inside-vrf |
Name of the VRF configured |
Outside IP Address |
Public IPv4 address |
Inside IP Address |
IPv4 address from the private pool. |
Type |
Type of the NAT mode. |
Port Range |
The range of ports defined for the public IP addresses to which the mapping is done. |
Ports Used |
Specifies the number of translations that are currently being used by the subscriber. The value 0 indicates that the subscriber is not using address translation at that moment. The value that is equal to the number of ports in the range indicates that the subscriber might have exceeded the allocated limit because of which some packets might be dropped. |
To display the outside-address to inside-address translation details for a specified NAT44 instance, use the show cgn nat44 outside-translation command in EXEC mode.
show cgn nat44 instance-name outside-translation protocol { gre | icmp | tcp | udp } [ translation-type { alg | all | dynamic | pcp-explicit-dynamic | pcp-implicit-dynamic | static } ] outside-address address port start number end number
instance-name |
Name of the NAT44 instance that is configured. |
protocol |
Displays the name of the protocols. |
gre |
Displays the GRE protocol. |
icmp |
Displays the ICMP protocol. |
tcp |
Displays the TCP protocol. |
udp |
Displays the UDP protocol. |
translation-type |
(Optional) Displays the translation type. |
alg |
(Optional) Displays only the ALG translation entries. |
all |
(Optional) Displays all the translation entries, for example, alg, dynamic, and static. |
pcp-explicit-dynamic |
Displays Port Control Protocol (PCP) explicit translation entries. |
pcp-implicit-dynamic |
Displays Port Control Protocol (PCP) implicit translation entries |
dynamic |
(Optional) Displays only the dynamic translation entries. |
static |
(Optional) Displays only the static translation entries. |
outside-address |
Displays the outside address for the inside VRF. |
address |
Outside address. |
port |
Displays the range of the port numbers. |
start number |
Displays the start of the port number. |
end number |
Displays the end of the port number. |
None
EXEC
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.0.0 |
The NAT44 instance was included to the command. The address-family keyword was removed. |
Release 4.3.0 |
The keyword, gre was added. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
If you want to display the entries for a single port, the value for the end port must be equal to that of the start port. Each entry is displayed with a field that informs whether it is static, ALG, or dynamic translation.
If no VRF is specified, the entries are displayed for the default VRF.
If the value of the translation type is not specified, all types of entries are displayed.
Task ID |
Operations |
---|---|
cgn |
read |
This example shows sample output from the show cgn outside-translation command:
RP/0/RP0/CPU0:router#
show cgn nat44 nat1 outside-translation protocol tcp outside-vrf
outsidevrf1 outside-address 10.64.23.45 port start 23 end 5
Outside-translation details
---------------------------------
NAT44 instance : nat1
Outside-VRF : outsidevrf1
------------------------------------------------------------------------------------------
Outside Protocol Outside Inside Translation Inside Outside
Address Destination Destination Type to to
Port Port Outside Inside
Packets Packets
------------------------------------------------------------------------------------------
13.16.6.23 tcp 314 56 dynamic 8753 5345
13.16.6.23 tcp 819 329 alg 8901 890
13.16.6.23 tcp 40 178 alg 97654 4532
13.16.6.23 tcp 503 761 static 43215 8765
13.16.6.23 tcp 52 610 dynamic 7645 876
.
.
.
.
.
13.16.6.23 tcp 390 621 static 67532 1234
RP/0/RP0/CPU0:router
show cgn nat44 inst1 outside-translation protocol gre outside-address 52.52.52.215 port start 1 end 65535
Outside-translation details
---------------------------
NAT44 instance : inst1
Outside-VRF : default
--------------------------------------------------------------------------------------------
Inside Protocol Outside Inside Translation Inside Outside
Address Destination Destination Type to to
Port Port Outside Inside
Packets Packets
--------------------------------------------------------------------------------------------
11.11.11.2 gre 1492 43605 alg 0 359423
11.11.11.2 gre 3967 43575 alg 0 359423
11.11.11.2 gre 5940 29 alg 0 359423
Note | There is no Inside-to-Outside accounting during GRE translation. The value is always 'zero'. |
Field |
Description |
---|---|
NAT44 instance |
Name of the NAT44 instance configured |
Outside-VRF |
Name of the Outside VRF configured |
Outside Address |
Outside IPv4 address |
Protocol |
Protocol Type (TCP/UDP/ICMP) |
Outside Destination Port |
Outside Destination Port |
Inside Destination Port |
Inside Destination Port |
Translation Type |
Type of Translation ( Static/Dynamic/pcp-explicit-dynamic/pcp-implicit-dynamic/ALG/ Static+ALG) |
Inside to Outside Packets |
Outbound Packets |
Outside to Inside Packets |
Inbound Packets |
Command | Description |
| Clears translation database entries that are created dynamically for the specified inside VRF. |
| Clears the translation database entries that are created dynamically for the specified inside port number. |
| Clears translation database entries that are created dynamically for the specified protocol. |
protocol (NAT44) |
|
| Enables an instance for the CGN application. |
| Displays the translation table entries for an inside-address to outside-address for a specified NAT44 CGN instance. |
To display the outside address pool utilization details for a specified NAT44 instance, use the show cgn nat44 pool-utilization command in EXEC mode. The range of the IPv4 addresses must not be more than 255 consecutive IPv4 addresses. Any range beyond the specified limit may hog the CGSE processors resulting in unresponsive CGN commands and Health monitoring test failures which causes subsequent CGSE reload, if auto reload is not disabled.
show cgn nat44 instance-name pool-utilization inside-vrf vrf-name address-range start-address end-address
nat44instance-name |
Name of the NAT44 instance that is configured. |
inside-vrf |
Displays the contents for the inside VRF. |
vrf-name |
Name for the inside VRF. |
address-range |
Displays the range for the outside address. |
start-address |
Range for the start address of the outside address pool. The range of the IPv4 addresses cannot be more than 255 consecutive IPv4 addresses. |
end-address |
Range for the end address of the outside address pool. |
None
EXEC
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.0.0 |
The NAT44 instance was included to the command syntax. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
The show cgn nat44 pool-utilization command displays the utilization of the outside address pool. In addition, this command displays the number of free and used ports per IPv4 address in the specified range.
Task ID |
Operations |
---|---|
cgn |
read |
The following sample output shows the number of free and used global addresses and port numbers:
RP/0/RP0/CPU0:router# show cgn nat44 nat1 pool-utilization inside-vrf insidevrf4 address-range 17.16.6.23 20.12.23.1
Public-address-pool-utilization details
-------------------------------------------------------------------------
NAT44 instance: nat1
VRF : insidevrf4
-------------------------------------------------------------------------
Outside Number Number
Address of of
Free ports Used ports
-------------------------------------------------------------------------
17.16.6.23 123 64388
17.16.6.120 58321 6190
17.16.6.98 98 64413
17.16.6.2 1234 60123
.
.
.
.
.
.
.
.
.
18.12.6.12 678 52789
Field |
Description |
---|---|
NAT44 instance |
Name of the NAT44 instance configured |
VRF |
Name of the Inside VRF configured |
Outside Address |
Outside IPv4 address. |
Number of Free Ports |
Total number of Free ports available for the given Outside IPv4 address |
Number of Used Ports |
Total number of Used ports for the given Outside IPv4 address |
Command | Description |
| Enters inside VRF configuration mode for a NAT44 instance. |
To display the statistics of NAT44 instance related to Point-to-Point Tunneling Protocol (PPTP) Application-Level Gateway (ALG), use the show cgn nat44 pptpCounters command in EXEC mode.
show cgn nat44 instance-name pptpCounters
instance-name |
Name of the configured NAT44 instance. |
None
EXEC
Release |
Modification |
---|---|
Release 4.3.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID |
Operations |
---|---|
cgn |
read |
This example shows the statistics of PPTP ALG:
RP/0/RP0/CPU0:router# show cgn nat44 nat1 pptpCounters
PPTP Alg counters of NAT44 instance: 'nat1'
pptp active tunnels : 0
pptp active channels : 0
gre in2out fwds : 0
gre out2in fwds : 0
gre in2out drops : 0
gre out2in drops : 0
pptp ctrl msg drops : 0
start ctrl connection reqs : 0
start ctrl connection reply : 0
stop ctrl connection reqs : 0
stop ctrl connection reply : 0
echo reqs : 0
echo reply : 0
outbound connection reqs : 0
outbound connection reply : 0
inbound connection reqs : 0
inbound connection reply : 0
inbound connection connected : 0
call clear reqs : 0
call disconnect reqs : 0
wan error notify : 0
set link info : 0
To display all the active destination sessions for a given source IPv4 address and port number per NAT44 instance, use the show cgn nat44 session command in EXEC mode.
show cgn nat44 instance-name session protocol { icmp | tcp | udp } [ translation-type { alg | all | dynamic | static } ] [ inside-vrf vrf-instance inside-address IPv4 address port port number
session |
Specifies the active session for a given source IP address and port. |
instance-name |
Name of the NAT44 instance that is configured. |
protocol |
Displays the name of the protocols. |
icmp |
Displays the ICMP protocol. |
tcp |
Displays the TCP protocol. |
udp |
Displays the UDP protocol. |
translation-type |
(Optional) Displays the translation type. |
alg |
(Optional) Displays only the ALG translation entries. |
all |
(Optional) Displays all the translation entries, for example, alg, dynamic, and static. |
dynamic |
(Optional) Displays only the dynamic translation entries. |
static |
(Optional) Displays only the static translation entries. |
ipv4 |
(Optional) Displays information for the IPv4 address family. |
inside-vrf |
Displays the information for the inside VPN routing and forwarding (VRF) for the necessary translation details. |
vrf-name |
Name of the inside VRF. |
inside-address |
Displays the inside address for the inside VRF. |
address |
IPv4 address of the source. |
port |
Port number of the source. |
port-number |
Specifies the port number range from 1 to 65535. |
None
Exec
Release | Modification |
---|---|
Release 4.3.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read |
This example shows how to display all the active destination sessions for a given source IPv4 address and port number per NAT44 instance:
RP/0/RP0/CPU0:router#
show cgn nat44 nat44-inst session protocol tcp translation-type alg inside-address 10.1.1.50 port 123
Session details:
-----------------------------------------------------------------
NAT44 instance: nat44-inst
-----------------------------------------------------------------
Outside address: 12.168.6.231
Outside port: 235
Translation type: alg
Protocol: tcp
-----------------------------------------------------------------------
Destination IP Destination Port
209.85.231.104 100
209.85.231.106 200
.
.
.
.
209.85.231.178 579
Command | Description |
| Displays the translation table entries for an inside-address to outside-address for a specified NAT44 CGN instance. |
| Displays the outside-address to inside-address translation details for a specified NAT44 instance. |
| Displays the outside address pool utilization details for a specified NAT44 instance. |
| Displays the contents of the NAT44 CGN instance statistics. |
To display the contents of the NAT44 CGN instance statistics, use the show cgn nat44 statistics command in EXEC mode.
show cgn nat44 instance-name statistics
instance-name |
Name of the configured NAT44 instance. |
None
EXEC
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.0.0 |
The summary keyword was removed. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Statistics provides the total number of active translation for a given NAT44 instance and other parameters. In addition, the outside IPv4 addresses, along with the current number of ports in use, are used for translation.
Task ID |
Operations |
---|---|
cgn |
read |
This example shows the statistics entries:
RP/0/RP0/CPU0:router# show cgn nat44 nat1 statistics
Statistics summary of NAT44 instance: 'nat1'
Number of active translations: 34
Translations create rate: 0
Translations delete rate: 0
Inside to outside forward rate: 3
Outside to inside forward rate: 3
Inside to outside drops port limit exceeded: 0
Inside to outside drops system limit reached: 0
Inside to outside drops resource depletion: 0
Outside to inside drops no translation entry: 9692754
Pool address totally free: 62
Pool address used: 2
Pool address usage:
-------------------------------------------------
External Address Ports Used
-------------------------------------------------
24.114.18.53 4
24.114.18.55 30
-------------------------------------------------
The following table describes the fields seen in the output of the show cgn nat44 nat1 statistics as shown in the above example:
Name |
Description |
Number of active translations |
Translation entries allocated in the database. |
Translations create rate/Translations delete rate |
Rate in sessions per second. |
Inside to outside forward rate/Outside to inside forward rate |
Rate in packets per second. |
Inside to outside drops port limit exceeded |
Packets dropped because the port-limit for the inside user has exceeded |
Inside to outside drops system limit reached |
Packets dropped as a result of reaching the system limit. |
Inside to outside drops resource depletion |
Packets dropped because no public L4 port could be allocated. |
Outside to inside drops no translation entry |
Packets dropped due to lack of entry in the translation database. |
Pool address totally free |
Addresses available from the pool. |
Pool address used |
Addresses utilized from the pool. |
This example shows the statistics of PPTP and GRE entries:
RP/0/RP0/CPU0:router# show cgn nat44 nat1 statistics
Statistics summary of NAT44 instance: 'nat1'
Number of active translations: 3
Translations create rate: 0
Translations delete rate: 0
Inside to outside forward rate: 0
Outside to inside forward rate: 0
Inside to outside drops port limit exceeded: 0
Inside to outside drops system limit reached: 0
Inside to outside drops resorce depletion: 0
No translation entry drops: 0
PPTP active tunnels: 1
PPTP active channels: 2
PPTP ctrl message drops: 4
Pool address totally free: 255
Pool address used: 1
Pool address usage:
-------------------------------------------------
External Address Ports Used
-------------------------------------------------
52.52.52.215 3
-------------------------------------------------
To display PCP related statistics per CGN instance, use the show cgn pcpcounters command in EXEC mode.
show cgn instance-name pcpcounters
instance-name |
Name of the CGN instance. |
None
EXEC
Release | Modification |
---|---|
Release 4.3.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID |
Operations |
---|---|
cgn |
read |
This command displays the statistics corresponding to CGN instances:
show cgn c1 pcpcounters PCP counters of NAT44 instance: 'cgn1' pcp input : 3 pcp output : 3 pcp service nat44 : 3 pcp service dslite : 0 pcp drops : 0 pcp in2out key in use : 0 pcp throttle drops : 0 pcp udp length : 0 pcp nrequest : 0 pcp minimum udp length : 0 pcp maximum udp length : 0 pcp mod4 length : 0 pcp invalid 3rd party length : 0 pcp invalid option : 0 pcp version : 0 pcp invalid opcode : 0 pcp invalid client ip : 0 pcp invalid proto : 0 pcp invalid port : 0 pcp invalid vrfmap : 0 pcp invalid external address : 3 pcp out address in use : 0 pcp exact match : 0 pcp exact entry created : 0 pcp exact db allocation failed : 0 pcp udb mismatch : 0 pcp exact db not allocated : 3 pcp static entry present : 0 pcp entry deleted : 0 pcp 3rd party option present : 0 pcp map input : 3 pcp map minimum length : 0 pcp map maximum length : 0 pcp map invalid option : 0 pcp map invalid option length : 0 pcp map pref fail option : 0 pcp map invalid delete request : 0 pcp map delete request : 0 pcp map create request : 3 pcp map refresh : 0 pcp peer input : 0 pcp peer invalid length : 0 pcp peer delete request : 0 pcp peer create request : 0 pcp peer address mismatch : 0 pcp peer refresh : 0
To display the IPv6 Rapid Deployment (6RD) tunnel statistics information for a CGN instance, use the show cgn tunnel v6rd statistics command in the EXEC mode.
show cgn tunnel v6rd 6rd-instance statistics
tunnel |
Indicates the tunnel type. |
v6rd |
Specifies the 6rd information. |
6rd-instance |
Instance name. |
statistics |
Specifies the statistics details for 6rd. |
None
EXEC
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read |
This sample output shows the summary of the statistics entries:
RP/0/RP0/CPU0:router#show cgn tunnel v6rd 6rd1 statistics
Tunnel 6rd configuration
=========================
Tunnel 6rd name: 6rd1
IPv6 Prefix/Length: 2001:db8::/32
Source address: 9.1.1.1
BR Unicast address: 2001:db8:901:101::1
IPv4 Prefix length: 0
IPv4 Suffix length: 0
TOS: 0, TTL: 255, Path MTU: 1280
Tunnel 6rd statistics
======================
IPv4 to IPv6
=============
Incoming packet count : 2296951183
Incoming tunneled packets count : 2296951183
Decapsulated packets : 0
ICMP translation count : 0
Insufficient IPv4 payload drop count : 0
Security check failure drops : 0
No DB entry drop count : 0
Unsupported protocol drop count : 0
Invalid IPv6 source prefix drop count : 2296951183
IPv6 to IPv4
=============
Incoming packet count : 0
Encapsulated packets count : 0
No DB drop count : 0
Unsupported protocol drop count : 0
IPv4 ICMP
==========
Incoming packets count : 0
Reply packets count : 0
Throttled packet count : 0
Nontranslatable drops : 0
Unsupported icmp type drop count : 0
IPv6 ICMP
==========
Incoming packets count : 0
Reply packets count : 0
Packet Too Big generated packets count : 0
Packet Too Big not generated packets count : 0
NA generated packets count : 0
TTL expiry generated packets count : 0
Unsupported icmp type drop count : 0
Throttled packet count : 0
IPv4 to IPv6 Fragments
=======================
Incoming fragments count : 0
Reassembled packet count : 0
Reassembled fragments count : 0
ICMP incoming fragments count : 0
Total fragment drop count : 0
Fragments dropped due to timeout : 0
Reassembly throttled drop count : 0
Duplicate fragments drop count : 0
Reassembly disabled drop count : 0
No DB entry fragments drop count : 0
Fragments dropped due to security check failure : 0
Insufficient IPv4 payload fragment drop count : 0
Unsupported protocol fragment drops : 0
Invalid IPv6 prefix fragment drop count : 0
IPv6 to IPv4 Fragments
=======================
Incoming ICMP fragment count : 0
RP/0/RP1/CPU0:#
=================================================================================
The following table describes the fields seen as shown in the above example:
Note | The same field description is applicable to IPv4 and IPv6 packets appropriately. |
Name |
Description |
Incoming packet count |
Total number of incoming packets |
Incoming tunneled packets count |
Total No of 6rd tunnel packets |
Decapsulated packets |
Number of decapsulated packets |
ICMP translation count |
ICMPv4 to ICMPv6 translated count |
Insufficient IPv4 payload drop count |
Number of packets dropped due to missing IPv6 header. |
Security check failure drops |
Number of packets dropped due to security check failure. |
No DB entry drop count |
Number of packets dropped due to incomplete or missing 6rd configuration. |
Unsupported protocol drop count |
Number of packets dropped due to unsupported protocol. |
Invalid IPv6 source prefix drop count |
Number of packets dropped due to invalid IPv6 source prefix. |
Reply packets count |
Total ICMPv4 echo replies by the Border Relay (BR) router. |
Throttled packet count |
Total ICMPv4 packets which are rate-limited by the BR router |
Nontranslatable drops |
Number of packets dropped without translating. |
Unsupported icmp type drop count |
Number of packets dropped due to unsupported ICMP type. |
Packet Too Big generated packets count | Total ICMPv6 Packet Too Big (PTB) messages generated by the BR router. |
Packet Too Big not generated packets count |
Total ICMPv6 packets for which PTB messages were not generated by the BR router. |
NA generated packets count |
Total ICMPv6 Neighbor Advertisement (NA) packets generated by the BR router. |
TTL expiry generated packets count |
Total ICMPv6 TTL expiry messages generated by the BR router. |
Incoming fragments count |
Number of incoming fragments. |
Reassembled packet count |
Number of reassembled packets. |
Reassembled fragments count |
Number of reassembled fragments. |
ICMP incoming fragments count |
Number of ICMP incoming fragments. |
Total fragment drop count |
Number of fragments dropped. |
Fragments dropped due to timeout |
Number of fragments dropped due to timeout. |
Reassembly throttled drop count |
Number of fragments throttled |
Duplicate fragments drop count |
Number of fragments dropped due to duplication (repeated fragment offset). |
Reassembly disabled drop count |
Number of fragments dropped while reassembly is disabled. |
No DB entry fragments drop count |
Number of fragments dropped due to incomplete or missing 6rd configuration. |
Fragments dropped due to security check failure |
Number of fragments dropped due to missing IPv6 header. |
Insufficient IPv4 payload fragment drop count |
Number of fragments dropped due to missing IPv6 header. |
Unsupported protocol fragment drops |
Number of fragments dropped due to unsupported protocol. |
Invalid IPv6 prefix fragment drop count |
Number of fragments dropped due to invalid IPv6 prefix. |
Command | Description |
| Clears all the statistics for a IPv6 Rapid Deployment (6RD) instance |
To display the throughput of CGSE or CGSE-PLUS, use the show cgn utilization throughput command in the EXEC mode.
show cgn instance name utilization throughput [ cpu < 0-63 | all> ] [ threshold < % threshold level> ]
instance name |
Specifies the CGN instance name. |
throughput |
Displays the amount of traffic coming into CGSE or CGSE plus. |
cpu <0-63 | all> |
Displays the output for a particular core if specified (0-63) or for all the cores (all). |
threshold % threshold level |
Specifies the data for only those cores that have exceeded the value specified by the % threshold level. |
None
EXEC
Release |
Modification |
---|---|
Release 5.2.0 |
This command was introduced for the CGSE card. |
Release 5.3.1 |
The support is extended to the CGSE-PLUS card. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID |
Operations |
---|---|
cgn |
read |
This example shows the statistics entries:
RP/0/RP0/CPU0:router# show cgn cgn1 utilization throughput cpu 50
RP/0/RP1/CPU0:Tasman#show cgn cgn1 utilization throughput cpu 50
Wed Nov 13 11:07:14.236 IST
---------------------------------------------------------
CGN instance name: cgn1
---------------------------------------------------------
CPU-core Last 1sec Last 5min Peak value
kbps pps kbps pps kbps pps
50 315487 84482 110222 59466 317358 84983
RP/0/RP0/CPU0:router# show cgn cgn1 utilization throughput cpu all threshold 95
RP/0/RP1/CPU0:Tasman#show cgn cgn1 utilization throughput cpu all threshold 95
Wed Nov 13 11:07:14.236 IST
---------------------------------------------------------
CGN instance name: cgn1
---------------------------------------------------------
CPU-core Last 1sec Last 5min Peak value
kbps pps kbps pps kbps pps
All 1898026 2754578 1156109 1267997 1939104 2765570
1 323628 86662 37467 39984 325282 87101
2 326496 87430 38583 40282 328023 87837
3 326518 87436 38754 40328 328154 87874
4 322071 86245 36192 39642 322560 86376
5 321637 86129 35896 39563 321947 86212
6 324229 86823 37511 39995 325704 87218
7 324823 86982 37584 40015 325398 87136
16 316152 84660 33221 38846 317694 85073
17 317522 85027 33620 38953 317892 85126
18 318519 85294 34582 39211 321171 86004
19 319617 85588 34828 39277 321462 86082
20 315326 84437 34440 39173 317657 85063
21 317369 84986 33711 38978 318448 85275
22 318165 85199 34286 39132 319460 85546
23 319498 85556 34749 39256 320719 85883
32 326556 87446 38969 40386 328875 88067
33 328916 88078 39689 40579 329917 88346
34 326772 87504 38468 40251 327437 87682
35 328819 88052 39784 40604 330525 88509
36 329144 88139 39706 40583 330047 88381
37 328244 87898 38945 40379 328303 87914
38 328307 87915 39324 40481 329267 88172
39 328561 87983 39131 40429 328725 88027
48 312809 83765 32430 38635 314288 84161
49 314632 84253 33120 38819 316297 84699
50 315110 84381 33490 38918 317358 84983
51 316219 84678 34241 39120 319348 85516
52 316477 84747 33504 38922 316477 84747
53 316312 84703 33686 38971 317093 84912
54 317167 84932 34219 39114 318265 85226
55 318280 85230 34520 39194 319203 85477
To assign an ipv4 address as the tunnel source address, use the source-address command in 6RD configuration mode. To remove the source address assigned to the tunnel, use the no form of this command.
source-address address
no source-address address
address |
Indicates the Source IP address. |
None
6RD configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
For a 6RD tunnel, configure the ipv6-prefix, ipv4 source-address and unicast IPv6 address in a single commit operation. Once configured, the source-address cannot be deleted individually. It must be deleted along with all br tunnel configuration parameters.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the 6RD tunnel source-address:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# br RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd-br)# source-address 10.2.2.1
Command | Description |
Assigns a value for the ipv4-prefix length to be used as part of both ends of tunnel. | |
Assigns a value for the ipv4-suffix length to be used as part of both ends of a tunnel. | |
Generates the delegated ipv6 prefix for a IPv6 Rapid Deployment (6RD) application. | |
Assigns an IPv6 address to be used for a IPv6 Rapid Deployment (6RD) Border Relay (BR) unicast configuration. |
Use the tcp mss command to adjust the TCP maximum segment size (MSS) value for a ServiceApp interface. To disable a particular service application interface, use the no form of this command.
tcp mss<28-1500>
no tcp mss
<28-1500> |
Maximum segment size to be used in bytes. |
tcp mss value is disabled by default.
CGN-NAT64
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
If this configuration does not exist, TCP determines the maximum segment size based on the settings specified by the application process, interface maximum transfer unit (MTU), or MTU received from Path MTU Discovery. This is a NAT64 stateless translation command to be applied for each NAT64 stateless CGN instance. This command enables rewriting of the tcp mss value in the translated IPv4 packet (getting translated from IPv6 to IPv4), if the incoming tcp mss value is greater than the value configured by this command.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure TCP MSS value as 1000 for a NAT64 stateless ServiceApp interface:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat64 stateless xlat1 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# interface ServiceApp 2 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# address-family ipv4 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless-afi)# tcp mss 1000
Command | Description |
| Enters the ICMP, TCP, and UDP protocol configuration mode. |
| Enables an instance for the CGN application. |
To configure the timeout for the ICMP session for a CGN instance, use the timeout command in NAT44 protocol configuration mode. To return to the default value of 60 seconds, use the no form of this command.
timeout seconds
no timeout seconds
seconds | Timeout value. Range is from 1 to 65535. |
The default timeout value is 60 seconds.
NAT44 protocol configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
Release 4.3.0 |
Support for GRE data channels was added. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
We recommend that you configure the timeout values for the protocol sessions carefully. For example, the values for the protocol and NAT functions must be configured properly.
This is a NAT44 service type specific command to be applied for each CGN instance. This command configures the initial and active timeout value in seconds for TCP or UDP sessions for a CGN instance. For ICMP and GRE, the user can configure only the timeout value.
Note | The destination port/destination address timeout configuration is not supported for ICMP and GRE. |
Enter up to 1000 timer entries (inclusive of port only, ip only or port/ip combo).
Task ID |
Operations |
---|---|
cgn |
read, write |
This example shows how to configure the timeout value as 908 for the ICMP session:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# protocol icmp RP/0/RP0/CPU0:router(config-cgn-proto)# timeout 908
This example shows how to configure the destination address value as 600 for the tcp session:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf red RP/0/RP0/CPU0:router(config-cgn-invrf)# protocol tcp RP/0/RP0/CPU0:router(config-cgn-invrf-proto)# address 40.1.1.2 timeout 600
This example shows how to configure the destination port value as 600 for the tcp session:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf red RP/0/RP0/CPU0:router(config-cgn-invrf)# protocol tcp RP/0/RP0/CPU0:router(config-cgn-invrf-proto)# port 80 timeout 600
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat44-1 RP/0/RP0/CPU0:router(config-cgn-nat44)# protocol gre RP/0/RP0/CPU0:router(config-cgn-proto)# timeout 908
To configure the frequency at which the netflow-v9 template is refreshed or resent to the netflow-v9 server, use the timeout command in CGN inside-VRF external logging server configuration mode.
To revert back to the default value of 30 minutes, use the no form of this command.
timeout value
no timeout value
value |
Value, in minutes, for the timeout. Range is from 1 to 3600. |
value : 30
CGN inside VRF external logging server configuration
Release |
Modification |
---|---|
Release 3.9.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
After a certain amount of minutes has elapsed since the template was last sent, the timeout value is resent to the logging server.
The netflowv9 based logging requires that a logging template be sent to the server periodically. The timeout value implies that after that number of minutes has elapsed since the template was last sent, the template will be resent to the logging server. The refresh-rate value implies that after sending that number of packets to the server, the template will be resent. The timeout and refresh-rate values are mutually exclusive; that is, the one that expires first is the one considered for resending the template.
Note | Only when the ipv4 address and port number for the logging server has been configured, the configurations for path-mtu, refresh-rate and timeout are applied. |
Task ID |
Operations |
---|---|
cgn |
read, write |
This example shows how to configure the timeout value as 50 for the NetFlow logging information for the NAT table entries:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat44 nat1 RP/0/RP0/CPU0:router(config-cgn-nat44)# inside-vrf insidevrf1 RP/0/RP0/CPU0:router(config-cgn-invrf)# external-logging netflow version 9 RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog)# server RP/0/RP0/CPU0:router(config-cgn-invrf-af-extlog-server)# timeout 50
Command | Description |
| Enables external logging of a NAT44 instance. |
| Enters inside VRF configuration mode for a NAT44 instance. |
| Enables the logging server information for the IPv4 address and port for the server that is used for the netflowv9-based external-logging facility. |
| Enables an instance for the CGN application. |
To configure the IPv4 tunnel type of service, use the tos command in 6RD configuration mode. To disable the type of service, use the no form of this command.
tos value
no tos value
value |
Value of the type of service to be set. The range is from 0 to 255. |
None
6RD configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the 6RD tunnel type of service:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# tos 25
To configure a range of ipv4 addresses that are to be used for mapping when a non-translatable ipv6 address is received, use the traceroute command. To remove the pool of IPv4 addresses used for mapping the non-translatable IPv6 source addresses, use the no form of this command.
traceroute translation address-pool <A.B.C.D/prefix IP subnet mask>algorithm | hash | random | ttl
no traceroute translation
translation |
Specifies the configuration related to translating traceroute addresses. |
address-pool |
Specifies the IPv4 address pool for traceroute addresses. |
A.B.C.D/ prefix IP subnet |
Indicates the start address and prefix for the address pool. |
algorithm |
Indicates the algorithm to translate IPv6 address to IPv4 address. |
hash |
Indicates the hashing algorithm. |
random |
Randomly generated algorithm. |
ttl |
Specifies time to live algorithm. |
None
CGN-NAT64
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
These IPv4 addresses are not allowed to be configured through this command:
The value for prefix can range from 1 to 32. There is only one such map per instance of stateless ipv4 to ipv6 service-type. When there is no pool of IPv4 addresses to translate the non-translatable IPv6 source address, packets coming with non-translatable IPv6 source addresses are dropped.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the address-pool:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat64 stateless xlat1 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# traceroute translation address-pool 121.1.2.0/24
This example shows how to configure the random algorithm:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat64 stateless xlat1 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# traceroute translation algorithm Random
This example shows how to configure the hash algorithm:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat64 stateless xlat1 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# traceroute translation algorithm Hash
This example shows how to configure the TTL algorithm:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat64 stateless xlat1 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# traceroute translation algorithm TTL
Command | Description |
| Enters the IPv4 address family configuration mode. |
| Enters the IPv6 address family configuration mode. |
| Generates the delegated ipv6 prefix for a IPv6 Rapid Deployment (6RD) application. |
| Enables an instance for the CGN application. |
| Creates a nat64 stateless application |
| Reserves the bits 64 to 71 for the IPv6 addresses. |
Use the traffic-class command to configure the traffic class value to be used when translating a packet from IPv4 to IPv6. To copy the traffic-class value from ipv4 packet, use the no form of this command.
traffic-class value
no traffic-class value
value |
The value of traffic class to be set. It ranges from 0 to 255. |
None
CGN-NAT64
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the CGN-NAT64 traffic class value:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type nat64 stateless xlat1 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# ipv6-prefix 2010:db8:ff00::/40 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# address-family ipv6 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless-afi)# interface ServiceApp 461 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless-afi)# traffic-class 20
Command | Description |
| Enters the IPv6 address family configuration mode. |
| Sets the do not fragment bit |
| Enables an instance for the CGN application. |
| Creates a nat64 stateless application |
To configure the ipv4 tunnel time to live (ttl) , use the ttl command. To undo the configuration, use the no form of this command.
ttl value
no ttl value
value |
Time-to-live value to be used for IPv4 tunnel. The range is from 1 to 255. |
None
6RD configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the 6RD tunnel time to live value:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router#(config)# service cgn cgn1 RP/0/RP0/CPU0:router#(config-cgn)service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# ttl 25
Command | Description |
| Binds an ipv4 or ipv6 ServiceApp interface to a 6rd instance. |
| Enables the Border Relay(BR) configuration. |
| Configures the ipv4 tunnel MTU (Maximum Transmission Unit) size for an IPv6 Rapid Deployment (6RD) instance. |
| Reassembles the fragmented packets. |
| Enables anycast mode. |
tos (6rd) |
|
To reserve the bits 64 to 71 in the IPv6 addresses, use the ubit-reserved command. To cancel the IPv6 addresses from getting reserved to bits 64 to 71, use the no form of this command. They may be used to store IPv4 address octets as part of translation.
ubit-reserved
no ubit-reserved
This command has no keywords or arguments.
None
CGN-NAT64
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
This is a NAT64 stateless translation command to be applied for each instance of NAT64 stateless of a CGN instance. When this configuration is enabled bits 64 to 71 in the IPv6 addresses are reserved for purposes including U-Bit. These are not used for translation purposes.
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the nat64 stateless ubit-reserved option:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type nat64 stateless xlat1 RP/0/RP0/CPU0:router(config-cgn-nat64-stateless)# ubit-reserved
Command | Description |
| Enters the IPv4 address family configuration mode. |
| Enters the IPv6 address family configuration mode. |
| Generates the delegated ipv6 prefix for a IPv6 Rapid Deployment (6RD) application. |
| Enables an instance for the CGN application. |
| Creates a nat64 stateless application |
| Configures a range of ipv4 addresses that are to be used for mapping when a non-translatable ipv6 address is received. |
To assign an IPv6 address to be used for a IPv6 Rapid Deployment (6RD) Border Relay (BR) unicast configuration, use the unicast address command in 6RD configuration mode. To remove the assigned unicast address, use the no form of this command.
unicast address address
no unicast address address
address |
IPv6 address used for unicast from IPv6 network. |
None
6RD configuration
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
For a 6RD tunnel, configure the br with ipv6-prefix, ipv4 source-address and unicast IPv6 address in a single commit operation. Once configured, the unicast address cannot be deleted individually. It must be deleted along with all br (Border Relay) tunnel configuration parameters.
The ipv6 unicast address is derived from these: ipv6 prefix, ipv6 prefix length, ipv4 prefix length and ipv4 suffix length, and tunnel source address.
Here's the formula to calculate the IPv6 unicast address:
ipv6 unicast address = <ipv6-prefix> + (remove ipv4 prefix length bits from starting and ipv4 suffix length bits from ending of tunnel source address) :: <number>
Task ID | Operation |
---|---|
cgn |
read, write |
This example shows how to configure the 6RD tunnel unicast address:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# service cgn cgn1 RP/0/RP0/CPU0:router(config-cgn)# service-type tunnel v6rd 6rd1 RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd)# br RP/0/RP0/CPU0:router(config-cgn-tunnel-6rd-br)# unicast address 2001:db8:a02:102::1
Command | Description |
Assigns a value for the ipv4-prefix length to be used as part of both ends of tunnel. | |
Assigns a value for the ipv4-suffix length to be used as part of both ends of a tunnel. | |
Generates the delegated ipv6 prefix for a IPv6 Rapid Deployment (6RD) application. | |
Assigns an ipv4 address as the tunnel source address. |
To configure and activate a virtual service, use the virtual-service command. To disable the virtual service, use the no virtual-service command.
You can run this command in both global configuration mode as well as EXEC mode.
virtual-service in Global Configuration Modevirtual-service <virtual service name> enable
no virtual-service <virtual service name> enable
<virtual service name> |
Specifies the name of the virtual service. |
enable |
Enables the virtual service. |
virtual-service { connect name virtual-service-name [ aux console node node-name ] | install name virtual-service-name | uninstall name virtual-service-name }
connect name |
Connects to the virtual service. The keyword name specifies the name of the appliance. |
aux |
Connects to the aux port. |
console node |
Connects to the console port of the particular card specified by the keyword node. |
install name |
Installs the virtual service. The keyword name specifies the name of the appliance. |
uninstall name |
Uninstalls the virtual service. The keyword name specifies the name of the appliance. |
<virtual service name> |
Specifies the name of the virtual service. The virtual service name can contain only alphanumeric characters (A to Z, a to z, or 0 to 9) or an underscore (_). All other special characters are not allowed. |
<node name> |
Specifies the name of the card. |
None
Global Configuration mode and EXEC mode
Release | Modification |
---|---|
Release 5.1.1 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Note | Use Ctrl ^ e to disconnect from the VM. |
Task ID | Operation |
---|---|
eem |
read, write |
RP/0/RSP0/CPU0:router(config)#virtual-service enable RP/0/RSP0/CPU0:router(config)#commit
The following is an example of the virtual-service connect command:
RP/0/RSP0/CPU0:router #virtual-service connect name cgn1 console node 0/0/CPU0 RP/0/RSP0/CPU0:router #commit
The following is an example of the virtual-service install command:
RP/0/RSP0/CPU0:router #virtual-service install name cgn1 package disk0:/asr9k-vsm-cgv6-5.2.2.02.ova node 0/7/CPU0 RP/0/RSP0/CPU0:router #commit
Use the vrf command to configure a VPN routing and forwarding (VRF) instance. To disable the VRF, use the no form of this command.
vrf vrf-name
no vrf vrf-name
vrf-name |
The CGN application uses inside vrfs and outside vrfs exclusively. These names cannot be used: all, default, and global. |
None
CONFIG-IF
Release | Modification |
---|---|
Release 4.1.0 |
This command was introduced. |
To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
Note | The number of supported VRFs is platform specific. For the CGN application, use only these vrf-names: insidevrf1 and outsidevrf1. The CGN application uses inside vrfs and outside vrfs exclusively, and the user needs to name and use them accordingly. |
Task ID | Operation |
---|---|
ip services |
read, write |
This example shows how to create an inside and outside VRF using the vrf command:
RP/0/RP0/CPU0:router# configure RP/0/RP0/CPU0:router(config)# vrf insidevrf1 RP/0/RP0/CPU0:router(config-vrf)# vrf outsidevrf1 RP/0/RP0/CPU0:router(config-vrf)# exit
Command | Description |
| Enables a CGN service role on a specified location. |
| Enables the application SVI interface. |
| Enables the infrastructure SVI interface. |
| Enables an instance for the CGN application. |