<html><head><title>Re: [rbak-nsp] NAT Logging</title>
<META http-equiv=Content-Type content="text/html; charset=utf-8">
</head>
<body>
<span style=" font-family:'Courier New'; font-size: 9pt;">Hello<br>
Still doesn't work. <br>
<br>
My config:<br>
nat logging-profile LogowanieNAT<br>
transport-protocol udp<br>
export-version v9<br>
dscp ef<br>
maximum ip-packet-size 1400<br>
source 10.0.0.33 port 5000<br>
destination 10.0.0.1 context mrouter port 5000<br>
<br>
!<br>
<br>
ip nat pool ip_test_lan1_nat napt paired-mode logging<br>
paired-mode subscriber over-subscription 32 port-limit 2000<br>
logging-profile LogowanieNat<br>
address 178.214.29.1/32 port-block 1 to 15<br>
address 178.214.29.2/32 port-block 1 to 15<br>
!<br>
<br>
ip nat pool ip_test_pppoe1_nat napt multibind<br>
address 178.214.30.1/32 port-block 1 to 15<br>
address 178.214.30.2/32 port-block 1 to 15<br>
<br>
!<br>
nat policy ip_test_lan1_nat_policy enhanced<br>
! Default class<br>
pool ip_test_lan1_nat routerek<br>
timeout tcp 18000<br>
timeout abandoned 3600<br>
endpoint-independent filtering tcp<br>
endpoint-independent filtering udp<br>
inbound-refresh udp<br>
icmp-notification<br>
<br>
!<br>
nat policy ip_test_pppoe1_nat_policy<br>
! Default class<br>
pool ip_test_pppoe1_nat routerek<br>
timeout tcp 18000<br>
endpoint-independent filtering udp<br>
inbound-refresh udp<br>
icmp-notification<br>
<br>
<br>
interface loop1 loopback<br>
ip address 10.0.0.33/27<br>
ip source-address radius flow-ip<br>
no logging console<br>
<br>
<br>
<br>
<br>
<br>
<br>
I want log ip_test_lan1_nat which is now paired-mode, this context have both paired-mode and multibind nat pool.<br>
There is nothing received on collector 10.0.0.1 (no single packet received). Collector using same interface as radius.<br>
Is there something more which I have to check ?<br>
I have also question about collector ip address. I suppiled destination 10.0.0.1 context mrouter port 5000<br>
because 10.0.0.1 is reachable over context mrouter. Is there any debug command which shows if there flow is active ?<br>
<br>
<br>
<br>
<br>
<br>
[routerek]se600#show nat pool<br>
Pool-Grid Context-Id Type Rcrds Slot-Mask Pool-Name<br>
0x00000003 0x40080003 napt/M 2 0x00000000 ip_test_pppoe1_nat<br>
0x00000007 0x40080003 napt/PL 2 0x00000004 ip_test_lan1_nat<br>
<br>
[routerek]se600#show nat logging-profile<br>
Profile-Grid Context-Id Valid Profile-Name<br>
0x00000001 0x40080003 yes LogowanieNAT<br>
<br>
<br>
<br>
Wednesday, October 30, 2013, 8:43:15 PM, you wrote:<br>
<br>
</span><table>
<tr>
<td width=13 bgcolor= #0000ff><br>
</td>
<td width=827><span style=" font-family:'courier new'; font-size: 9pt;">And I'm assuming you have the license for CGNAT, right?<br>
<br>
<br>
On Wed, Oct 30, 2013 at 4:40 PM, Tomas Lynch <<a href="mailto:tomas.lynch@gmail.com">tomas.lynch@gmail.com</a>> wrote:<br>
Rafal,<br>
<br>
Problem is with keywords at the ip nat pool, you are using multibind and must use paired-mode. Here is a complete config that was tested on a SE1200 SEOS 11.x:<br>
<br>
context local<br>
!<br>
nat logging-profile LOGGING_PROF<br>
transport-protocol udp<br>
export-version v9<br>
source 10.10.10.10 port 2055<br>
destination 1.1.1.1 context local port 2055<br>
dscp ef<br>
!<br>
! the following can be at any context including local<br>
!<br>
ip nat pool NAT_POOL napt paired-mode logging<br>
paired-mode subscriber over-subscription 100 port-limit 1000<br>
logging-profile LOGGING_PROF context local<br>
address <a href="http://192.168.208.0/28">192.168.208.0/28</a><br>
!<br>
nat policy NAT_POLICY enhanced<br>
! Default class<br>
pool NAT_POOL cgnat<br>
timeout abandoned 3600<br>
endpoint-independent filtering tcp<br>
endpoint-independent filtering udp<br>
inbound-refresh udp<br>
icmp-notification<br>
<br>
<br>
<br>
<br>
On Wed, Oct 30, 2013 at 10:58 AM, Golem <<a href="mailto:golem@mtm-info.pl">golem@mtm-info.pl</a>> wrote:<br>
Hello<br>
<br>
Im trying to setup NAT logging, this is how my config looks:<br>
<br>
context routerek<br>
<br>
<br>
nat logging-profile LogowanieNAT<br>
transport-protocol udp<br>
export-version v9<br>
source 11.0.0.33 port 5000<br>
destination 11.0.0.1 port 5000<br>
<br>
<br>
ip nat pool ip_test_lan1_nat napt multibind logging<br>
logging-profile LogowanieNat<br>
address <a href="http://178.214.29.1/32">178.214.29.1/32</a> port-block 1 to 15<br>
address <a href="http://178.214.29.2/32">178.214.29.2/32</a> port-block 1 to 15<br>
<br>
<br>
nat policy ip_test_lan1_nat_policy enhanced<br>
! Default class<br>
pool ip_test_lan1_nat routerek<br>
timeout tcp 18000<br>
inbound-refresh udp<br>
icmp-notification<br>
!<br>
interface loop1 loopback<br>
ip address <a href="http://11.0.0.33/27">11.0.0.33/27</a><br>
ip source-address radius flow-ip<br>
no logging console<br>
!<br>
!<br>
....<br>
(config truncated)<br>
<br>
<br>
<br>
NAT does work , there is internet access etc, but collector 11.0.0.1 (linux)<br>
not receiving any packets on port 5000, tcpdump doesn't show anything.<br>
How to debug Nat logging ? debug nat all - doesn't show anything useful about logging.<br>
Do I need setup some additional config like flow collector/flow profile for nat logging<br>
to make it working ?<br>
<br>
Rafal<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
redback-nsp mailing list<br>
<a href="mailto:redback-nsp@puck.nether.net">redback-nsp@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/redback-nsp">https://puck.nether.net/mailman/listinfo/redback-nsp</a></td>
</tr>
</table>
<br><br>
<br>
<br>
<span style=" font-family:'arial'; color: #c0c0c0;"><i>-- <br>
Best regards,<br>
Ozga Rafal <a style=" font-style: normal;" href="mailto:golem@mtm-info.pl">mailto:golem@mtm-info.pl</a></body>