<div dir="ltr">Hi,<div><br></div><div style>How is your collector connected to the SE: over management or over line card port? The CGNAT logging flows will be only transferred over line card ports, in other words you cannot use management interface for CGNAT logging.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Oct 31, 2013 at 3:48 AM, Golem <span dir="ltr"><<a href="mailto:golem@mtm-info.pl" target="_blank">golem@mtm-info.pl</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<span style="font-family:'Courier New';font-size:9pt">Hello<br>
Still doesn't work. <br>
<br>
My config:<div class="im"><br>
nat logging-profile LogowanieNAT<br>
transport-protocol udp<br>
export-version v9<br></div>
dscp ef<br>
maximum ip-packet-size 1400<br>
source 10.0.0.33 port 5000<br>
destination 10.0.0.1 context mrouter port 5000<br>
<br>
!<br>
<br>
ip nat pool ip_test_lan1_nat napt paired-mode logging<br>
paired-mode subscriber over-subscription 32 port-limit 2000<div class="im"><br>
logging-profile LogowanieNat<br>
address <a href="http://178.214.29.1/32" target="_blank">178.214.29.1/32</a> port-block 1 to 15<br>
address <a href="http://178.214.29.2/32" target="_blank">178.214.29.2/32</a> port-block 1 to 15<br></div>
!<br>
<br>
ip nat pool ip_test_pppoe1_nat napt multibind<br>
address <a href="http://178.214.30.1/32" target="_blank">178.214.30.1/32</a> port-block 1 to 15<br>
address <a href="http://178.214.30.2/32" target="_blank">178.214.30.2/32</a> port-block 1 to 15<div class="im"><br>
<br>
!<br>
nat policy ip_test_lan1_nat_policy enhanced<br>
! Default class<br>
pool ip_test_lan1_nat routerek<br>
timeout tcp 18000<br></div><div class="im">
timeout abandoned 3600<br>
endpoint-independent filtering tcp<br>
endpoint-independent filtering udp<br>
inbound-refresh udp<br>
icmp-notification<br>
<br></div>
!<br>
nat policy ip_test_pppoe1_nat_policy<br>
! Default class<br>
pool ip_test_pppoe1_nat routerek<br>
timeout tcp 18000<div class="im"><br>
endpoint-independent filtering udp<br>
inbound-refresh udp<br>
icmp-notification<br>
<br>
<br></div>
interface loop1 loopback<br>
ip address <a href="http://10.0.0.33/27" target="_blank">10.0.0.33/27</a><div class="im"><br>
ip source-address radius flow-ip<br>
no logging console<br>
<br>
<br>
<br>
<br>
<br>
<br></div>
I want log ip_test_lan1_nat which is now paired-mode, this context have both paired-mode and multibind nat pool.<br>
There is nothing received on collector 10.0.0.1 (no single packet received). Collector using same interface as radius.<br>
Is there something more which I have to check ?<br>
I have also question about collector ip address. I suppiled destination 10.0.0.1 context mrouter port 5000<br>
because 10.0.0.1 is reachable over context mrouter. Is there any debug command which shows if there flow is active ?<br>
<br>
<br>
<br>
<br>
<br>
[routerek]se600#show nat pool<br>
Pool-Grid Context-Id Type Rcrds Slot-Mask Pool-Name<br>
0x00000003 0x40080003 napt/M 2 0x00000000 ip_test_pppoe1_nat<br>
0x00000007 0x40080003 napt/PL 2 0x00000004 ip_test_lan1_nat<br>
<br>
[routerek]se600#show nat logging-profile<br>
Profile-Grid Context-Id Valid Profile-Name<br>
0x00000001 0x40080003 yes LogowanieNAT<div class="im"><br>
<br>
<br>
<br>
Wednesday, October 30, 2013, 8:43:15 PM, you wrote:<br>
<br>
</div></span><div><div class="h5"><table>
<tbody><tr>
<td width="13" bgcolor="#0000ff"><br>
</td>
<td width="827"><span style="font-family:'courier new';font-size:9pt">And I'm assuming you have the license for CGNAT, right?<br>
<br>
<br>
On Wed, Oct 30, 2013 at 4:40 PM, Tomas Lynch <<a href="mailto:tomas.lynch@gmail.com" target="_blank">tomas.lynch@gmail.com</a>> wrote:<br>
Rafal,<br>
<br>
Problem is with keywords at the ip nat pool, you are using multibind and must use paired-mode. Here is a complete config that was tested on a SE1200 SEOS 11.x:<br>
<br>
context local<br>
!<br>
nat logging-profile LOGGING_PROF<br>
transport-protocol udp<br>
export-version v9<br>
source 10.10.10.10 port 2055<br>
destination 1.1.1.1 context local port 2055<br>
dscp ef<br>
!<br>
! the following can be at any context including local<br>
!<br>
ip nat pool NAT_POOL napt paired-mode logging<br>
paired-mode subscriber over-subscription 100 port-limit 1000<br>
logging-profile LOGGING_PROF context local<br>
address <a href="http://192.168.208.0/28" target="_blank">192.168.208.0/28</a><br>
!<br>
nat policy NAT_POLICY enhanced<br>
! Default class<br>
pool NAT_POOL cgnat<br>
timeout abandoned 3600<br>
endpoint-independent filtering tcp<br>
endpoint-independent filtering udp<br>
inbound-refresh udp<br>
icmp-notification<br>
<br>
<br>
<br>
<br>
On Wed, Oct 30, 2013 at 10:58 AM, Golem <<a href="mailto:golem@mtm-info.pl" target="_blank">golem@mtm-info.pl</a>> wrote:<br>
Hello<br>
<br>
Im trying to setup NAT logging, this is how my config looks:<br>
<br>
context routerek<br>
<br>
<br>
nat logging-profile LogowanieNAT<br>
transport-protocol udp<br>
export-version v9<br>
source 11.0.0.33 port 5000<br>
destination 11.0.0.1 port 5000<br>
<br>
<br>
ip nat pool ip_test_lan1_nat napt multibind logging<br>
logging-profile LogowanieNat<br>
address <a href="http://178.214.29.1/32" target="_blank">178.214.29.1/32</a> port-block 1 to 15<br>
address <a href="http://178.214.29.2/32" target="_blank">178.214.29.2/32</a> port-block 1 to 15<br>
<br>
<br>
nat policy ip_test_lan1_nat_policy enhanced<br>
! Default class<br>
pool ip_test_lan1_nat routerek<br>
timeout tcp 18000<br>
inbound-refresh udp<br>
icmp-notification<br>
!<br>
interface loop1 loopback<br>
ip address <a href="http://11.0.0.33/27" target="_blank">11.0.0.33/27</a><br>
ip source-address radius flow-ip<br>
no logging console<br>
!<br>
!<br>
....<br>
(config truncated)<br>
<br>
<br>
<br>
NAT does work , there is internet access etc, but collector 11.0.0.1 (linux)<br>
not receiving any packets on port 5000, tcpdump doesn't show anything.<br>
How to debug Nat logging ? debug nat all - doesn't show anything useful about logging.<br>
Do I need setup some additional config like flow collector/flow profile for nat logging<br>
to make it working ?<br>
<br>
Rafal<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
redback-nsp mailing list<br>
<a href="mailto:redback-nsp@puck.nether.net" target="_blank">redback-nsp@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/redback-nsp" target="_blank">https://puck.nether.net/mailman/listinfo/redback-nsp</a></span></td>
</tr>
</tbody></table>
<br><br>
<br>
<br>
</div></div><div class="im"><span style="font-family:'arial';color:#c0c0c0"><i>-- <br>
Best regards,<br>
Ozga Rafal <a style="font-style:normal" href="mailto:golem@mtm-info.pl" target="_blank">mailto:golem@mtm-info.pl</a></i></span></div></div>
<br>_______________________________________________<br>
redback-nsp mailing list<br>
<a href="mailto:redback-nsp@puck.nether.net">redback-nsp@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/redback-nsp" target="_blank">https://puck.nether.net/mailman/listinfo/redback-nsp</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>Best regards,<br>Yuri
</div>