<html><head><title>Re: [rbak-nsp] Some problems with NAT enhanced in SE600</title>
</head>
<body>
<span style=" font-family:'Courier New'; font-size: 9pt;">Hello Соловьёв,<br>
<br>
That's how enhanced NAT works.<br>
Because enhanced nat force connection to use router supplied port ranges, some software will not work.<br>
I preffer to stick with normal nat.<br>
If you need logging, then use single address for each nat subnet, and then add flow profile in <br>
subscriber default section, like <br>
flow apply ip profile logprofile both<br>
<br>
and:<br>
!<br>
flow collector SubsLog<br>
ip-address ipaddress context colectorcontext<br>
port mycollectorport<br>
export-version v5<br>
transport-protocol udp<br>
ip profile logprofile<br>
!<br>
<br>
ip nat pool ip_lan1_nat napt multibind<br>
address publicip/32 port-block 1 to 15<br>
<br>
!<br>
nat policy ip_lan1_nat_policy<br>
! Default class<br>
ignore<br>
endpoint-independent filtering udp<br>
inbound-refresh udp<br>
icmp-notification<br>
! Named classes<br>
access-group NATACL<br>
class NAT<br>
pool ip_lan1_nat mycontext<br>
timeout tcp 6000<br>
endpoint-independent filtering udp<br>
inbound-refresh udp<br>
icmp-notification<br>
class NATLESS<br>
ignore<br>
inbound-refresh udp<br>
icmp-notification<br>
!<br>
<br>
<br>
Put in NATLESS your DNS servers and local network devices you need.<br>
Using enhanced NAT you can NAT like 2000 users per single card and then you <br>
run out of microblocks on card because every subscriber have reserved port ranges and<br>
amount of possible open connection even if he only activate and do nothing.<br>
<br>
Rafal<br>
<br>
<br>
<br>
<br>
<br>
Monday, November 7, 2016, 9:12:39 AM, you wrote:<br>
<br>
</span><table>
<tr>
<td width=2 bgcolor= #0000ff><br>
</td>
<td><span style=" font-family:'Courier New'; font-size: 9pt;">Here is my NAT config <br>
local]Redback#sh configuration nat<br>
Building configuration...<br>
Current configuration:<br>
!<br>
context local<br>
!<br>
nat logging-profile NAT_LOG_RUBTSOVSK<br>
export-version v9<br>
destination 192.168.0.40 port 9996<br>
!<br>
context local<br>
!<br>
ip nat pool NAPT-pool-1 napt paired-mode<br>
paired-mode subscriber over-subscription 10 port-limit 6000<br>
address 41.215.233.161 to 41.215.233.190<br>
exclude well-known<br>
!<br>
context local<br>
!<br>
policy access-list NAT-acl<br>
seq 10 permit ip 192.168.128.0 0.0.127.255 any class NATclass1<br>
seq 20 permit ip any any class NO_NAT<br>
!<br>
<b>nat policy NAT-1 enhanced<br>
</b>connections tcp maximum 2000<br>
connections udp maximum 2000<br>
connections icmp maximum 30<br>
! Default class<br>
ignore<br>
timeout tcp 1800<br>
timeout udp 60<br>
timeout fin-reset 60<br>
timeout icmp 30<br>
timeout syn 60<br>
timeout basic 300<br>
timeout abandoned 1800<br>
admission-control tcp<br>
admission-control udp<br>
admission-control icmp<br>
<b>endpoint-independent filtering tcp<br>
endpoint-independent filtering udp<br>
</b>inbound-refresh udp<br>
icmp-notification<br>
! Named classes<br>
access-group NAT-acl<br>
class NATclass1<br>
pool NAPT-pool-1 local<br>
timeout tcp 18000<br>
timeout udp 60<br>
timeout fin-reset 60<br>
timeout icmp 30<br>
timeout syn 60<br>
timeout abandoned 1800<br>
<b>endpoint-independent filtering tcp<br>
endpoint-independent filtering udp<br>
</b>inbound-refresh udp<br>
icmp-notification<br>
class NO_NAT<br>
ignore<br>
inbound-refresh udp<br>
icmp-notification<br>
!<br>
end<br>
With such config we have problem with Skype - no connection - even test connection!<br>
problem with online games such as steam, Dota and etc...<br>
With public IP (no NAT) everything is ok - Skype. games and so on....<br>
What I have forgotten?<br>
------------------------------------------------<br>
С уважением Соловьёв Роман<br>
Технический директор<br>
ООО "СерДи ТелеКом"<br>
тел. +7 87951 35529<br>
+7 9624 335529<br>
Сайт компании<br>
www.serdi.ru</td>
</tr>
</table>
<br><br>
<br>
<br>
<span style=" font-family:'arial'; color: #c0c0c0;"><i>-- <br>
Best regards,<br>
Ozga Rafal </i></span><a style=" font-family:'arial';" href="mailto:golem@mtm-info.pl">mailto:golem@mtm-info.pl</a></body></html>