I've been working on setting up a CG-NAT on our MX480 which has 2 MS-DPC cards. I've read the Day-One book and scoured a lot of forums, so I think I have it setup ok. I must be missing something though, because about 2-3 hours after turning it on, we start to have issues where certain customers stop passing any traffic at all. I've checked our nat pool and there aren't any errors. We're NAT'ing about 1700 customers behind about 110 IPs using NAPT, giving them PBA's of 1024 with a 16 block limit. Our flows never go above ~190k.
Here's our setup:
services {
service-set napt44-svc {
syslog {
host local {
services any;
log-prefix napt44-svc;
class {
stateful-firewall-logs;
alg-logs;
nat-logs;
}
}
}
nat-rules napt44-rule;
interface-service {
service-interface rsp1;
}
}
}
nat {
pool napt44-pool {
address 1.2.2.0/26; # < dummy public IP
address 1.2.3.128/27; # < dummy public IP
address 1.2.3.48/28; # < dummy public IP
port {
automatic {
random-allocation;
}
secured-port-block-allocation block-size 1024 max-blocks-per-address 16;
}
address-allocation round-robin;
mapping-timeout 120;
}
rule napt44-rule {
match-direction output;
term nat-term1 {
from {
source-prefix-list {
napt44-private;
}
}
then {
translated {
source-pool napt44-pool;
translation-type {
napt-44;
}
address-pooling paired;
}
syslog;
}
}
}
}
ae1 {
unit 0 {
family inet {
filter {
input-list [ block-ip-ingress block-port-ingress static-src-filter default-accept ];
output-list [ block-ip-egress block-port-egress default-accept ];
}
service {
input {
service-set napt44-svc service-filter napt44-ingress-filter;
}
output {
service-set napt44-svc service-filter napt44-egress-filter;
}
}
# address omitted
}
}
}
When a customer stops passing traffic from their private IP, I do the usual and check for any AP-P port allocation errors, etc, but it shows zero. I checked the stateful-firewall flows for the customer and see a lot of DNS requests, but nothing much else. My ports in use tops out at about 95,257, and unique pool users around 1710.
I just can't figure out why after a few hours, a ton of random customers simply stop working, even though they have flow data. If it was port exhaustion, it would show up in "show services nat pool detail" as an error.
How can I troubleshoot why certain IPs simply stop working? Right now our old mikrotik is doing NAT just fine, but I reeeaally want to get away from Mikrotik on our edge.
#CGNAT#ms-dpc#cg-nat