topic Re: Show ip nat statistics in Network Security

Show ip nat statistics

Adel3 — Sun, 09 Jan 2022 14:44:43 GMT

Hi everybody

I've nat configurations on my router and everything goes well .

But in "show ip nat statistics" output , it shows some drops ( In-to-out drops: 3124 Out-to-in drops: 1136 )

I dont know the reason and the meaning and I couldnt also find anything in documetns.

I'd appreciate in case anyone advise me .

This is the partial output :

Hits: 1118337 Misses: 6627
Expired translations: 7698
Dynamic mappings:
-- Inside Source
[Id: 1] access-list NAT pool cgnat refcount 362784
pool cgnat: id 2, netmask 255.255.240.0
start 11.23.240.0 end 11.23.255.255
type rotary, total addresses 4096, allocated 0 (0%), misses 0
nat-limit statistics:
max entry: max allowed 0, used 0, missed 0
In-to-out drops: 3124 Out-to-in drops: 1126
Pool stats drop: 0 Mapping stats drop: 0
Port block alloc fail: 0
IP alias add fail: 0
Limit entry add fail: 0

Re: Show ip nat statistics

MHM Cisco World — Sun, 09 Jan 2022 15:36:20 GMT

Re: Show ip nat statistics

balaji.bandi — Sun, 09 Jan 2022 18:34:01 GMT

what is the device, and what code running ?

when you clear the NAT Stats, is this increases? what kind of traffic is this device translating?

if possible post the configuration.

Re: Show ip nat statistics

MHM Cisco World — Mon, 10 Jan 2022 08:56:10 GMT

can you share the config of NAT.

Re: Show ip nat statistics

Adel3 — Mon, 10 Jan 2022 12:17:21 GMT

Device is ASR1002-X

IOS ver. XE 15.4(3)S3

When I clear NAT statistics counter, everything cleard except these counters (In-to-out drops and Out-to-in drops).

And this device NAT IP traffic (fully IP)

This is the configuration :

ip nat pool cgnat 11.23.240.0 11.23.255.255 prefix-length 20 type rotary
ip nat inside source list NAT pool cgnat

Standard IP access list NAT
20 permit 100.66.128.0, wildcard bits 0.0.63.255

Re: Show ip nat statistics

Adel3 — Mon, 10 Jan 2022 12:17:57 GMT

Sure

ip nat pool cgnat 11.23.240.0 11.23.255.255 prefix-length 20 type rotary
ip nat inside source list NAT pool cgnat

Standard IP access list NAT
20 permit 100.66.128.0, wildcard bits 0.0.63.255