topic Re: NAT/PAT pool exhausted in Network Security

NAT/PAT pool exhausted

swaro2000 — Mon, 11 Mar 2019 19:56:30 GMT

ASA5505 running 8.4.1 I keep seeing the below logs..

Feb 24 2011 14:32:09: %ASA-3-202010: NAT/PAT pool exhausted. Unable to create connection.
Feb 24 2011 14:32:10: %ASA-3-202010: NAT/PAT pool exhausted. Unable to create connection.
Feb 24 2011 14:32:11: %ASA-3-202010: NAT/PAT pool exhausted. Unable to create connection.
Feb 24 2011 14:32:12: %ASA-3-202010: NAT/PAT pool exhausted. Unable to create connection.
Feb 24 2011 14:32:22: %ASA-3-202010: NAT/PAT pool exhausted. Unable to create connection.

Do I have NAT misconfigured? if not which traffic is using up the NAT pool?

Currently there are only 2 hosts up & running behind the ASA, I have also collected the below logs

!
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network CME
host 10.10.1.4
object network Hack-PC
subnet 10.4.4.0 255.255.255.0
object network LAN
subnet 192.168.100.0 255.255.255.0
object network Media
subnet 10.6.6.0 255.255.255.0
object network Safe-PC
subnet 10.3.3.0 255.255.255.0
object network NTOP
host 172.16.100.5
!
object network CME
nat (inside,outside) dynamic interface
object network Hack-PC
nat (inside,outside) dynamic interface
object network LAN
nat (inside,outside) dynamic interface
object network Media
nat (inside,outside) dynamic interface
object network Safe-PC
nat (inside,outside) dynamic interface
object network NTOP
nat (inside,outside) dynamic interface
object network VPN-Users
nat (outside,outside) dynamic interface
!

NetgearFW# sh xlate
8 in use, 210 most used
Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
UDP PAT from inside:10.6.6.4/33036 to outside:98.198.202.104/7583 flags ri idle 0:01:13 timeout 0:00:30
UDP PAT from inside:10.10.1.4/123 to outside:98.198.202.104/128 flags ri idle 0:00:13 timeout 0:00:30
UDP PAT from inside:10.10.1.4/61326 to outside:98.198.202.104/20097 flags ri idle 0:05:05 timeout 0:00:30
UDP PAT from inside:10.10.1.4/5060 to outside:98.198.202.104/41406 flags ri idle 0:00:05 timeout 0:10:00
TCP PAT from outside:10.100.1.2/60687 to outside:98.198.202.104/5913 flags ri idle 0:19:55 timeout 0:00:30
TCP PAT from outside:10.100.1.2/60672 to outside:98.198.202.104/33714 flags ri idle 0:20:22 timeout 0:00:30
TCP PAT from outside:10.100.1.2/60671 to outside:98.198.202.104/24011 flags ri idle 0:20:22 timeout 0:00:30
TCP PAT from outside:10.100.1.2/60668 to outside:98.198.202.104/34600 flags ri idle 0:20:22 timeout 0:00:30
NetgearFW#
NetgearFW# sh nat pool
UDP PAT pool outside, address 98.198.202.104, range 1-511, allocated 9
UDP PAT pool outside, address 98.198.202.104, range 512-1023, allocated 0
UDP PAT pool outside, address 98.198.202.104, range 1024-65535, allocated 7
TCP PAT pool outside, address 98.198.202.104, range 1-511, allocated 2
TCP PAT pool outside, address 98.198.202.104, range 512-1023, allocated 0
TCP PAT pool outside, address 98.198.202.104, range 1024-65535, allocated 4
TCP PAT pool inside, address 172.20.1.1, range 1-511, allocated 2
TCP PAT pool inside, address 172.20.1.1, range 512-1023, allocated 0
TCP PAT pool inside, address 172.20.1.1, range 1024-65535, allocated 0
UDP PAT pool inside, address 172.20.1.1, range 1-511, allocated 3
UDP PAT pool inside, address 172.20.1.1, range 512-1023, allocated 1
UDP PAT pool inside, address 172.20.1.1, range 1024-65535, allocated 7
NetgearFW#
NetgearFW# sh conn
114 in use, 305 most used
UDP outside 216.246.105.146:0 inside 10.10.1.4:5060, idle 0:04:54, bytes 0, flags ti
TCP outside 66.54.158.8:443 outside 10.100.1.2:60687, idle 0:05:32, bytes 6391, flags UIOB
TCP outside 66.54.158.8:443 outside 10.100.1.2:60672, idle 0:04:59, bytes 8603, flags UIOB
TCP outside 66.54.158.8:443 outside 10.100.1.2:60671, idle 0:04:46, bytes 146675, flags UIOB
TCP outside 66.54.158.8:443 outside 10.100.1.2:60668, idle 0:04:52, bytes 15959, flags UIOB
UDP outside 129.6.15.28:123 inside 10.6.6.4:33036, idle 0:00:55, bytes 48, flags -
UDP outside 216.246.105.146:5060 inside 10.10.1.4:61326, idle 0:00:47, bytes 48627, flags T
NetgearFW#

NetgearFW# sh nat detail

Auto NAT Policies (Section 2)
1 (inside) to (outside) source dynamic CME interface
    translate_hits = 77, untranslate_hits = 1129
    Source - Origin: 10.10.1.4/32, Translated: 98.198.202.104/21
2 (inside) to (outside) source dynamic NTOP interface
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: 172.16.100.5/32, Translated: 98.198.202.104/21
3 (outside) to (outside) source dynamic VPN-Users interface
    translate_hits = 2069, untranslate_hits = 405
    Source - Origin: 10.100.1.0/29, Translated: 98.198.202.104/21
4 (inside) to (outside) source dynamic Safe-PC interface
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: 10.3.3.0/24, Translated: 98.198.202.104/21
5 (inside) to (outside) source dynamic Hack-PC interface
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: 10.4.4.0/24, Translated: 98.198.202.104/21
6 (inside) to (outside) source dynamic Media interface
    translate_hits = 15, untranslate_hits = 0
    Source - Origin: 10.6.6.0/24, Translated: 98.198.202.104/21
7 (inside) to (outside) source dynamic LAN interface
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: 192.168.100.0/24, Translated: 98.198.202.104/21
NetgearFW#

Re: NAT/PAT pool exhausted

PAUL GILBERT ARIAS — Thu, 24 Feb 2011 22:40:23 GMT

Can you include the show run timeout?

The config seems fine

Sent from Cisco Technical Support iPhone App

Re: NAT/PAT pool exhausted

swaro2000 — Thu, 24 Feb 2011 23:47:50 GMT

Here you go

NetgearFW# sh run timeout
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
NetgearFW#

Re: NAT/PAT pool exhausted

Federico Coto Fajardo — Fri, 25 Feb 2011 02:18:44 GMT

Here's what Cisco says about that error message:

This is a connection-related message. This message is displayed if the adaptive security appliance has no more address translation slots available.

You should check the size of the global pool compared to the number of inside network clients.

A PAT address may be necessary. Alternatively, shorten the timeout interval of translates and connections.

This error message could also be caused by insufficient memory; reduce the amount of memory usage, or purchase additional memory, if possible.

However, you said there are only two hosts simultaneosuly behind the ASA?

I would think that either there's not enough memory on the box (8.4 require more memory than older versions)

You might want to adjust the XLATE and CONN timers to 10 and 5 minutes respectively just to test but we need to check other things.. can you attach a show ver please?

Federico.

Re: NAT/PAT pool exhausted

PAUL GILBERT ARIAS — Fri, 25 Feb 2011 02:43:30 GMT

PAT is being used so the error is not nornal. It could be a software issue. Have you tried with a different version?

Sent from Cisco Technical Support iPhone App

Re: NAT/PAT pool exhausted

swaro2000 — Fri, 25 Feb 2011 03:26:17 GMT

Box currrently has 512mb, I have purchased a 1Gig stick but. But ASA will not boot with Gig stick. I noticed that the browsing performance is also sluggish. I will test after with adjusting CONN & XLATE.

Re: NAT/PAT pool exhausted

Federico Coto Fajardo — Fri, 25 Feb 2011 03:54:50 GMT

8.4 should run fine with 512MB on ASA 5505

The amount of translations or connections are not a lot and PAT is definitely not being exhausted.... so... I would think a bug?

Just to check on your license, is it a 10-user, 50-user or unlimited?

Federico.

Re: NAT/PAT pool exhausted

swaro2000 — Fri, 25 Feb 2011 13:49:35 GMT

NetgearFW# sh ver

Cisco Adaptive Security Appliance Software Version 8.4(1)

Device Manager Version 6.4(1)

Compiled on Mon 31-Jan-11 02:11 by builders

System image file is "disk0:/asa841-k8.bin"

Config file at boot was "startup-config"

NetgearFW up 2 days 18 hours

Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz

Internal ATA Compact Flash, 128MB

BIOS Flash M50FW080 @ 0xfff00000, 1024KB

Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)

Boot microcode : CN1000-MC-BOOT-2.00

SSL/IKE microcode : CNLite-MC-SSLm-PLUS-2.03

IPSec microcode : CNlite-MC-IPSECm-MAIN-2.06

Number of accelerators: 1

0: Int: Internal-Data0/0 : address is 0019.0710.17ef, irq 11

1: Ext: Ethernet0/0 : address is 0019.0710.17e7, irq 255

2: Ext: Ethernet0/1 : address is 0019.0710.17e8, irq 255

3: Ext: Ethernet0/2 : address is 0019.0710.17e9, irq 255

4: Ext: Ethernet0/3 : address is 0019.0710.17ea, irq 255

5: Ext: Ethernet0/4 : address is 0019.0710.17eb, irq 255

6: Ext: Ethernet0/5 : address is 0019.0710.17ec, irq 255

7: Ext: Ethernet0/6 : address is 0019.0710.17ed, irq 255

8: Ext: Ethernet0/7 : address is 0019.0710.17ee, irq 255

9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255

10: Int: Not used : irq 255

11: Int: Not used : irq 255

Licensed features for this platform:

Maximum Physical Interfaces : 8 perpetual

VLANs : 20 DMZ Unrestricted

Dual ISPs : Enabled perpetual

VLAN Trunk Ports : 8 perpetual

Inside Hosts : Unlimited perpetual

Failover : Active/Standby perpetual

VPN-DES : Enabled perpetual

VPN-3DES-AES : Enabled perpetual

AnyConnect Premium Peers : 2 perpetual

AnyConnect Essentials : Disabled perpetual

Other VPN Peers : 25 perpetual

Total VPN Peers : 25 perpetual

Shared License : Disabled perpetual

AnyConnect for Mobile : Disabled perpetual

AnyConnect for Cisco VPN Phone : Disabled perpetual

Advanced Endpoint Assessment : Disabled perpetual

UC Phone Proxy Sessions : 2 perpetual

Total UC Proxy Sessions : 2 perpetual

Botnet Traffic Filter : Disabled perpetual

Intercompany Media Engine : Disabled perpetual

This platform has an ASA 5505 Security Plus license.

Serial Number: JMX10000000

Running Permanent Activation Key: 0xb2031100 0x0039eb00 0xe8617900 0x877cd400 0x850ff00

Configuration register is 0x1

Configuration last modified by adm!n at 21:33:14.304 CST Thu Feb 24 2011

NetgearFW#

Re: NAT/PAT pool exhausted

swaro2000 — Sat, 26 Feb 2011 22:40:48 GMT

I downgraded from 8.4.1 to 8.3.2, & now I no longer see the NAT/PAT pool exhausted messages. Browsing speeds have also improved

Re: NAT/PAT pool exhausted

PAUL GILBERT ARIAS — Sun, 27 Feb 2011 01:17:17 GMT

downgrade is always a good troubleshooting step. I am glad that it is working fine now. That could be caused by a software bug.

Please mark this as answered if possible.

NAT/PAT pool exhausted

cperkins2 — Wed, 17 Aug 2011 23:53:32 GMT

Hi,

We upgraded from 8.2 to 8.4.2 and allowed the ASA to do the conversion. We noticed the error happening a few times, but not for all xlates/conns.

I went through the configuration and found that the conversion had a small error. It was PAT'ing 0.0.0.0 to 0.0.0.0. I changed the PAT value to the outside interface IP. All looks good now.

Chris

NAT/PAT pool exhausted

barryhes — Tue, 07 May 2013 19:22:23 GMT

this worked for me....

Hi guys,We had. exactly, the

cristian.munoz — Mon, 15 Jun 2015 20:17:36 GMT

Hi guys,

We had. exactly, the same problem. There is a BUG reported (CSCum51086):

https://tools.cisco.com/bugsearch/bug/CSCum51086/?referring_site=bugquickviewredir

Regards

Cristián