NAT performance and Analysis

[jeffhague]

I have several questions about NAT and performance. Cisco 3640, 2 fast ethernet interfaces. 1 faces in to my firewall, the other faces out to the ISP at 10Mbps. College campus, roughly 1000 students currently only about 400 in house - the rest return this weekend. I moved to private addressing in the dorms this term and set up NAT on the 3640. Initially I deployed it wrong - I supplied 240 public addresses and did not include the overload keyword. I quickly ran out of addresses with only about 200 hosts on campus and was told that I should use overload so I set up 2 pools of 250 public addresses each and turned on overload. Now my router is hitting 80% CPU utilization steadily and response time has dropped - a trace in from the outside yielded a response time of over 1300ms! It dropped back to less than 20ms immidiately after issueing a clear ip nat translations *. I am seeing what seems like a lot of translations - 30,000 or more at some times. Should I see this many connections with only about 400 hosts being Natted? It seems to me that I have some hosts that are taking more than their fair share - how can I track those hosts down? I have noticed that even though there are 250 available addresses in each pool, it has only issued 1 per pool - will it ever issue more or am I wasting 998 addresses? How do I decipher the show ip nat statistics output?

Thanks!

Jeff

[spremkumar]

hi

Since u r hving the option of using 500+ public ips u better have a config similar to this

ip nat pool test 172.16.131.2 172.16.131.10 netmask 255.255.255.0

ip nat inside source list 7 pool test

interface e 0

ip address 10.10.10.254 255.255.255.0

ip nat inside

interface s 0

ip address 172.16.130.2 255.255.255.0

ip nat outside

access-list 7 permit 10.10.10.0 0.0.0.255

just attached only for one segment ,but i dont know y ur using overload though u r having pool configured.

overload usually used in case if u dont hve enough ip blocks to issue in tht case u can use one public ip address for all ur local lan block to go out and browse.in this case all the communications will be based on the port numbers..

btw if possible do post ur config too..

regds

[unicmd]

has the same problem with out 3640 and 1:1 NAT, had about 512 public addresses. The CPU in the 3640 is/was way to small to do that kind of work so now we have moved the NAT to a PIX525, same kind of setup with 1:1 NAT. The PIX has a cpu usage of 3% compared to the router of 65 to 90% cpu