Cisco router dynamic NAT stuck after nearly 133,000 active translation

[telesymbol]

Dear All,

we've installed Cisco 3945 router for internet connection and we did dynamic NAT with a pool of two public IPs but we've observed that the NAT stuck after nearly 133,000 active translations and users are not able to access internet. please advise on the issue.

regards

[balaji.bandi]

How Much is your internet bandwidth? and how many clients ?

you need to find out if any devices has malware infected, what is the source, and what destination using frequently.

some NAT Troubleshoot tips :

https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/8605-13.html

If you have NetFlow you can also monitor what device using more NAT Translation.

[telesymbol]

Internet speed is 100 mbps and there are nearly 400 internet users. sources are internal users and destination is basic internet access. when we use one public IP address the NAT stuck after nearly 64000 translations and while we use two IP addresses the NAT got stuck when there is around 134000 active translations

[balaji.bandi]

are these your broadband users? or corporate users?

you need to get statistics on what is happening with NAT translation.

You may restrict users' connection rate per second basis, rather than overloaded with the connection.

or you need to get a modern device which can do the work for you. 

[MHM Cisco World]

can I assume you use two public IP for NAT pool ?
each interface have 65000 port and you reach the max port for two IP. 
I think you need adjust timeout of NAT TCP and UDP OR add more public IP.

[telesymbol]

yes, we're having two public IPs for dynamic NAT, but we didn't have such issues while internet was terminated on the firewall even with one public IP.  

[MHM Cisco World]

each Public IP give you 65000 TCP/UDP port, 
if you exhaust the dynamic NAT then  you need 
to reduce the timeout of dynamic NAT 
or add one or more public ip to your NAT pool 

check your UDP port timeout I think it more than 30 min.

[paul driver]

Hello
Can you share the output of the following, just to makes sure with that many translations you are not maxing out memory/cpu resources, as suggested you can try decrease the nat timeout fro  default 24hrs to a much smaller value - 4hrs (7200)
sh version
sh processes cpu sorted 
sh processes memory
sh ip nat statisitics

[Joseph W. Doherty]

Like @paul driver and @MHM Cisco World , I would first try reducing how long your NAT entries stay alive.

As others and @balaji.bandi have noted, additional stats would help us better diagnose your issue.