Clear IP NAT command restart the Router Configured with Event Manager

[Hamidsattarrana]

Hi All!

I have some issue while executing "clear IP NAT translation *". The router restart after executing the command. Also the Voice Traffic is going via the same router. And Cisco IP phones went to voice mail after clear ip nat command. I have to manually release/renew the IP address of Cisco IP Phone 7940/7960 when they went to voice mail.

I have configured failover with EMM. Configurations are below. Kindly check.

Cisco IOS Version: c3845-adventerprisek9-mz.124-24.T6.bin

Cisco Router: C3845

Number of Users: Almost 100 users doing Browsing.

ip sla 4
icmp-echo 1.1.1.1 source-interface GigabitEthernet0/0.100
threshold 100
frequency 5
timeout 2500
verify-data
owner ISP-1
tag ISP-1
ip sla schedule 4 life forever start-time now

ip sla 5
icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0.952
threshold 100
frequency 5
timeout 2500
verify-data
owner ISP-2
tag ISP-2
ip sla schedule 5 life forever start-time now

track 4 ip sla 4 reachability
track 5 ip sla 5 reachability

event manager applet ISP-1-DOWN
event track 4 state down
action 1.0 cli command "enable"
action 2.0 cli command "conf t"
action 3.0 cli command "no ip route 0.0.0.0 0.0.0.0 192.168.10.1"
action 4.0 cli command "exit"
action 5.0 cli command "clear ip nat translation *"
action 6.0 cli command "end"
!
event manager applet ISP-1-UP
event track 4 state up
action 1.0 cli command "enable"
action 2.0 cli command "conf t"
action 3.0 cli command "ip route 0.0.0.0 0.0.0.0 192.168.10.1"
action 4.0 cli command "exit"
action 5.0 cli command "clear ip nat translation *"
action 6.0 cli command "end"
!
event manager applet ISP-2-DOWN
event track 5 state down
action 1.0 cli command "enable"
action 2.0 cli command "conf t"
action 3.0 cli command "no ip route 0.0.0.0 0.0.0.0 203.25.45.223"
action 4.0 cli command "exit"
action 5.0 cli command "clear ip nat translation *"
action 6.0 cli command "end"
!
event manager applet ISP-2-UP
event track 5 state up
action 1.0 cli command "enable"
action 2.0 cli command "conf t"
action 3.0 cli command "ip route 0.0.0.0 0.0.0.0 203.25.45.223"
action 4.0 cli command "exit"
action 5.0 cli command "clear ip nat translation *"
action 6.0 cli command "end"

[balaji.bandi]

Clearing NAT will not casue of the reboot device (by the what device is this and what version code running here)

what is the Logs while clear nat happends ?

Where is your DHCP Server ? if the DHCP server north side of the Router, then this breaks. if the router offering DHCP, then sure youll see the issue, since device not aware DHCP Server Lost. depends on lease time.

what kind of Load this router handling ?

[Hamidsattarrana]

Clearing NAT will not casue of the reboot device (by the what device is this and what version code running here)

-- Cisco Router c3845 with IOS Version: c3845-adventerprisek9-mz.124-24.T6.bin

what is the Logs while clear nat happends ?

-- I am not sure about the logs. Router restarted as soon the clear ip nat translation is exeucted.

Where is your DHCP Server ? if the DHCP server north side of the Router, then this breaks. if the router offering DHCP, then sure youll see the issue, since device not aware DHCP Server Lost. depends on lease time.

-- This router is also a DHCP server. 192.168.32.0/22 subnet for Data VLan and 192.168.100.0/24 is for Voice VLan.

what kind of Load this router handling ?

--We are using this router for Voice Traffic, Video Streaming, Browsing. Almost 100 to 150 users. 

I have collected Crashinfo file.

The output of crashinfo file is below.

--------------------------------------------------------------------

   Possible software fault. Upon reccurence,  please collect

   crashinfo, "show tech" and contact Cisco Technical Support.

--------------------------------------------------------------------

[balaji.bandi]

May be due to high load or could be bugs, Looks device End of Life Long time.

check any new version you can upgrade to fix the issue, if not try to offload some of the traffic Like DHCP from router.

or business can make a new budget replace with higher end router.

Note : still i suggest to have different DHCP Server if you have large environment.

[Georg Pauwen]

Hello,

how many active NAT translations does the router have ? Check if the bug below applies:

CSCdr77631 - clearing 300,000 nat translations reboots router

high cpu at interrupt level with large number of NAT flows
CSCdu63623
Description
a router running NAT with large numbers of NAT translations active will
see high cpu at interrupt level:

router#show proc cpu | incl util
CPU utilization for five seconds: 100%/95%; one minute: 88%; five minutes: 88%

you can reduce the cpu at interrupt level by issuing:

router#clear ip nat translation *

or by configuring much shorter timeout intervals (then the default)
for the NAT translations:

router(config)#ip nat translation ?
dns-timeout Specify timeout for NAT DNS flows
finrst-timeout Specify timeout for NAT TCP flows after a FIN or RST
icmp-timeout Specify timeout for NAT ICMP flows
max-entries Specify maximum number of NAT entries
port-timeout Specify timeout for NAT TCP/UDP port specific flows
pptp-timeout Specify timeout for NAT PPTP flows
syn-timeout Specify timeout for NAT TCP flows after a SYN and no further
data
tcp-timeout Specify timeout for NAT TCP flows
timeout Specify timeout for dynamic NAT translations
udp-timeout Specify timeout for NAT UDP flows

[Hamidsattarrana]

Here is the Output of "Show ip nat statistics"

Total active translations: 7309 (0 static, 7309 dynamic; 7309 extended)
Peak translations: 9169, occurred 00:16:28 ago
Outside interfaces:
GigabitEthernet0/0.100, GigabitEthernet0/0.200, GigabitEthernet0/0.952
GigabitEthernet0/0.3523
Inside interfaces:
GigabitEthernet0/1.300, GigabitEthernet0/1.400
Hits: 54726914 Misses: 0
CEF Translated packets: 54339580, CEF Punted packets: 387412
Expired translations: 292843
Dynamic mappings:
-- Inside Source
[Id: 1] route-map Irfan-ISP interface GigabitEthernet0/0.952 refcount 1
[Id: 2] route-map mobilink interface GigabitEthernet0/0.3523 refcount 3
[Id: 3] route-map nexlink interface GigabitEthernet0/0.200 refcount 394
[Id: 4] route-map ptcl interface GigabitEthernet0/0.100 refcount 7039
Appl doors: 55
Normal doors: 77
Queued Packets: 0

[balaji.bandi]

what kind of traffic this router able to serving, what is the CPU process ? post  show interface gi 0/1

GigabitEthernet0/1.300, GigabitEthernet0/1.400
Hits: 54726914 Misses: 0
CEF Translated packets: 54339580, CEF Punted packets: 387412
Expired translations: 292843

[Hamidsattarrana]

Below is the output of "Show interface gig 0/1"

Core-Router#show interfaces gigabitEthernet 0/1
GigabitEthernet0/1 is up, line protocol is up
Hardware is BCM1125 Internal MAC, address is 68bd.abbd.d721 (bia 68bd.abbd.d721)
Description: LAN
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 5/255, rxload 1/255
Encapsulation 802.1Q Virtual LAN, Vlan ID 1., loopback not set
Keepalive not set
Full-duplex, 1000Mb/s, media type is RJ45
output flow-control is XON, input flow-control is XON
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/5/57 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: Class-based queueing
Output queue: 0/1000/0 (size/max total/drops)
5 minute input rate 2627000 bits/sec, 1707 packets/sec
5 minute output rate 21879000 bits/sec, 2678 packets/sec
23072054 packets input, 4058372250 bytes, 0 no buffer
Received 98947 broadcasts, 0 runts, 0 giants, 1 throttles
9 input errors, 0 CRC, 0 frame, 9 overrun, 0 ignored
0 watchdog, 154663 multicast, 0 pause input
0 input packets with dribble condition detected
41549733 packets output, 3315669230 bytes, 0 underruns
1 output errors, 0 collisions, 1 interface resets
449 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
1 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out