Hello guys - my first post here, please bear with me.
I am using an ASR 1004 with RP2 and ESP10.
That's the first time that I am trying to configure a BBA-group to work with CGNAT.
After some days, I realized that I do need the overload after the nat command, otherwise the v9 logging feature will not work... Actually the chassis sent the templates to the netflow collector but no data flows are fowarded.
With that in mind I went ahead and setup the PAP + BPA feature to reduce the logging size.
Turns out that if I configure one GI interface with ip nat inside, everything works great, and, when I check the ip nat translations, I can see the ports being allocated starting at 1024...
The issue is when I try to do the same using the BBA-GROUP - connecting a user using PPPOE over a subinterface / vlan.
When the PPPOE users is ON, the ports that are allocated are all over, and after that, if I issue a clear ip nat translation *, it will clear the translations and start doing the right thing, allocating the initial ports to 1024.
I've read the documentation many times, and I am probably missing something.
I am using Version 15.4(3)S9.
Here is my BBA setup
bba-group pppoe G-CGNAT
virtual-template 10
sessions auto cleanup
My interface config:
interface Port-channel1.4009
description G-CGNAT-PPPOE interface
encapsulation dot1Q 4009
no ip redirects
no ip unreachables
no ip proxy-arp
pppoe enable group G-CGNAT
My nat config:
ip nat settings mode cgn
no ip nat settings support mapping outside
ip nat settings pap limit 250 bpa
ip nat log translations flow-export v9 udp destination MYSERVER 59999 source Loopback1
ip nat pool VALIDOS STARTIP ENDIP prefix-length 24
ip nat inside source list CGNAT pool VALIDOS overload
Here is the virtual template
interface Virtual-Template10
ip unnumbered Loopback1
ip nat inside
peer default ip address dhcp-pool POOL-CGNAT-G
ppp authentication pap chap ms-chap ms-chap-v2 USUARIOSRADIUS
!
here is a sample of the translations when I use the ethernet port without BBA or PPPOE:
PPPoe-server#sh ip nat trans
Pro Inside global Inside local Outside local Outside global
tcp EXT-IP.0:1065 10.100.98.3:62022 --- ---
udp EXT-IP.0:1065 10.100.98.3:57136 --- ---
udp EXT-IP.0:1097 10.100.98.3:61201 --- ---
tcp EXT-IP.0:1027 10.100.98.3:61983 --- ---
udp EXT-IP.0:1027 10.100.98.3:59152 --- ---
udp EXT-IP.0:1079 10.100.98.3:58716 --- ---
I have replaced the real IP for EXT-IP.0..
everything looks fine, now, if I connect a pppoe user:
PPPoe-server#sh users
Line User Host(s) Idle Location
* 1 vty 0 support idle 00:00:00
Interface User Mode Idle Peer Address
Vi2.1 g2 PPPoE - 100.65.0.1
PPPoe-server#sh ip nat tr
PPPoe-server#sh ip nat translations
Pro Inside global Inside local Outside local Outside global
udp EXT-IP.0:51482 100.65.0.1:51482 --- ---
udp EXT-IP.0:49502 100.65.0.1:49502 --- ---
udp EXT-IP.0:56435 100.65.0.1:56435 --- ---
tcp EXT-IP.0:62046 100.65.0.1:62046 --- ---
udp EXT-IP.0:62080 100.65.0.1:62080 --- ---
tcp EXT-IP.0:62047 100.65.0.1:62047 --- ---
udp EXT-IP.0:61318 100.65.0.1:61318 --- ---
udp EXT-IP.0:51826 100.65.0.1:51826 --- ---
Now the ports get assigned all over... BPA seems not to work, but as soon as I clear the nat translation entries, everything looks ok:
PPPoe-server#sh ip nat trans
Pro Inside global Inside local Outside local Outside global
tcp EXT-IP.0:1050 100.65.0.1:62086 --- ---
udp EXT-IP.0:1050 100.65.0.1:55039 --- ---
tcp EXT-IP.0:1072 100.65.0.1:62108 --- ---
udp EXT-IP.0:1072 100.65.0.1:61449 --- ---
Not sure if its a bug or if I am missing anything...
I really would like to have BPA to reduce log size.
Tks a lot.
Jeffrey
