SNAT message

[Tauer Drumond]

Hi all,

I had two routers configured to share the NAT table using SNAT and HSRP.

At the standby router I receive this message all the time:

Sep 12 11:57:58.939: SNAT: found: (Real IP address, Nat Ip address, 0, 0)

And unexpectedly this router had rebooted.

Could be this message a problem? What does it could mean?

Thank a lot

[Rozsa Illes]

Hi,

I do not see the context of the error but normally this is seen when the NAT tables are synchronizing.

To see if it is causing the crash, we would need the crashinfo file. Could you upload it?

Warm Regards,

Rose

[Tauer Drumond]

Hi Rose,

thanks for answer.

Follow the attachment.

Thank you

[Rozsa Illes]

Hi,

Yes, looking at the crashinfo file, it indeed was indeed due to SNAT and it looks to be a software related crash.

Is it consistent?

I have seen a few cases where misconfigured SNAT caused crash but most of the time, these are due to the a software bug.

If the configuration looks fine, it would be the best to consider an upgrade.

Warm Regards,

Rose

[Tauer Drumond]

Hi Rose,

recently I've made a IOS upgrade, and after that, the router rebooted unexpectedly, but just once.

Another thing, after copying the new IOS to flash, the flash became 0Mb available space, and I didn't realize that...so I deleted some files, and now it's 1MB space available

[Rozsa Illes]

Hi,

If the crash did not reoccur, especially if the router has been stable for days/weeks, we could monitor the router for now.

The flash issue is strange though. If there is not enough space, it would not allow the upgrade or would fail to boot but I do not remember ever seeing a flash which had 0MB free space after copying over an image. To make sure the image did not get corrupted, I would compare the size of the image on the flash with the size of the image on cisco.com. If they match, we might have had so little space left, that it is indicated this way.

If the size do not match, I would recommend deleting the image, freeing up some more space and copying it over again as it must have gotten corrupted. Though in this case, the image should not even boot.

May I ask what is the image which is running now if you do a show version? And which was the image you wanted to upgrade to? The crashinfo indicated 12.4(24)T1 as the running software.

Cheers,

Rose

[Tauer Drumond]

Yes,

I'm running the "flash:c2800nm-advipservicesk9-mz.124-24.T1.bin

The previous image was: "flash:c2800nm-ipbase-mz.124-25c.bin"

The router has been stable for 5 days, and I'm only getting this message:

Sep 12 11:57:58.939: SNAT: found: (Real IP address, Nat Ip address, 0, 0)

And, before to upgrade the image, I didn't received this message, and SNAT worked very well.

[Rozsa Illes]

Hi,

Do you see the error constantly? From the previous posts, I thought it appeared only before the crash.

Does SNAT work now? If not what do you observe (aside from the errors)?

Do you see the errors on both the active and standby SNAT router?

Could you attach your configuration and the full logs? These errors normally do not appear on their own but are accompanied by other messages.

Warm Regards,

Rose

[Tauer Drumond]

Hi...

Yes I see the this message constantly... all the time.

The SNAT works well. No problem with it.

I see this message only at standby unit.

Follow the attachment

Thank you

[Rozsa Illes]

Hi,

From the information, it seems like this is very similar to the following defect: CSCsw64971 (the title and the description refers to H323 traffic as the trigger but it was seen with other traffic too).

If possible, we should try the 12.4T or later software with the fix.

Warm Regards,

Rose