Maximum concurrent NAT sessions for PAT overload

[zawminhtann]

What is the maximum concurrent NAT sessions for PAT overload of Cisco Router with Cisco IOS Software, C3900e Software (C3900e-UNIVERSALK9-M), Version 15.3(3)M4, RELEASE SOFTWARE (fc2) ?

[Mark Malone]

Hi it actually depends on memory in the device hardware not the running IOS

http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/26704-nat-faq-00.html

How many concurrent NAT sessions are supported in Cisco IOS NAT?

A. The NAT session limit is bounded by the amount of available DRAM in the router. Each NAT translation consumes about 312 bytes in DRAM. As a result, 10,000 translations (more than would generally be handled on a single router) consume about 3 MB. Therefore, typical routing hardware has more than enough memory to support thousands of NAT translations.

[zawminhtann]

Hi Mark ,

Router Model is 3945e and using C3900e Software (C3900e-UNIVERSALK9-M), Version 15.3(3)M4 version. The issues is when  Total active translations is 66*** value , facing internet slowness and no access. No latency or No packet drop . no counter value on both inside and outside interface. current user is around 300++. bro . I think the issue will be NAT overload config because  PAT have 65535 port for one IP address. We have completely same setup in 32 places but this one is very high user count and high congestion .Currently temporary solution was adjust the NAT time out default value (24 hours) to some short time value and watch out the outcome .Thanks

[Mark Malone]

Hi am i reading that correctly you have 66000 active NAT/PAT connections,  UDP connections should time out by default after 5 minutes but the TCP will stay for 24hours by default

Honestly never seen it that high if thats the case i would try to reduce them as you said pat can only handle 65535 as thats the amount of ports available so if your over that i would suspect there would be issues with connectivity

[zawminhtann]

Hi Mark ,
Now attached the log file for Active NAT Translation take around 30 mins within 6 hours period for your information .I never did edit for this log expect the router name only . we did the timeout value for tcp is 3600 and udp is 300 as work around solution and now still ok .
Thanks for your advice.