sh ip nat statistics

[axfalk]

We're utilizing the nat feature, where we're nating the destination address of a packet and using the "sh ip nat statistics" to monitor it. The statistics include the number of hits and misses. I understand what the number of hits means, but how should i interpret the number of misses? - does that indicate the packet's destination address is not in the NAT table?

thanks.

[Kevin Dorrell]

The documentation for the command is here:

http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/products_command_reference_chapter09186a008017d166.html#wp1082017

It says that the misses are the "Number of failed allocations from the pool." I presume that means that your are not using PAT overload, and you have more clients on the inside wanting to do NAT than you have addresses on the outside pool.

Hope that helps.

Kevin Dorrell

Luxembourg

[axfalk]

Kevin, thanks. That would be the most plausable explanation, except we only have the static NAT translations - no dynamic ones. And yet, when I do the sh ip nat statistics, I get the following:

Total active translations: 177 (48 static, 129 dynamic; 0 extended)

Outside interfaces:

FastEthernet0/0

Inside interfaces:

FastEthernet0/1

Hits: 1190723 Misses: 53935

Expired translations: 72

Dynamic mappings:

Where do these dynamic translations come from?

Thanks again

[Kevin Dorrell]

That's interesting. Could we see the configs please?

Did the output continue, and give a list of dynamics? If so, how many, and were there any clues in the addresses? Perhaps a show ip nat trans would tell us something.

Kevin Dorrell

Luxembourg

[axfalk]

that was it for the output - no dynamics were shown at all. the sh ip nat trans showed a whole bunch of static nats. i guess i will open a call with cisco on this - very peculiar.

thanks

[Kevin Dorrell]

OK. Let us know the outcome. I'm curious to know as well.

Kevin Dorrell

Luxembourg

[axfalk]

I am using "ip nat outside source static" in the router and, according to Cisco, when you configure "ip nat outside source static" configuration, the router creates dynamic translations. As strange as this may sound, it still does explain why the ip nat statistics shows both static and dynamic translations. Moreover, if I have, only static NATs, how could I run out of addresses and end up with so many misses....

[Kevin Dorrell]

Strange. I confess I don't see why it should produce dynamic translations when you have configured a static mapping, and even less why it should then not list them under the "show" command. I suspect ee are not going to understand the "misses" until we get to the bottom of why it maps these statics as dynamics.

Kevin Dorrell

Luxembourg

[axfalk]

As of 12.3(4)T, Cisco created extended NAT entries for faster lookups by default. Creating extended NAT entries is "dynamic". You can turn it off thru CLI "no ip nat create flow-entries" but your performance will suffer.

Also, the "dynamic translations" are not the same as the "dynamic mappings", which what led to my confuion in the first place.