Solved: CGN NAT44 configuration issue: Unable to obtain requested information Error:'cgn' detected the 'warn...

enrique.villa · ‎01-15-2013

Hello,

We followed this thread´s advice (https://supportforums.cisco.com/message/3753984) to get a CGN up and running with a single vrf instance (IOS XR 4.2)

Everything seems to be ok but we are getting the following error:

asr#show cgn nat44 NAT444 statistics

Unable to obtain requested information Error:'cgn' detected the 'warning' condition 'The instance has not yet been configured'

asr#

We have configured the service infra interface and we have also reloaded the line card.

Plus, we don´t see this error in any guide. Could you please enlighten us?

Thank you in advance,

Nicolas Fevrier · ‎01-16-2013

Hi Enrique,

looks all good to me so far: serviceInfra is up and reachable (you checked "show services interfaces" right ?), packages are installed properly, card is "IOS XR RUN / APP-READY" and config seems alright.

I realized I suggested a wrong show command.

Did you try:

sh cgn nat44 nat1 statistics

(not the CGN instance (also called "card instance") but the nat44 instance name).

Cheers,

N.

View solution in original post

Nicolas Fevrier · ‎01-15-2013

Hi Enrique,

let's follow up on this new thread then.

My answer on the other one was:

I've seen this message usually when I mistyped the name of my NAT44 instance,

could you please share the "sh run service cgn *" config ?

Thanks,

N.

enrique.villa · ‎01-15-2013

Thank you for the quick answer,

I don´t have full access to the platform atm but I can post the most relevant info form my text files: (When it says IPpublic-range there is public IPs in the ARK9K instead):

hw-module service cgn location 0/4/CPU0

vrf inside

address-family ipv4 unicast

interface GigabitEthernet0/1/0/6

description NAT44A

vrf inside

ipv4 address 192.168.128.1 255.255.255.240

transceiver permit pid all

interface ServiceApp1

vrf inside

ipv4 address 1.1.1.1 255.255.255.252

service cgn NAT44A service-type nat44

!

interface ServiceApp2

ipv4 address 2.1.1.1 255.255.255.252

service cgn NAT44A service-type nat44

!

interface ServiceInfra1

ipv4 address 192.168.128.241 255.255.255.240

service-location 0/4/CPU0

router static

address-family ipv4 unicast

IPpublic-range ServiceApp2

vrf inside

address-family ipv4 unicast

0.0.0.0/0 ServiceApp1

service cgn NAT44A

service-location preferred-active 0/4/CPU0

service-type nat44 nat1

inside-vrf inside

map address-pool IPpublic-range

Nicolas Fevrier · ‎01-15-2013

You are defining instance NAT44A and you try to check the stats on NAT444.

What does "show cgn nat44 NAT44A statistics" gives you ?

Cheers,

N.

enrique.villa · ‎01-15-2013

Ooops my fault

All of them should read NAT44A or NAT444 (as you like), I mistyped it when posting, that is not part of the issue.

Nicolas Fevrier · ‎01-15-2013

Ok, config seems ok.

Please send the output of "show platform" or "sh install act sum", first.

Curious to know if serviceInfra is up too.

Thanks,

N.

enrique.villa · ‎01-15-2013

Hi Nicolas,

We can ping serviceInfra.

Below the output of the 2 commands:

RP/0/RSP0/CPU0:ASR9K#show platform

Node Type State Config State

-----------------------------------------------------------------------------

0/RSP0/CPU0 A9K-RSP-4G(Active) IOS XR RUN PWR,NSHUT,MON

0/RSP1/CPU0 A9K-RSP-4G(Standby) IOS XR RUN PWR,NSHUT,MON

0/0/CPU0 A9K-2T20GE-L IOS XR RUN PWR,NSHUT,MON

0/1/CPU0 A9K-2T20GE-L IOS XR RUN PWR,NSHUT,MON

0/2/CPU0 A9K-2T20GE-L IOS XR RUN PWR,NSHUT,MON

0/4/CPU0 A9K-ISM-100(LCP) IOS XR RUN PWR,NSHUT,MON

0/4/CPU1 A9K-ISM-100(SE) APP-READY

RP/0/RSP0/CPU0:ASR9K#show install act sum

Active Packages:

disk0:asr9k-services-p-4.2.1

disk0:asr9k-9000v-nV-p-4.2.1

disk0:asr9k-mini-p-4.2.1

disk0:asr9k-optic-4.2.1

disk0:asr9k-doc-p-4.2.1

disk0:asr9k-mpls-p-4.2.1

disk0:asr9k-mgbl-p-4.2.1

disk0:asr9k-mcast-p-4.2.1

Best Regards,

Nicolas Fevrier · ‎01-16-2013

Hi Enrique,

looks all good to me so far: serviceInfra is up and reachable (you checked "show services interfaces" right ?), packages are installed properly, card is "IOS XR RUN / APP-READY" and config seems alright.

I realized I suggested a wrong show command.

Did you try:

sh cgn nat44 nat1 statistics

(not the CGN instance (also called "card instance") but the nat44 instance name).

Cheers,

N.

enrique.villa · ‎01-17-2013

Hello Nicolas,

You were absolutely right! We tried sh cgn nat44 nat1 statistics on the nat44 instance name and it´s showing statistics now.

But alas, now NAT´ed users are experiencing general slugginesh (some of them, at random).

RP/0/RSP0/CPU0:ASR9K#show cgn nat44 nat1 sta

Statistics summary of NAT44 instance: 'nat1'

Number of active translations: 26881

Translations create rate: 144

Translations delete rate: 0

Inside to outside forward rate: 6795

Outside to inside forward rate: 11638

Inside to outside drops port limit exceeded: 4876300

Inside to outside drops system limit reached: 0

Inside to outside drops resorce depletion: 0

No translation entry drops: 4391859

Pool address totally free: 0

Pool address used: 64

Pool address usage:

Config:

service cgn NAT444

service-location preferred-active 0/4/CPU0

service-type nat44 nat1

portlimit 10000

inside-vrf inside

map address-pool IP-Public pool

We have tried several portlimit configs, from 100 to 60000 right now.

Any idea about this?

Thank you in advance,

Nicolas Fevrier · ‎01-19-2013

Hello Enrique,

I will suppose that the "Inside to outside drops port limit exceeded" where present when you didn't have a port-limit at 10.000. (by the way, it's a fairly high number, we usually don't see more than 4096).

I see you are using a /26 ---> 64 outside addresses and 26881 concurrent users.

That makes an average of 26881/64 = 420 users per IP.

Each external address offers by default 65535-1024=64511 ports.

420 users sharing 64511, it's 154 ports average per user.

So, changing the port-limit to 10000 will not change much

I'm not concluding that it's the root cause of what you experienced, but it looks like a very high usage of the NAT port multiplexing.

More, the "math" above is based on the asumption that your traffic is load balanced to the different cores in the ISM.

To verify this, you can use the following:

RP/0/RSP0/CPU0:ASR9K#run attach 0/4/CPU0

# show_nat44_stats

---> use exit to get out of the attach mode.

My advise, try to allocate a slightly larger map pool to reduce the number of users per address.

The latency induced by the NAT should be negligeable (couple of hundreds of microseconds), so if the problem persists with a larger map pool, please contact the TAC and raise a case.

Cheers,

N.

enrique.villa · ‎01-21-2013

Hello Nicolas,

Thank you for your support!. NAT44 is working now, we will raise a TAC case if we see these symptoms again.

Best regards,

mkhalil10 · ‎02-16-2015

Hi all

What am trying to achieve is utilization per pool , can I load balance the traffic on the ISM cores ? and How can I know the commands available on the run attach mode in order to retrieve more information related to CGN NAT traffic?

Thanks

enrique.villa · ‎01-22-2013

Hello Nicolas,

The answer to your request:

RP/0/RSP0/CPU0:ASR9K#run attach 0/4/CPU0

attach: Starting session 1 to node 0/4/CPU0

# show_nat44_stats

CORE-ID #SESSIONS(%UTIL) #USERS(%UTIL)

------------------------------------------------------------------------

0 15356(0.5%) 212(0.16%)

1 9165(0.3%) 225(0.17%)

2 16384(0.6%) 228(0.17%)

3 14313(0.5%) 239(0.18%)

4 0(0.0%) 0(0.00%)

5 0(0.0%) 0(0.00%)

6 0(0.0%) 0(0.00%)

7 0(0.0%) 0(0.00%)

------------------------------------------------------------------------

Total Sessions: 55218 Total users: 904

Main DB size is 2875008 and User DB size is 131072

#

Thank you in advance for your comments,

Cheers,

Nicolas Fevrier · ‎01-22-2013

Ok, it's a very very light utilization you have here.

If the problem of latency re-occurs, the TAC will help you with the proper troubleshooting methodology.

Cheers,

N.

smailmilak · ‎01-29-2013

Hello,

we are trying to configure NAT64 on ISM. We are running 4.3.0 on ASR9k and all

packages are installed.

Problem is that the config guide is "incomplete" and the NAT64 config is not well

explained.

I will paste the config and show command. Problem is that we have the same problem

like the creator of the thread.

RP/0/RSP1/CPU0:ASR9010_PE_DMALTA#sh cgn nat64 stateful CGN1 statistics

Tue Jan 29 14:52:59.351 BIH

Unable to obtain requested info Error:'cgn' detected the 'warning' condition 'The instance has not yet been configured'

RP/0/RSP1/CPU0:ASR9010_PE_DMALTA#sh cgn nat64 stateful STATEFULL statistics

Tue Jan 29 14:59:07.270 BIH

Unable to obtain requested info Error:'cgn' detected the 'warning' condition 'CONN state is DOWN'

service cgn CGN1

service-location preferred-active 0/4/CPU0

service-type nat64 stateful STATEFULL

portlimit 2000

ipv6-prefix 64:ff9b::/64

ipv4 address-pool 80.65.84.160/29

dynamic-port-range start 10000

address-family ipv4

interface ServiceApp2

tcp mss 600

!

address-family ipv6

interface ServiceApp1

protocol icmp

reset-mtu

!

tcp mss 600

!

protocol udp

timeout 1800

!

protocol tcp

session initial timeout 90

session active timeout 90

!

protocol icmp

timeout 900

!

interface ServiceInfra10

ipv4 address 10.100.127.9 255.255.255.252

service-location 0/4/CPU0

RP/0/RSP1/CPU0:ASR9010_PE_DMALTA#show platform

Tue Jan 29 14:57:29.753 BIH

Node Type State Config State

-----------------------------------------------------------------------------

0/RSP0/CPU0 A9K-RSP440-TR(Standby) IOS XR RUN PWR,NSHUT,MON

0/RSP1/CPU0 A9K-RSP440-TR(Active) IOS XR RUN PWR,NSHUT,MON

0/0/CPU0 A9K-8T-L IOS XR RUN PWR,NSHUT,MON

0/1/CPU0 A9K-8T-L IOS XR RUN PWR,NSHUT,MON

0/2/CPU0 A9K-2T20GE-L IOS XR RUN PWR,NSHUT,MON

0/3/CPU0 A9K-2T20GE-L IOS XR RUN PWR,NSHUT,MON

0/4/CPU0 A9K-ISM-100(LCP) IOS XR RUN PWR,NSHUT,MON

0/4/CPU1 A9K-ISM-100(SE) APP-READY

Package asr9k-ism-cgv6-install-kit-4.3.0.00.sh has been installed!

Node 0/RSP0/CPU0 [RP] [SDR: Owner]

Boot Device: disk0:

Boot Image: /disk0/asr9k-os-mbi-4.3.0/0x100305/mbiasr9k-rsp3.vm

Active Packages:

disk0:asr9k-fpd-px-4.3.0

disk0:asr9k-mpls-px-4.3.0

disk0:asr9k-optic-px-4.3.0

disk0:asr9k-doc-px-4.3.0

disk0:asr9k-mini-px-4.3.0

disk0:asr9k-mcast-px-4.3.0

disk0:asr9k-mgbl-px-4.3.0

disk0:asr9k-services-p-px-4.3.0

disk0:asr9k-k9sec-px-4.3.0

Node 0/4/CPU0 [LC] [SDR: Owner]

Boot Device: mem:

Boot Image: /disk0/asr9k-os-mbi-4.3.0/lc/mbiasr9k-lc.vm

Active Packages:

disk0:asr9k-mpls-px-4.3.0

disk0:asr9k-optic-px-4.3.0

disk0:asr9k-mini-px-4.3.0

disk0:asr9k-mcast-px-4.3.0

disk0:asr9k-services-p-px-4.3.0

Service-Engine0/4/0/0 unassigned Up Up

Service-Mgmt0/4/0/0 unassigned Up Up

Service-Engine0/4/0/1 unassigned Up Up

Service-Mgmt0/4/0/1 unassigned Up Up

Service-Engine0/4/0/2 unassigned Up Up

Service-Mgmt0/4/0/2 unassigned Up Up

Service-Engine0/4/0/3 unassigned Up Up

Service-Mgmt0/4/0/3 unassigned Up Up

CGN NAT44 configuration issue: Unable to obtain requested information Error:'cgn' detected the 'warning' condition 'The instance has not yet been configured'