IP NAT Translation table timeout values

[0rsnaric]

I'm having a problem with a 2621 router doing NAT overload. At times PPTP connections through the router timeout. Although the NAT Translation table shows the intial connection on tcp port 1723, and an incoming GRE connection attempt, the clients still timeout. There are 10 addresses in the NAT pool, but the translation table never goes beyond two or three addresses, even when there are 10+ clients making outbound connections.

So, my question is, could this be a NAT timeout issue? There doesn't appear to be any timeout value set as the table still has entries from yesterday. Or, is there a way to use overload without having it go into PAT mode right off the bat? If I could set up the NAT to work similar to like how I have it configured on a PIX, where it first does one to one NAT until it gets to the last address in the pool, then does PAT.

Or, is there something else at play here? The router has 32megs of memory and is running IOS verison 12.2(10b). It's not under heavy usage when the problems occur (10-12 outbound NAT'd connections at most).

Thanks,

Rick

[Carlo Poggiarelli]

Hi Rick.

Can you post me your config (or a part of it)?

I think it's the same problem happened to me

Regards.

Carlo

[0rsnaric]

Here it is, minus some private IP info and passwords. Thanks for taking the time to look at it Carlo.

Using 1867 out of 29688 bytes

!

! Last configuration change at 11:23:51 UTC Wed Apr 16 2003

! NVRAM config last updated at 11:23:53 UTC Wed Apr 16 2003

!

version 12.2

service timestamps debug uptime

service timestamps log uptime

service password-encryption

!

hostname lortr01

!

no logging console

enable password 7

!

ip subnet-zero

!

!

no ip domain-lookup

ip dhcp excluded-address 172.19.0.0 172.19.1.1

ip dhcp excluded-address 172.19.1.101 172.19.255.255

!

ip dhcp pool lakeo

network 172.19.0.0 255.255.0.0

default-router 172.19.1.1

dns-server 4.2.2.2

!

!

!

!

interface FastEthernet0/0

ip address 172.19.1.1 255.255.0.0

ip nat inside

duplex auto

speed auto

!

interface FastEthernet0/1

ip address XX.XX.241.194 255.255.255.240

ip access-group 100 in

ip nat outside

duplex auto

speed auto

!

ip nat pool verizon XX.XX.241.196 XX.XX.241.205 netmask 255.255.255.240

ip nat inside source list 10 pool verizon overload

ip classless

ip route 0.0.0.0 0.0.0.0 XX.XX.241.193

no ip http server

no ip pim bidir-enable

!

access-list 10 permit 172.19.1.0 0.0.0.255

access-list 100 permit tcp any any established

access-list 100 permit ip host XX.XX.241.206 any

access-list 100 permit udp any eq domain any

access-list 100 permit ip XX.XX.XX.XX 0.0.0.63 any

access-list 100 permit ip XX.XX.XX.XX 0.0.0.31 any

access-list 100 permit udp any eq isakmp any

access-list 100 permit gre any any

access-list 100 permit esp any any

access-list 100 permit ahp any any

access-list 100 permit udp any eq 1000 any

snmp-server community XX RW

snmp-server community XX RO

snmp-server enable traps tty

!

line con 0

password 7

login

line aux 0

line vty 0 4

password 7

login

!

end