Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

NAT on ASR-1002

Hello,

Does anyone who uses NAT/PAT (nat overload) limit the max number of NAT translations that any one internal IP address can have?  We have had issues where people do port scans and utilise a large majority of our NAT pool.  We are doing NAT on a ASR 1002 with an ESP5.  It can do up to 250,000 NAT translations total and 50,000 new a second.  


Now I found out that the ASR in a pool will only use the last available IP to do PAT.. The rest of the IP addresses are used for 1-1 NAT.

Here is our NAT config

> ip nat translation tcp-timeout 1800
> ip nat translation udp-timeout 1800
> ip nat translation max-entries 250000
> ip nat pool Level3Pool some-ip-address some-ip-address netmask 255.255.255.248
> ip nat inside source list NAT pool Level3Pool overload

Any idea about: 
ip nat settings mode cgn
ip nat settings mode cgn

Thanks

83
Views
0
Helpful
0
Replies
CreatePlease to create content