3.2.23. cg-nat

Note

requires a CG-NAT Application License.

CG-NAT configuration.

vsr running config# vrf <vrf> cg-nat

enabled

Enable/disable CG-NAT in this VRF.

vsr running config# vrf <vrf> cg-nat
vsr running cg-nat# enabled true|false

Default value

true

alg (deprecated)

Attention

Deprecated since: 2023-08-09

Obsolete in release: 24q3

Description: Moved to network stack configuration because it is used by cg-nat and fp-firewall.

Replacement: .. network-stack fast-path alg

Application-Level Gateway.

vsr running config# vrf <vrf> cg-nat
vsr running cg-nat# alg ALG

ALG values	Description
ftp	ALG for File Transfer Protocol.
h323-q931	ALG for H.225.0 Call Signaling Protocol.
h323-ras	ALG for H.225.0 Registration, Admission and Status Protocol.
pptp	ALG for Point-to-Point Tunneling Protocol.
rtsp	ALG for Real Time Streaming Protocol.
sip-tcp	ALG for Session Initiation Protocol over TCP.
sip-udp	ALG for Session Initiation Protocol over UDP.
tftp	ALG for Trivial File Transfer Protocol.
dns-udp	ALG for Domain Name System.

pool

Pools of IP addresses for the CG-NAT rules.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56}

<string>{1,56}

Pool name.

address

IPv4 addresses in the pool.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56}
vsr running pool <string>{1,56}# address ADDRESS

ADDRESS values	Description
<ipv4-address>	An IPv4 address.
<ipv4-prefix>	An IPv4 prefix: address and CIDR mask.
<ipv4-range>	An IPv4 address range, in the form addr4-addr4.

block-allocation-mode (deprecated)

Attention

Deprecated since: 2024-01-24

Obsolete in release: 24q3

Description: Replaced by allocation-mode configuration

Replacement: allocation-mode

Algorithm used to associate blocks to user.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56}
vsr running pool <string>{1,56}# block-allocation-mode BLOCK-ALLOCATION-MODE

BLOCK-ALLOCATION-MODE values	Description
dynamic	Blocks are allocated dynamically to any user.
deterministic	Blocks are allocated deterministically. It means the same block is always allocated to the same user.

block-size (deprecated)

Attention

Deprecated since: 2024-01-24

Obsolete in release: 24q3

Description: Moved to dynamic/deterministic-block configuration

Replacement: dynamic-block block-size

Number of ports that will be assigned to a given user.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56}
vsr running pool <string>{1,56}# block-size <1-65535>

allocation-mode

Set the way to allocate IP resources.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56} allocation-mode

dynamic-block

Blocks are allocated dynamically to any user.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56} allocation-mode dynamic-block

block-size (mandatory)

Number of ports that will be assigned to a given user.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56} allocation-mode dynamic-block
vsr running dynamic-block# block-size <1-65535>

deterministic-block

Blocks are allocated deterministically. It means the same block is always allocated to the same user.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56} allocation-mode deterministic-block

block-size

Number of ports that will be assigned to a given user.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56} allocation-mode deterministic-block
vsr running deterministic-block# block-size <1-65535>

dynamic-port

Ports are allocated dynamically to any user.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56} allocation-mode dynamic-port

port-algo

Port allocation algorithm for new mappings.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56} allocation-mode dynamic-port
vsr running dynamic-port# port-algo PORT-ALGO

PORT-ALGO values	Description
parity	Preserve port parity: an even port will be mapped to an even port, and an odd port will be mapped to an odd port.
random	Choose port randomly.

port-overloading

Enable configuring port overloading.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56} allocation-mode dynamic-port port-overloading

unique-destination

Overload a port only when the destination address is unique or destination address and port pair is unique.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56} allocation-mode dynamic-port port-overloading
vsr running port-overloading# unique-destination UNIQUE-DESTINATION

UNIQUE-DESTINATION values	Description
address	Overload a port only when the destination address is unique.
address-and-port	Overload a port when the destination address and port pair is unique.

protocol

Enable port overloading for protocol TCP, UDP or both.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56} allocation-mode dynamic-port port-overloading
vsr running port-overloading# protocol PROTOCOL

PROTOCOL values	Description
tcp	Transmission Control Protocol.
udp	User Datagram Protocol.
both	Transmission Control Protocol and User Datagram Protocol.

factor

Select port factor multiplier. For example, with a port range of 64512 and a port factor of 2, the maximum port capacity will be 129024.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56} allocation-mode dynamic-port port-overloading
vsr running port-overloading# factor FACTOR

FACTOR values	Description
2	Port factor of 2.
4	Port factor of 4.
8	Port factor of 8.
16	Port factor of 16.
32	Port factor of 32.
64	Port factor of 64.
128	Port factor of 128.

port-range

Range of ports used for each address of the pool.

vsr running config# vrf <vrf> cg-nat pool <string>{1,56}
vsr running pool <string>{1,56}# port-range START END

START

Port range start.

START

START

A 16-bit port number used by a transport protocol such as TCP or UDP.

END

Port range end.

END

END	A 16-bit port number used by a transport protocol such as TCP or UDP.

rule

List of CG-NAT rules.

vsr running config# vrf <vrf> cg-nat rule <uint16>

<uint16>

Id and priority of the rule. Higher number means lower priority.

deterministic-snat44

Deterministic source NAT44 translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44

match

Match parameters.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 match

outbound-interface (mandatory)

Interface to match on outbound.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 match
vsr running match# outbound-interface OUTBOUND-INTERFACE

OUTBOUND-INTERFACE

An interface name.

source

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 match source

ipv4-address

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 match source
vsr running source# ipv4-address IPV4-ADDRESS

IPV4-ADDRESS

An IPv4 prefix: address and CIDR mask.

translate-to

Translate to.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 translate-to

pool-name (mandatory)

Name of IP address pool used for translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 translate-to
vsr running translate-to# pool-name <leafref>

port-algo

Port allocation algorithm for new mappings.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 translate-to
vsr running translate-to# port-algo PORT-ALGO

PORT-ALGO values	Description
parity	Preserve port parity: an even port will be mapped to an even port, and an odd port will be mapped to an odd port.
random	Choose port randomly.

max-conntracks-per-user

Maximum number of conntracks assigned to a user. When set to 0, the number of conntracks is not limited.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 translate-to
vsr running translate-to# max-conntracks-per-user <uint32>

endpoint-mapping

NAT endpoint mapping behavior.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 translate-to
vsr running translate-to# endpoint-mapping ENDPOINT-MAPPING

ENDPOINT-MAPPING values	Description
dependent	Reuse port mapping for subsequent packets sent from the same internal IP address and port to the same external IP address and port.
independent	Reuse the port mapping for subsequent packets sent from the same internal IP address and port to any external IP address and port.

endpoint-filtering

NAT endpoint filtering behavior.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 translate-to
vsr running translate-to# endpoint-filtering ENDPOINT-FILTERING

ENDPOINT-FILTERING values	Description
dependent	Inbound packets from external endpoints are filtered out if they don’t fully match an existing mapping (IP/port src/dst).
independent	Inbound packets from external endpoints are filtered out only if their destination IP address and port don’t match an existing mapping (IP/port src can differ).

hairpinning

Enable communication between two hosts on the internal network, using their mapped endpoint.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 translate-to
vsr running translate-to# hairpinning true|false

address-pooling

CG-NAT Address Pooling mode.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 translate-to
vsr running translate-to# address-pooling ADDRESS-POOLING

ADDRESS-POOLING values	Description
paired	In paired mode, the same IP of the pool is used to translate all the sessions originating from the same CPE.
no-paired	In no-paired mode, different IPs of the pool can be used to translate different sessions originating from the same CPE.

port-overloading

Enable configuring port overloading.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 translate-to port-overloading

unique-destination

Overload a port only when the destination address is unique or destination address and port pair is unique.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 translate-to port-overloading
vsr running port-overloading# unique-destination UNIQUE-DESTINATION

UNIQUE-DESTINATION values	Description
address	Overload a port only when the destination address is unique.
address-and-port	Overload a port when the destination address and port pair is unique.

protocol

Enable port overloading for protocol TCP, UDP or both.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 translate-to port-overloading
vsr running port-overloading# protocol PROTOCOL

PROTOCOL values	Description
tcp	Transmission Control Protocol.
udp	User Datagram Protocol.
both	Transmission Control Protocol and User Datagram Protocol.

factor

Select port factor multiplier. For example, with a port range of 64512 and a port factor of 2, the maximum port capacity will be 129024.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat44 translate-to port-overloading
vsr running port-overloading# factor FACTOR

FACTOR values	Description
2	Port factor of 2.
4	Port factor of 4.
8	Port factor of 8.
16	Port factor of 16.
32	Port factor of 32.
64	Port factor of 64.
128	Port factor of 128.

deterministic-snat64

Deterministic source NAT64 translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64

match

Match parameters.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 match

outbound-interface (mandatory)

Interface to match on outbound.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 match
vsr running match# outbound-interface OUTBOUND-INTERFACE

OUTBOUND-INTERFACE

An interface name.

source

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 match source

ipv6-address

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 match source
vsr running source# ipv6-address IPV6-ADDRESS

IPV6-ADDRESS

An IPv6 prefix: address and CIDR mask.

translate-to

Translate to.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 translate-to

pool-name (mandatory)

Name of IP address pool used for translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 translate-to
vsr running translate-to# pool-name <leafref>

port-algo

Port allocation algorithm for new mappings.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 translate-to
vsr running translate-to# port-algo PORT-ALGO

PORT-ALGO values	Description
parity	Preserve port parity: an even port will be mapped to an even port, and an odd port will be mapped to an odd port.
random	Choose port randomly.

max-conntracks-per-user

Maximum number of conntracks assigned to a user. When set to 0, the number of conntracks is not limited.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 translate-to
vsr running translate-to# max-conntracks-per-user <uint32>

endpoint-mapping

NAT endpoint mapping behavior.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 translate-to
vsr running translate-to# endpoint-mapping ENDPOINT-MAPPING

ENDPOINT-MAPPING values	Description
dependent	Reuse port mapping for subsequent packets sent from the same internal IP address and port to the same external IP address and port.
independent	Reuse the port mapping for subsequent packets sent from the same internal IP address and port to any external IP address and port.

endpoint-filtering

NAT endpoint filtering behavior.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 translate-to
vsr running translate-to# endpoint-filtering ENDPOINT-FILTERING

ENDPOINT-FILTERING values	Description
dependent	Inbound packets from external endpoints are filtered out if they don’t fully match an existing mapping (IP/port src/dst).
independent	Inbound packets from external endpoints are filtered out only if their destination IP address and port don’t match an existing mapping (IP/port src can differ).

hairpinning

Enable communication between two hosts on the internal network, using their mapped endpoint.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 translate-to
vsr running translate-to# hairpinning true|false

address-pooling

CG-NAT Address Pooling mode.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 translate-to
vsr running translate-to# address-pooling ADDRESS-POOLING

ADDRESS-POOLING values	Description
paired	In paired mode, the same IP of the pool is used to translate all the sessions originating from the same CPE.
no-paired	In no-paired mode, different IPs of the pool can be used to translate different sessions originating from the same CPE.

destination-prefix

NAT64 destination prefix.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 translate-to
vsr running translate-to# destination-prefix DESTINATION-PREFIX

DESTINATION-PREFIX

An IPv6 prefix: address and CIDR mask.

port-overloading

Enable configuring port overloading.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 translate-to port-overloading

unique-destination

Overload a port only when the destination address is unique or destination address and port pair is unique.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 translate-to port-overloading
vsr running port-overloading# unique-destination UNIQUE-DESTINATION

UNIQUE-DESTINATION values	Description
address	Overload a port only when the destination address is unique.
address-and-port	Overload a port when the destination address and port pair is unique.

protocol

Enable port overloading for protocol TCP, UDP or both.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 translate-to port-overloading
vsr running port-overloading# protocol PROTOCOL

PROTOCOL values	Description
tcp	Transmission Control Protocol.
udp	User Datagram Protocol.
both	Transmission Control Protocol and User Datagram Protocol.

factor

Select port factor multiplier. For example, with a port range of 64512 and a port factor of 2, the maximum port capacity will be 129024.

vsr running config# vrf <vrf> cg-nat rule <uint16> deterministic-snat64 translate-to port-overloading
vsr running port-overloading# factor FACTOR

FACTOR values	Description
2	Port factor of 2.
4	Port factor of 4.
8	Port factor of 8.
16	Port factor of 16.
32	Port factor of 32.
64	Port factor of 64.
128	Port factor of 128.

dynamic-snat44

Dynamic source NAT44 translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44

match

Match parameters.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 match

outbound-interface (mandatory)

Interface to match on outbound.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 match
vsr running match# outbound-interface OUTBOUND-INTERFACE

OUTBOUND-INTERFACE

An interface name.

source

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 match source

ipv4-address

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 match source
vsr running source# ipv4-address IPV4-ADDRESS

IPV4-ADDRESS

An IPv4 prefix: address and CIDR mask.

translate-to

Translate to.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to

pool-name (mandatory)

Name of IP address pool used for translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to
vsr running translate-to# pool-name <leafref>

max-blocks-per-user

Maximum number of port blocks assigned to a user.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to
vsr running translate-to# max-blocks-per-user <1-65535>

active-block-timeout

unit: seconds

Interval during which the the current block is used to allocate sessions. When set to 0, the current block is always used.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to
vsr running translate-to# active-block-timeout <uint16>

user-timeout

unit: seconds

Interval during which the current user remains active after all user flows have expired.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to
vsr running translate-to# user-timeout <1-65535>

port-algo

Port allocation algorithm for new mappings.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to
vsr running translate-to# port-algo PORT-ALGO

PORT-ALGO values	Description
parity	Preserve port parity: an even port will be mapped to an even port, and an odd port will be mapped to an odd port.
random	Choose port randomly.

max-conntracks-per-user

Maximum number of conntracks assigned to a user. When set to 0, the number of conntracks is not limited.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to
vsr running translate-to# max-conntracks-per-user <uint32>

endpoint-mapping

NAT endpoint mapping behavior.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to
vsr running translate-to# endpoint-mapping ENDPOINT-MAPPING

ENDPOINT-MAPPING values	Description
dependent	Reuse port mapping for subsequent packets sent from the same internal IP address and port to the same external IP address and port.
independent	Reuse the port mapping for subsequent packets sent from the same internal IP address and port to any external IP address and port.

endpoint-filtering

NAT endpoint filtering behavior.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to
vsr running translate-to# endpoint-filtering ENDPOINT-FILTERING

ENDPOINT-FILTERING values	Description
dependent	Inbound packets from external endpoints are filtered out if they don’t fully match an existing mapping (IP/port src/dst).
independent	Inbound packets from external endpoints are filtered out only if their destination IP address and port don’t match an existing mapping (IP/port src can differ).

hairpinning

Enable communication between two hosts on the internal network, using their mapped endpoint.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to
vsr running translate-to# hairpinning true|false

address-pooling

CG-NAT Address Pooling mode.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to
vsr running translate-to# address-pooling ADDRESS-POOLING

ADDRESS-POOLING values	Description
paired	In paired mode, the same IP of the pool is used to translate all the sessions originating from the same CPE.
no-paired	In no-paired mode, different IPs of the pool can be used to translate different sessions originating from the same CPE.

port-overloading

Enable configuring port overloading.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to port-overloading

unique-destination

Overload a port only when the destination address is unique or destination address and port pair is unique.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to port-overloading
vsr running port-overloading# unique-destination UNIQUE-DESTINATION

UNIQUE-DESTINATION values	Description
address	Overload a port only when the destination address is unique.
address-and-port	Overload a port when the destination address and port pair is unique.

protocol

Enable port overloading for protocol TCP, UDP or both.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to port-overloading
vsr running port-overloading# protocol PROTOCOL

PROTOCOL values	Description
tcp	Transmission Control Protocol.
udp	User Datagram Protocol.
both	Transmission Control Protocol and User Datagram Protocol.

factor

Select port factor multiplier. For example, with a port range of 64512 and a port factor of 2, the maximum port capacity will be 129024.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat44 translate-to port-overloading
vsr running port-overloading# factor FACTOR

FACTOR values	Description
2	Port factor of 2.
4	Port factor of 4.
8	Port factor of 8.
16	Port factor of 16.
32	Port factor of 32.
64	Port factor of 64.
128	Port factor of 128.

dynamic-port-snat44

Dynamic source NAT44 translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat44

match

Match parameters.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat44 match

outbound-interface (mandatory)

Interface to match on outbound.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat44 match
vsr running match# outbound-interface OUTBOUND-INTERFACE

OUTBOUND-INTERFACE

An interface name.

source

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat44 match source

ipv4-address

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat44 match source
vsr running source# ipv4-address IPV4-ADDRESS

IPV4-ADDRESS

An IPv4 prefix: address and CIDR mask.

translate-to

Translate to.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat44 translate-to

pool-name (mandatory)

Name of IP address pool used for translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat44 translate-to
vsr running translate-to# pool-name <leafref>

user-timeout

unit: seconds

Interval during which the current user remains active after all user flows have expired.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat44 translate-to
vsr running translate-to# user-timeout <1-65535>

max-conntracks-per-user

Maximum number of conntracks assigned to a user. When set to 0, the number of conntracks is not limited.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat44 translate-to
vsr running translate-to# max-conntracks-per-user <uint32>

endpoint-mapping

NAT endpoint mapping behavior.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat44 translate-to
vsr running translate-to# endpoint-mapping ENDPOINT-MAPPING

ENDPOINT-MAPPING values	Description
dependent	Reuse port mapping for subsequent packets sent from the same internal IP address and port to the same external IP address and port.
independent	Reuse the port mapping for subsequent packets sent from the same internal IP address and port to any external IP address and port.

endpoint-filtering

NAT endpoint filtering behavior.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat44 translate-to
vsr running translate-to# endpoint-filtering ENDPOINT-FILTERING

ENDPOINT-FILTERING values	Description
dependent	Inbound packets from external endpoints are filtered out if they don’t fully match an existing mapping (IP/port src/dst).
independent	Inbound packets from external endpoints are filtered out only if their destination IP address and port don’t match an existing mapping (IP/port src can differ).

hairpinning

Enable communication between two hosts on the internal network, using their mapped endpoint.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat44 translate-to
vsr running translate-to# hairpinning true|false

address-pooling

CG-NAT Address Pooling mode.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat44 translate-to
vsr running translate-to# address-pooling ADDRESS-POOLING

ADDRESS-POOLING values	Description
paired	In paired mode, the same IP of the pool is used to translate all the sessions originating from the same CPE.
no-paired	In no-paired mode, different IPs of the pool can be used to translate different sessions originating from the same CPE.

dynamic-snat64

Dynamic source NAT64 translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64

match

Match parameters.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 match

outbound-interface (mandatory)

Interface to match on outbound.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 match
vsr running match# outbound-interface OUTBOUND-INTERFACE

OUTBOUND-INTERFACE

An interface name.

source

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 match source

ipv6-address

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 match source
vsr running source# ipv6-address IPV6-ADDRESS

IPV6-ADDRESS

An IPv6 prefix: address and CIDR mask.

translate-to

Translate to.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to

pool-name (mandatory)

Name of IP address pool used for translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to
vsr running translate-to# pool-name <leafref>

max-blocks-per-user

Maximum number of port blocks assigned to a user.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to
vsr running translate-to# max-blocks-per-user <1-65535>

active-block-timeout

unit: seconds

Interval during which the the current block is used to allocate sessions. When set to 0, the current block is always used.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to
vsr running translate-to# active-block-timeout <uint16>

user-timeout

unit: seconds

Interval during which the current user remains active after all user flows have expired.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to
vsr running translate-to# user-timeout <1-65535>

port-algo

Port allocation algorithm for new mappings.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to
vsr running translate-to# port-algo PORT-ALGO

PORT-ALGO values	Description
parity	Preserve port parity: an even port will be mapped to an even port, and an odd port will be mapped to an odd port.
random	Choose port randomly.

max-conntracks-per-user

Maximum number of conntracks assigned to a user. When set to 0, the number of conntracks is not limited.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to
vsr running translate-to# max-conntracks-per-user <uint32>

endpoint-mapping

NAT endpoint mapping behavior.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to
vsr running translate-to# endpoint-mapping ENDPOINT-MAPPING

ENDPOINT-MAPPING values	Description
dependent	Reuse port mapping for subsequent packets sent from the same internal IP address and port to the same external IP address and port.
independent	Reuse the port mapping for subsequent packets sent from the same internal IP address and port to any external IP address and port.

endpoint-filtering

NAT endpoint filtering behavior.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to
vsr running translate-to# endpoint-filtering ENDPOINT-FILTERING

ENDPOINT-FILTERING values	Description
dependent	Inbound packets from external endpoints are filtered out if they don’t fully match an existing mapping (IP/port src/dst).
independent	Inbound packets from external endpoints are filtered out only if their destination IP address and port don’t match an existing mapping (IP/port src can differ).

hairpinning

Enable communication between two hosts on the internal network, using their mapped endpoint.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to
vsr running translate-to# hairpinning true|false

address-pooling

CG-NAT Address Pooling mode.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to
vsr running translate-to# address-pooling ADDRESS-POOLING

ADDRESS-POOLING values	Description
paired	In paired mode, the same IP of the pool is used to translate all the sessions originating from the same CPE.
no-paired	In no-paired mode, different IPs of the pool can be used to translate different sessions originating from the same CPE.

destination-prefix

NAT64 destination prefix.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to
vsr running translate-to# destination-prefix DESTINATION-PREFIX

DESTINATION-PREFIX

An IPv6 prefix: address and CIDR mask.

port-overloading

Enable configuring port overloading.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to port-overloading

unique-destination

Overload a port only when the destination address is unique or destination address and port pair is unique.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to port-overloading
vsr running port-overloading# unique-destination UNIQUE-DESTINATION

UNIQUE-DESTINATION values	Description
address	Overload a port only when the destination address is unique.
address-and-port	Overload a port when the destination address and port pair is unique.

protocol

Enable port overloading for protocol TCP, UDP or both.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to port-overloading
vsr running port-overloading# protocol PROTOCOL

PROTOCOL values	Description
tcp	Transmission Control Protocol.
udp	User Datagram Protocol.
both	Transmission Control Protocol and User Datagram Protocol.

factor

Select port factor multiplier. For example, with a port range of 64512 and a port factor of 2, the maximum port capacity will be 129024.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-snat64 translate-to port-overloading
vsr running port-overloading# factor FACTOR

FACTOR values	Description
2	Port factor of 2.
4	Port factor of 4.
8	Port factor of 8.
16	Port factor of 16.
32	Port factor of 32.
64	Port factor of 64.
128	Port factor of 128.

dynamic-port-snat64

Dynamic source NAT64 translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64

match

Match parameters.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64 match

outbound-interface (mandatory)

Interface to match on outbound.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64 match
vsr running match# outbound-interface OUTBOUND-INTERFACE

OUTBOUND-INTERFACE

An interface name.

source

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64 match source

ipv6-address

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64 match source
vsr running source# ipv6-address IPV6-ADDRESS

IPV6-ADDRESS

An IPv6 prefix: address and CIDR mask.

translate-to

Translate to.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64 translate-to

pool-name (mandatory)

Name of IP address pool used for translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64 translate-to
vsr running translate-to# pool-name <leafref>

user-timeout

unit: seconds

Interval during which the current user remains active after all user flows have expired.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64 translate-to
vsr running translate-to# user-timeout <1-65535>

max-conntracks-per-user

Maximum number of conntracks assigned to a user. When set to 0, the number of conntracks is not limited.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64 translate-to
vsr running translate-to# max-conntracks-per-user <uint32>

endpoint-mapping

NAT endpoint mapping behavior.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64 translate-to
vsr running translate-to# endpoint-mapping ENDPOINT-MAPPING

ENDPOINT-MAPPING values	Description
dependent	Reuse port mapping for subsequent packets sent from the same internal IP address and port to the same external IP address and port.
independent	Reuse the port mapping for subsequent packets sent from the same internal IP address and port to any external IP address and port.

endpoint-filtering

NAT endpoint filtering behavior.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64 translate-to
vsr running translate-to# endpoint-filtering ENDPOINT-FILTERING

ENDPOINT-FILTERING values	Description
dependent	Inbound packets from external endpoints are filtered out if they don’t fully match an existing mapping (IP/port src/dst).
independent	Inbound packets from external endpoints are filtered out only if their destination IP address and port don’t match an existing mapping (IP/port src can differ).

hairpinning

Enable communication between two hosts on the internal network, using their mapped endpoint.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64 translate-to
vsr running translate-to# hairpinning true|false

address-pooling

CG-NAT Address Pooling mode.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64 translate-to
vsr running translate-to# address-pooling ADDRESS-POOLING

ADDRESS-POOLING values	Description
paired	In paired mode, the same IP of the pool is used to translate all the sessions originating from the same CPE.
no-paired	In no-paired mode, different IPs of the pool can be used to translate different sessions originating from the same CPE.

destination-prefix

NAT64 destination prefix.

vsr running config# vrf <vrf> cg-nat rule <uint16> dynamic-port-snat64 translate-to
vsr running translate-to# destination-prefix DESTINATION-PREFIX

DESTINATION-PREFIX

An IPv6 prefix: address and CIDR mask.

static-dnat44

Static destination NAT44 translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat44

match

Match parameters.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat44 match

inbound-interface (mandatory)

Interface to match on inbound.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat44 match
vsr running match# inbound-interface INBOUND-INTERFACE

INBOUND-INTERFACE

An interface name.

destination

Match on destination address.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat44 match destination

ipv4-address

Match on destination address.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat44 match destination
vsr running destination# ipv4-address IPV4-ADDRESS

IPV4-ADDRESS

An IPv4 prefix: address and CIDR mask.

translate-to

Translate to.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat44 translate-to

ipv4-address (mandatory)

Translated Address.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat44 translate-to
vsr running translate-to# ipv4-address IPV4-ADDRESS

IPV4-ADDRESS

An IPv4 address.

static-dnat46

Static destination NAT46 translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat46

match

Match parameters.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat46 match

inbound-interface (mandatory)

Interface to match on inbound.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat46 match
vsr running match# inbound-interface INBOUND-INTERFACE

INBOUND-INTERFACE

An interface name.

destination

Match on destination address.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat46 match destination

ipv4-address

Match on destination address.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat46 match destination
vsr running destination# ipv4-address IPV4-ADDRESS

IPV4-ADDRESS

An IPv4 prefix: address and CIDR mask.

translate-to

Translate to.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat46 translate-to

ipv6-address (mandatory)

Translated Address.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat46 translate-to
vsr running translate-to# ipv6-address IPV6-ADDRESS

IPV6-ADDRESS

An IPv6 address.

source-prefix

NAT46 source prefix.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-dnat46 translate-to
vsr running translate-to# source-prefix SOURCE-PREFIX

SOURCE-PREFIX

An IPv6 prefix: address and CIDR mask.

static-snat44

Static source NAT44 translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat44

match

Match parameters.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat44 match

outbound-interface (mandatory)

Interface to match on outbound.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat44 match
vsr running match# outbound-interface OUTBOUND-INTERFACE

OUTBOUND-INTERFACE

An interface name.

source

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat44 match source

ipv4-address

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat44 match source
vsr running source# ipv4-address IPV4-ADDRESS

IPV4-ADDRESS

An IPv4 prefix: address and CIDR mask.

translate-to

Translate to.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat44 translate-to

ipv4-address (mandatory)

Translated Address.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat44 translate-to
vsr running translate-to# ipv4-address IPV4-ADDRESS

IPV4-ADDRESS

An IPv4 address.

static-snat64

Static source NAT64 translation.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat64

match

Match parameters.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat64 match

outbound-interface (mandatory)

Interface to match on outbound.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat64 match
vsr running match# outbound-interface OUTBOUND-INTERFACE

OUTBOUND-INTERFACE

An interface name.

source

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat64 match source

ipv6-address

Match on source address.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat64 match source
vsr running source# ipv6-address IPV6-ADDRESS

IPV6-ADDRESS

An IPv6 prefix: address and CIDR mask.

translate-to

Translate to.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat64 translate-to

ipv4-address (mandatory)

Translated Address.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat64 translate-to
vsr running translate-to# ipv4-address IPV4-ADDRESS

IPV4-ADDRESS

An IPv4 address.

destination-prefix

NAT64 destination prefix.

vsr running config# vrf <vrf> cg-nat rule <uint16> static-snat64 translate-to
vsr running translate-to# destination-prefix DESTINATION-PREFIX

DESTINATION-PREFIX

An IPv6 prefix: address and CIDR mask.

conntrack (deprecated)

Attention

Deprecated since: 2023-08-09

Obsolete in release: 24q3

Description: Moved to network stack configuration because it is used by cg-nat and fp-firewall.

Replacement: .. network-stack fast-path conntrack

Conntrack options.

vsr running config# vrf <vrf> cg-nat conntrack

behavior (deprecated)

Specific TCP options.

vsr running config# vrf <vrf> cg-nat conntrack
vsr running conntrack# behavior <behavior> enabled true|false

<behavior> values	Description
tcp-window-check	TCP window check.
tcp-rst-strict-order	TCP rst strict order.

enabled (deprecated) (mandatory)

Enable option.

enabled true|false

timeouts (deprecated)

Timeouts for the different events/protocols.

vsr running config# vrf <vrf> cg-nat conntrack timeouts

icmp (deprecated)

Conntrack options for ICMP.

vsr running config# vrf <vrf> cg-nat conntrack timeouts
vsr running timeouts# icmp <icmp> <uint32>

<icmp> values	Description
new	State NEW.
established	State ESTABLISHED.
closed	State CLOSED.

<uint32> (deprecated) (mandatory)

Timeout in seconds.

<uint32>

udp (deprecated)

Conntrack options for UDP.

vsr running config# vrf <vrf> cg-nat conntrack timeouts
vsr running timeouts# udp <udp> <uint32>

<udp> values	Description
new	State NEW.
established	State ESTABLISHED.
closed	State CLOSED.

<uint32> (deprecated) (mandatory)

Timeout in seconds.

<uint32>

gre-pptp (deprecated)

Conntrack options for GRE-PPTP.

vsr running config# vrf <vrf> cg-nat conntrack timeouts
vsr running timeouts# gre-pptp <gre-pptp> <uint32>

<gre-pptp> values	Description
new	State NEW.
established	State ESTABLISHED.
closed	State CLOSED.

<uint32> (deprecated) (mandatory)

Timeout in seconds.

<uint32>

tcp (deprecated)

Conntrack options for TCP.

vsr running config# vrf <vrf> cg-nat conntrack timeouts
vsr running timeouts# tcp <tcp> <uint32>

<tcp> values	Description
syn-sent	State SYN-SENT.
simsyn-sent	State SIMSYN-SENT.
syn-received	State SYN-RECEIVED.
established	State ESTABLISHED.
fin-sent	State FIN-SENT.
fin-received	State FIN-RECEIVED.
closed	State CLOSED.
close-wait	State CLOSE-WAIT.
fin-wait	State FIN-WAIT.
last-ack	State LAST-ACK.
time-wait	State TIME-WAIT.

<uint32> (deprecated) (mandatory)

Timeout in seconds.

<uint32>

nat64 (deprecated)

NAT64 conntrack options.

vsr running config# vrf <vrf> cg-nat conntrack nat64

option (deprecated)

Specific NAT64 options.

vsr running config# vrf <vrf> cg-nat conntrack nat64
vsr running nat64# option <option> true|false

<option> values	Description
update-tcp-mss	Enable/Disable TCP MSS update.
drop-udp-zero-checksum	Enable/Disable UDP null checksum packet drops.
force-frag-ipv4	Fragment IPv4 packets (with DF flag) if the MTU is too small.
force-frag-ipv6	Fragment IPv6 packets if the MTU is too small.

true|false (deprecated) (mandatory)

Option state.

true|false

mtu (deprecated)

NAT64 lowest IPv6 mtu configuration.

vsr running config# vrf <vrf> cg-nat conntrack nat64
vsr running nat64# mtu <mtu> <uint16>

<mtu>

Set lowest IPv6 MTU.

<uint16> (deprecated) (mandatory)

MTU (0 to fragment packet according to the MTU of the output interface).

<uint16>

logging

CG-NAT log configuration.

vsr running config# vrf <vrf> cg-nat logging

enabled

Enable log.

vsr running config# vrf <vrf> cg-nat logging
vsr running logging# enabled true|false

Default value

true

local

Generate log locally.

vsr running config# vrf <vrf> cg-nat logging
vsr running logging# local true|false

event

Events to log.

vsr running config# vrf <vrf> cg-nat logging
vsr running logging# event EVENT

EVENT values	Description
conntrack	Log conntrack allocation and destroy event.
deterministic-conf	Log deterministic configuration event.
port-block	Log port-block allocation and destroy event.

Default value

deterministic-conf port-block

rsyslog-server

Remote log server list.

vsr running config# vrf <vrf> cg-nat logging rsyslog-server <rsyslog-server>

<rsyslog-server> values	Description
<ipv4-address>	The ipv4-address type represents an IPv4 address in dotted-quad notation. The IPv4 address may include a zone index, separated by a % sign. The zone index is used to disambiguate identical address values. For link-local addresses, the zone index will typically be the interface index number or the name of an interface. If the zone index is not present, the default zone of the device will be used. The canonical format for the zone index is the numerical format
<ipv6-address>	The ipv6-address type represents an IPv6 address in full, mixed, shortened, and shortened-mixed notation. The IPv6 address may include a zone index, separated by a % sign. The zone index is used to disambiguate identical address values. For link-local addresses, the zone index will typically be the interface index number or the name of an interface. If the zone index is not present, the default zone of the device will be used. The canonical format of IPv6 addresses uses the textual representation defined in Section 4 of RFC 5952. The canonical format for the zone index is the numerical format as described in Section 11.2 of RFC 4007.
<domain-name>{1,253}	The domain-name type represents a DNS domain name. The name SHOULD be fully qualified whenever possible. Internet domain names are only loosely specified. Section 3.5 of RFC 1034 recommends a syntax (modified in Section 2.1 of RFC 1123). The pattern above is intended to allow for current practice in domain name use, and some possible future expansion. It is designed to hold various types of domain names, including names used for A or AAAA records (host names) and other records, such as SRV records. Note that Internet host names have a stricter syntax (described in RFC 952) than the DNS recommendations in RFCs 1034 and 1123, and that systems that want to store host names in schema nodes using the domain-name type are recommended to adhere to this stricter standard to ensure interoperability. The encoding of DNS names in the DNS protocol is limited to 255 characters. Since the encoding consists of labels prefixed by a length bytes and there is a trailing NULL byte, only 253 characters can appear in the textual dotted notation. The description clause of schema nodes using the domain-name type MUST describe when and how these names are resolved to IP addresses. Note that the resolution of a domain-name value may require to query multiple DNS records (e.g., A for IPv4 and AAAA for IPv6). The order of the resolution process and which DNS record takes precedence can either be defined explicitly or may depend on the configuration of the resolver. Domain-name values use the US-ASCII encoding. Their canonical format uses lowercase US-ASCII characters. Internationalized domain names MUST be A-labels as per RFC 5890.

port

Sets the destination port number for syslog UDP messages to the server.

vsr running config# vrf <vrf> cg-nat logging rsyslog-server <rsyslog-server>
vsr running rsyslog-server <rsyslog-server># port PORT

PORT	A 16-bit port number used by a transport protocol such as TCP or UDP.

Default value

514

vrf

The VRF from which to access the remote server.

vsr running config# vrf <vrf> cg-nat logging rsyslog-server <rsyslog-server>
vsr running rsyslog-server <rsyslog-server># vrf <leafref>

connection-status (state only)

Connection status.

vsr> show state vrf <vrf> cg-nat logging rsyslog-server <rsyslog-server> connection-status

statistics (state only)

The statistics for this server.

transmit (state only)

The number of logs transmitted to this server.

vsr> show state vrf <vrf> cg-nat logging rsyslog-server <rsyslog-server> statistics transmit

transmit-error (state only)

The number of logs that have not been transmitted to this server.

vsr> show state vrf <vrf> cg-nat logging rsyslog-server <rsyslog-server> statistics transmit-error

build-error (state only)

The number of logs that have not been built to this server.

vsr> show state vrf <vrf> cg-nat logging rsyslog-server <rsyslog-server> statistics build-error