CISCO-NAT-CGN-EXT-MIB
AI MIB Summary
The CISCO-NAT-CGN-EXT-MIB extends the standard IETF NAT MIB to monitor Carrier Grade NAT (CGN) and Large Scale NAT (LSN) translation records, subscriber sessions, and bulk port allocation states on Cisco IOS-XR and IOS-XE platforms. It provides granular visibility into address mapping associations, session flow definitions, and packet directionality (in-to-out vs. out-to-in) to facilitate the management of high-volume NAT44, NAT64, and DS-Lite deployments.
This MIB module extends the IETF draft NAT MIB available at
http://tools.ietf.org/html/draft-ietf-behave-nat-mib-11
The extensions are intended to address the needs of the Carrier Grade NAT (CGN), also known as Large Scale NAT (LSN).
GLOSSARY ========== Address mapping - is used to refer to association between a private IP to public IP (in case of NAT44 and DS Lite) or source IPv6 address to IPv4 address in case of NAT64 stateful application.
Mapping - A mapping used to refer to a NAT translation record. It is a record held in memory that maps a private IP address and port to a public IP address and port.
Subscriber - A subscriber is a record held in memory that provides IP address and other details of an end user device which has one or more mappings.
Session - A session is a record maintained in memory that identifies a flow. The flow is uniquely identified by the source IPv4/IPv6 address, source port, translated IP address, translated source port, destination IPv4/IPv6 address and destination port.
In to Out packet - A packet originating from a subscriber, with a private source address (or with an IPv6 address in case of NAT64), destined to a host with a public IP address. This packet needs NAT (or NAPT) service.
Out to In packet - A packet originating from a host on the public Internet (or any host with a routable/public) source address, whose destination address is a mapped (translated) IP address. This packet needs reverse-NAT.
Bulk port allocation - A NAT instance can be configured pre-allocate a range of contiguous ports instead of a single port. A mapping log record is created indicating the range of ports allocated to this subscriber. This is done in anticipation that the subscriber is likely to send packets that require more mappings to be created. For the subsequent mapping requests, one of the pre-allocated port is used and no additional log entries need to be created. This is a technique used to reduce the volume of translation record data.
Main OID:
ciscoNatCgnExtMIB.1.3.6.1.4.1.9.9.818
58
Objects
Active
Status
6
Dependencies
Imported Objects
Objects
58 total| Object Name |
|---|
ciscoNatCgnExtMIBThis MIB module extends the IETF draft NAT MIB available at
http://tools.ietf.org/html/draft-ietf-behave-nat-mib-11
The extensions are intended to address the needs of the Carrier
Grade NAT (CGN), also known as Large Scale NAT (LSN).
GLOSSARY
==========
Address mapping - is used to refer to association between
a private IP to public IP (in case of NAT44 and DS Lite)
or source IPv6 address to IPv4 address in case of NAT64
stateful application.
Mapping - A mapping used to refer to a NAT translation record.
It is a record held in memory that maps a private IP address
and port to a public IP address and port.
Subscriber - A subscriber is a record held in memory that
provides IP address and other details of an end user device
which has one or more mappings.
Session - A session is a record maintained in memory that
identifies a flow. The flow is uniquely identified by the
source IPv4/IPv6 address, source port, translated IP address,
translated source port, destination IPv4/IPv6 address and
destination port.
In to Out packet - A packet originating from a subscriber,
with a private source address (or with an IPv6 address in
case of NAT64), destined to a host with a public IP address.
This packet needs NAT (or NAPT) service.
Out to In packet - A packet originating from a host on the
public Internet (or any host with a routable/public) source
address, whose destination address is a mapped (translated)
IP address. This packet needs reverse-NAT.
Bulk port allocation - A NAT instance can be configured
pre-allocate a range of contiguous ports instead of a single
port. A mapping log record is created indicating the range of
ports allocated to this subscriber. This is done in anticipation
that the subscriber is likely to send packets that require more
mappings to be created. For the subsequent mapping requests, one
of the pre-allocated port is used and no additional log entries
need to be created. This is a technique used to reduce the
volume of translation record data. MODULE-IDENTITY .1.3.6.1.4.1.9.9.818 |
ciscoNatCgnExtMIBNotifs OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.818.0 |
cNatCgnNotifPortUsageWatermarkLowThe device generates this notification when the value of
cNatCgnCounterCurrentPortAllocation becomes lower than or equal
to the value of cNatCgnCounterPortUsageLowThreshold.
The device will not generate notification if
cNatCgnCounterPortUsageLowThreshold is set to zero. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.818.0.1 |
cNatCgnNotifPortUsageWatermarkLowClearThe device generates this notification when the value of
cNatCgnCounterCurrentPortAllocation becomes higher than or
equal to the value of cNatCgnCounterPortUsageClearLowThreshold
and if cNatCgnNotifPortUsageWatermarkLow is already generated.
The device will not generate notification if
cNatCgnCounterPortUsageClearLowThreshold is set to zero. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.818.0.2 |
cNatCgnNotifPortUsageWatermarkHighThe device generates this notification when the value of
cNatCgnCounterCurrentPortAllocation becomes higher than or
equal to the cNatCgnCounterPortUsageHighThreshold.
The device will not generate notification if
cNatCgnCounterPortUsageHighThreshold is set to zero. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.818.0.3 |
cNatCgnNotifPortUsageWatermarkHighClearThe device generates this notification when the value of
cNatCgnCounterCurrentPortAllocation becomes lower than or
equal to the value of cNatCgnCounterPortUsageClearLowThreshold
and if cNatCgnNotifPortUsageWatermarkHigh is already generated.
The device will not generate notification if
cNatCgnCounterPortUsageClearHighThreshold is set to zero. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.818.0.4 |
ciscoNatCgnExtMIBObjects OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.818.1 |
cNatCgnInstanceTableThis table lists the NAT instances configured on the device. SEQUENCE OF CNatCgnInstanceEntry .1.3.6.1.4.1.9.9.818.1.1 |
cNatCgnInstanceEntryAn entry describes a NAT instance configured on the device.
The parameters include the type of the NAT instance and the
important configuration elements. CNatCgnInstanceEntry .1.3.6.1.4.1.9.9.818.1.1.1 |
cNatCgnInstanceTypeThis object specifies the type of the NAT instance.
If the instance type is changed, the service-type attribute of
the corresponding interfaces will also need to be changed.rw NatCgnInstanceType .1.3.6.1.4.1.9.9.818.1.1.1.1 |
cNatCgnInstanceServiceNameThis object specifies the CGN service name of this instance.rw SnmpAdminString .1.3.6.1.4.1.9.9.818.1.1.1.2 |
cNatCgnInstanceVrfThis object specifies the name the VRF that is bringing in
subscriber's traffic that needs to undergo NAT.rw SnmpAdminString .1.3.6.1.4.1.9.9.818.1.1.1.3 |
cNatCgnInstanceInterfaceThis object specifies the name the interface that is bringing
in subscriber's traffic that needs to undergo NAT. Typically
either the cNatCgnInstanceVrf or cNatCgnInstanceInterface is
needed to be configured, but not both.rw SnmpAdminString .1.3.6.1.4.1.9.9.818.1.1.1.4 |
cNatCgnInstanceBehaviorTypeThis object specifies the configured NAT mapping behavior
for this instance.rw NatBehaviorType (NAT-MIB) .1.3.6.1.4.1.9.9.818.1.1.1.5 |
cNatCgnInstancePoolingTypeThis object specifies the configured NAT address pooling type
for this instance.rw NatPoolingType (NAT-MIB) .1.3.6.1.4.1.9.9.818.1.1.1.6 |
cNatCgnInstanceProtocolPortLimitThis object specifies the configured protocol port limit. This
is the maximum number of active mappings each subscriber can
have at any given time.
Value of zero means, it is unlimited.rw Unsigned32 .1.3.6.1.4.1.9.9.818.1.1.1.7 |
cNatCgnInstanceProtocolPortBulkAllocControlThis object specifies the configured bulk port allocation size.
Value of 0 means, bulk allocation is not applicable (or not
supported). Value of 1 means, it is not enabled, that
is, ports are allocated individually and not in bulk.rw Unsigned32 .1.3.6.1.4.1.9.9.818.1.1.1.8 |
cNatCgnCounters OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.818.1.2 |
cNatCgnCounterTableThis table lists the counters of NAT instances in the device. SEQUENCE OF CNatCgnCounterEntry .1.3.6.1.4.1.9.9.818.1.2.1 |
cNatCgnCounterEntryAn entry contains the additional statistics of a NAT
instance. CNatCgnCounterEntry .1.3.6.1.4.1.9.9.818.1.2.1.1 |
cNatCgnCounterSessionCreationsThis object indicates the number of sessions created since
the instance is up.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.1.1.1 |
cNatCgnCounterSessionRemovalsThis object indicates the number of sessions removed since
the instance is up. The number of active sessions is equal to
cNatCgnCounterSessionCreations -
cNatCgnCounterSessionRemovals.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.1.1.2 |
cNatCgnCounterOutOfSessionDropsThis object indicates the number of packets dropped because
they required a new session entry to be created, however,
there is no space to create new sessions.ro Counter64 UNITS "packets" .1.3.6.1.4.1.9.9.818.1.2.1.1.3 |
cNatCgnCounterSessionLimitDropsThis object indicates the number of packets in either in to
out or out to in direction dropped because of exceeding limit
on session entries.ro Counter64 UNITS "packets" .1.3.6.1.4.1.9.9.818.1.2.1.1.4 |
cNatCgnCounterNoMappingEntryDropsThis object indicates the number of packets in the out to in
direction not translated because there was no mapping found.ro Counter64 UNITS "packets" .1.3.6.1.4.1.9.9.818.1.2.1.1.5 |
cNatCgnCounterSourceIPOutOfRangeDropsThis object indicates the number of packets in the in to out
direction not translated because source address was out of
configured prefix or range. For NAT44 configured in predefined
mode, NAT64 stateful or DS Lite, it could be drops due to
source IP address not matching the configured prefix bits.ro Counter64 UNITS "packets" .1.3.6.1.4.1.9.9.818.1.2.1.1.6 |
cNatCgnCounterEndPointFilteringDropsThis object indicates the number of packets in the out to in
direction dropped because of end point dependent filtering
policy. Note, the value of this object should be interpreted in
conjunction with the value of cNatCgnInstanceBehaviorType.
If the NAT instance is configured with endpointIndependent
behavior, the instance is not supposed to filter or
drop any packets based on the destination. In such case
this counter could either be zero or could be the number
of packets passed which would have otherwise be filtered
and dropped if cNatCgnInstanceBehaviorType is set to
addressDependent or addressAndPortDependent.ro Counter64 UNITS "packets" .1.3.6.1.4.1.9.9.818.1.2.1.1.7 |
cNatCgnCounterTCPSequenceDropsThis object indicates the number of packets in the out to in
direction dropped because TCP sequence check failed.ro Counter64 UNITS "packets" .1.3.6.1.4.1.9.9.818.1.2.1.1.8 |
cNatCgnCounterTCPMappingDropsThis object indicates the number of TCP packets in the in to
out direction dropped because a new mapping was required to
be created, however TCP SYN flag was not set.ro Counter64 UNITS "packets" .1.3.6.1.4.1.9.9.818.1.2.1.1.9 |
cNatCgnCounterFragmentPktsInToOutDropsThis object indicates the number of fragmented packets in the
in to out direction dropped due to errors such as timed out
waiting for first fragment or no space to hold the fragment.ro Counter64 UNITS "packets" .1.3.6.1.4.1.9.9.818.1.2.1.1.10 |
cNatCgnCounterFragmentPktsOutToInDropsThis object indicates the number of fragmented packets in the
out to in direction dropped due to errors such as timed out
waiting for first fragment or no space to hold the fragment.ro Counter64 UNITS "packets" .1.3.6.1.4.1.9.9.818.1.2.1.1.11 |
cNatCgnCounterCurrentPortAllocationThis object indicates the current average port allocation
across all available public IP addresses applied to this NAT
instance.
When bulk allocation is enabled (that is, the value of
cNatCgnInstanceProtocolPortBulkAllocControl is more than 1),
this value will include all the ports pre-allocated in bulk
(whether they are in use or not).ro Integer32 .1.3.6.1.4.1.9.9.818.1.2.1.1.12 |
cNatCgnCounterPortUsageLowThresholdThis object specifies the low threshold in percentage of
available public ports that are used up. The notification
cNatCgnNotifPortUsageWatermarkLow is sent once the value of
cNatCgnCounterAveragePortAllocation becomes less than or equal
to this value. If this object is set to zero, the notification
is not generated.rw Integer32 .1.3.6.1.4.1.9.9.818.1.2.1.1.13 |
cNatCgnCounterPortUsageClearLowThresholdThis object specifies the clear low threshold in percentage
of available public ports that are used up. The notification
cNatCgnNotifPortUsageWatermarkLowClear is sent once the value
of cNatCgnCounterAveragePortAllocation becomes more than or
equal to this value. If this object is set to zero, the
notification is not generated.
Implementations must ensure that values of objects
cNatCgnCounterPortUsageClearLowThreshold and
cNatCgnCounterPortUsageLowThreshold remain consistent. For
example, an implementation must respond with an
inconsistentValue error if an attempt is made to set the the
value of cNatCgnCounterPortUsageClearLowThreshold to be less
than or equal to that of cNatCgnCounterPortUsageLowThreshold
and vice versa.rw Integer32 .1.3.6.1.4.1.9.9.818.1.2.1.1.14 |
cNatCgnCounterPortUsageHighThresholdThis object specifies the high threshold in percentage of
available public ports that are used up. The notification
cNatCgnNotifPortUsageWatermarkHigh is sent once the value of
cNatCgnCounterAveragePortAllocation becomes higher than or equal
to this value. If this field is set to zero, the notification
is not generated.rw Integer32 .1.3.6.1.4.1.9.9.818.1.2.1.1.15 |
cNatCgnCounterPortUsageClearHighThresholdThis object specifies the clear high threshold in percentage
of available public ports that are used up. The notification
cNatCgnNotifPortUsageWatermarkHighClear is sent once the value
of cNatCgnCounterAveragePortAllocation becomes less than or
equal to this value. If this object is set to zero, the
notification is not generated.
Implementations must ensure that values of objects
cNatCgnCounterPortUsageClearHighThreshold and
cNatCgnCounterPortUsageHighThreshold remain consistent. For
example, an implementation must respond with an
inconsistentValue error if an attempt is made to set the the
value of cNatCgnCounterPortUsageClearHighThreshold to be more
than or equal to that of cNatCgnCounterPortUsageHighThreshold
and vice versa.rw Integer32 .1.3.6.1.4.1.9.9.818.1.2.1.1.16 |
cNatCgnCounterAverageBulkPortUsageThis object indicates the average percentage usage of ports
pre-allocated in bulk. This value is valid only if the bulk
allocation is configured. That is the value specified by the
cNatCgnInstanceProtocolPortBulkAllocControl is more than 1.
This value gives hints about effectiveness of bulk port
allocation technique. A very low percentage of bulk port usage
may suggest that, bulk allocation size be reduced. On the other
hand, a value close to 100 may hint at increasing the bulk size
to further reduce log data volume.ro Gauge32 .1.3.6.1.4.1.9.9.818.1.2.1.1.17 |
cNatCgnLogStatTableThis table lists the logging statistics of each NAT instance
in the device. SEQUENCE OF CNatCgnLogStatEntry .1.3.6.1.4.1.9.9.818.1.2.2 |
cNatCgnLogStatEntryAn entry describes the logging related statistics of a NAT
instance. CNatCgnLogStatEntry .1.3.6.1.4.1.9.9.818.1.2.2.1 |
cNatCgnLogStatMappingCreateRecordsThis object indicates the number of translation create records
generated. It could be Netflow or Syslog records. It may not
always necessarily be equal to number of mappings created
(natMappingCreations of the NAT-MIB). If bulk allocation is
enabled, this number could be much smaller than
natMappingCreations. If the NAT mode is configured to be
pre-defined or if logging is not configured, this could be
zero.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.2.1.1 |
cNatCgnLogStatMappingDeleteRecordsThis object indicates the number of translation delete records
generated. It could be Netflow or Syslog records. It may not
always necessarily be equal to number of mappings deleted
(natMappingRemovals of the NAT-MIB). If bulk allocation is
enabled, this number could be much smaller than
natMappingRemovals. If the NAT mode is configured to be
pre-defined or if logging is not configured, this could be
zero.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.2.1.2 |
cNatCgnLogStatSessionCreateRecordsThis object indicates the number of session create records
generated. It could be Netflow or Syslog records. It may not
always necessarily be equal to number of sessions created
(cNatCgnCounterSessionCreations).
If logging is not configured or if session logging
is not configured, this could be zero.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.2.1.3 |
cNatCgnLogStatSessionDeleteRecordsThis object indicates the number of session delete records
generated. It could be Netflow or Syslog records. It may not
always necessarily be equal to number of sessions deleted
(cNatCgnCounterSessionRemovals).
If the logging is not configured or if session logging
is not configured, this could be zero.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.2.1.4 |
cNatCgnLogStatNetflowPacketsThis object indicates the number of Netflow packets generated.
This includes the packet which could not be sent out due to
congestion or other reasons.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.2.1.5 |
cNatCgnLogStatNetflowPacketDropsThis object indicates the number of Netflow packets which
could not be sent out due to congestion or other errors within
the CGN device. This does not include any drops along the way
to the collector.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.2.1.6 |
cNatCgnLogStatSyslogPacketsThis object indicates the number of Syslog packets generated.
This includes the packet which could not be sent out due to
congestion or other reasons.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.2.1.7 |
cNatCgnLogStatSyslogPacketDropsThis object indicates the number of Syslog packets which could
not be sent out due to congestion or other errors within the CGN
device. This does not include any drops along the way to the
collector.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.2.1.8 |
cNatCgnALGCountersTableThis table lists the application level gateway status and
counters for each ALG type and for each NAT instance
in the device. SEQUENCE OF CNatCgnALGCountersEntry .1.3.6.1.4.1.9.9.818.1.2.3 |
cNatCgnALGCountersEntryAn entry describes status and counters of a specific ALG type
for a specific NAT instance. CNatCgnALGCountersEntry .1.3.6.1.4.1.9.9.818.1.2.3.1 |
cNatCgnALGTypeThis object indicates the ALG type which together with
natInstanceIndex uniquely identifies the set of counters being
reported. NatCgnALGType .1.3.6.1.4.1.9.9.818.1.2.3.1.1 |
cNatCgnALGStatusThis object indicates the status of this ALG type for this
NAT instance.
notApplicable:
This ALG type is not relevant to this NAT instance.
unSupported:
This ALG type is relevant to this NAT instance, however
it is not supported.
notEnabled:
This ALG is supported on this NAT instance, however it is
not enabled in the configuration.
enabled:
This ALG is enabled on this NAT instance.
The rest of the objects of this entry are valid only if the
cNatCgnALGStatus is set to enabled.ro Enumeration .1.3.6.1.4.1.9.9.818.1.2.3.1.2 |
cNatCgnALGMappingCreationsThis object indicates the number of mappings created for this
ALG.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.3.1.3 |
cNatCgnALGMappingRemovalsThis object indicates the number of mappings removed which
were created for this ALG. The number of active mappings for
this ALG is equal to
cNatCgnALGMappingCreations - cNatCgnALGMappingRemovals.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.3.1.4 |
cNatCgnALGUnsupportedErrorsThis object indicates the number of application level
messages/packets which could not be processed as they used
options which are not yet supported. This does not include
messages/packets that did not conform to the protocol.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.3.1.5 |
cNatCgnALGProtocolErrorsThis object indicates the number of application level
messages/packets which could not be processed as they did
not conform to the protocol.ro Counter64 .1.3.6.1.4.1.9.9.818.1.2.3.1.6 |
ciscoNatCgnExtMIBConform OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.818.2 |
cNatCgnMIBCompliances OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.818.2.1 |
cNatCgnMIBGroups OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.818.2.2 |