Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Monitoring NAT

Configuring NAT Session Logs

You can configure session logs for NAT from the CLI. By default, session open and close logs are produced. However, you can request that only one type of log be produced.

To configure NAT session logs:

  1. Go to the [edit services service-set service-set-name syslog host class classname] hierarchy level.
  2. Configure NAT logging using the nat-logs configuration statement.
  3. Configure session logging using the session-logs statement. Open and close logs are produced by default. Specify open or close to produce only one type of log.

    Or

    Or

  4. For NAT sessions that use secured port block allocation (PBA), enter the pba-interim-logging interval option.
  5. Configure a /32 IP address under unit 0 of the service interface that is assigned to the service set. This is the source IP address for all syslog messages generated by the service set for the NAT session logs. If you do not configure the IP address, syslog messages are not generated.
    Note:

    If you use anything other than a /32 IP address, unwanted traffic might be sent to the service interface, which can eat up valuable CPU time on the service PIC.

Monitoring NAT Pool Usage

Purpose

Use the show services nat pool detail command to find global NAT statistics related to pool usage. This command is frequently used in conjunction with the show services stateful-firewall statistics command.

Action

Using the Enterprise-Specific Utility MIB

Using the Enterprise-Specific Utility MIB

The enterprise-specific Utility MIB enables you to add SNMP-compliant applications information to the enterprise-specific Utility MIB. The application information includes:

  • NAT mappings

  • Carrier-grade NAT (CGNAT) pools

  • Service set CPU utilization

  • Service set memory usage

  • Service set summary information

  • Service set packet drop information

  • Service set memory zone information

  • Multiservices PIC CPU and memory utilization

  • Stateful firewall flow counters

  • Session application connection information

  • Session analysis information

  • Subscriber analysis information

  • Traffic Load Balancer information

You use a delivered Stylesheet Language Alternative Syntax (SLAX) script to place applications information into the enterprise-specific Utility MIB. The script is invoked based on event policies (such as reboot of the router or switchover of Routing Engines) defined in an event script. The script can also be invoked from the command line as an op script. The script only runs on the primary Routing Engine. After the script is invoked, it polls data from the specified components at regular intervals using the XML-RPC API and writes the converted data to the Utility MIB as SNMP variables. The script automatically restarts after a configured polling cycle elapses.

Populating the Enterprise-Specific Utility MIB with Information

To use a SLAX script to populate the enterprise-specific Utility MIB with information:

  1. Enable the services-oids-slax script.

  2. Configure the maximum amount of memory for the data segment during the execution of the script.

  3. Enable the script.

  4. (Optional) Enable the log-stats argument to allow sys logging of stateful firewall rate statistics when the event-script is run.

    1. Display the event policies and the arguments that can be used.

      The log-stats argument does not appear, so you must enable it.

    2. Start the Linux shell.

    3. Open the /var/db/scripts/event/services-oids-eve-policy.slax file for editing.

    4. Remove the comment enclosures (/* and */) surrounding the <arguments> tags containing “log-stats”.

    5. Exit the Linux shell and return to the CLI.

    6. Load the changes you made to the event script file.

      The log-stats argument is available the next time the event script restarts.

  5. Set up the script logging file services-oids.log.

  6. Synchronize scripts between Routing Engines so that when a switchover of Routing Engine occurs, the event policy starts on the new primary.

    • To synchronize on a per-commit basis:

    • To synchronize scripts every time you execute a commit synchronize:

  7. The script starts automatically at system boot, but you can manually start it with the CLI.

    Table 1 describes the arguments that you can use.

    Table 1: Arguments for services-oids.slax Script

    Argument

    Description

    clean

    A value of 1 clears all Utility MIB OIDs. Use this only to clean OID tables.

    clear-semaphore

    A value of 1 resets the semaphore in the Utility MIB to recover from an abnormal script exit or from a manual script exit.

    debug

    Prints debug messages on console.

    detail

    Displays detailed output.

    interval

    Sets the number of seconds between poll cycles (default is 120).

    invoke-debugger

    Invokes script in debugger mode.

    log-stats

    Yes value enables sys logging of stateful firewall rate statistics (default is no).

    max-polls

    Sets the number of poll cycles before exiting the script (default is 30).

    one-cycle-only

    Value of 1 quits after one cycle of polling. Event policy does not restart the script. Use this option for testing only. The default is 0.

    signal-stop

    A value of 1 stops the script and sets the semaphore, which causes the next iteration to exit.

    silent

    Prints trace messages on console if it is unset. Set it to zero-length string (“ ”) to unset it. Default is 1.

    |

    Pipes through a command.

  8. Check the status of the script from the log file.

  9. Verify that you are getting Utility MIB OID updates.

    To exclude the timestamp information, use

Stopping the SLAX Script with the CLI

To stop the SLAX script from the CLI:

Issue the stop argument.

Clearing the Utility MIB

To clear all the utility MIB OIDs:

Issue the clean argument.

Recovering from an Abnormal SLAX Script Exit or a SLAX Script Exit with the CLI

To recover from an abnormal SLAX script exit or an SLAX script exit with the CLI:

Issue the clear semaphore argument.