Monitoring CGN, Stateful Firewall, and Softwire Flows
Purpose
Use the following commands to check the creation of the softwires, pre-NAT flows, and post-NAT flows. Output can be filtered using more specific fields such as AFTR or B4 address or both for DS-Lite, and softwire-concentrator or softwire-initiator or both for 6rd.
show services stateful-firewall flows
show services softwire flows
Action
user@host# show services stateful-firewall flows
Interface: sp-0/1/0, Service set: dslite-svc-set2
Flow State Dir Frm count
TCP 200.200.200.2:80 -> 44.44.44.1:1025 Forward O 219942
NAT dest 44.44.44.1:1025 -> 20.20.1.4:1025
Softwire 2001::2 -> 1001::1
TCP 20.20.1.2:1025 -> 200.200.200.2:80 Forward I 110244
NAT source 20.20.1.2:1025 -> 44.44.44.1:1024
Softwire 2001::2 -> 1001::1
TCP 200.200.200.2:80 -> 44.44.44.1:1024 Forward O 219140
NAT dest 44.44.44.1:1024 -> 20.20.1.2:1025
Softwire 2001::2 -> 1001::1
DS-LITE 2001::2 -> 1001::1 Forward I 988729
TCP 200.200.200.2:80 -> 44.44.44.1:1026 Forward O 218906
NAT dest 44.44.44.1:1026 -> 20.20.1.3:1025
Softwire 2001::2 -> 1001::1
TCP 20.20.1.3:1025 -> 200.200.200.2:80 Forward I 110303
NAT source 20.20.1.3:1025 -> 44.44.44.1:1026
Softwire 2001::2 -> 1001::1
TCP 20.20.1.4:1025 -> 200.200.200.2:80 Forward I 110944
NAT source 20.20.1.4:1025 -> 44.44.44.1:1025
Softwire 2001::2 -> 1001::1