Troubleshooting: Verifying NAT Operability

In this article, we will understand how to verify the NAT sessions created on the Versa VOS appliance.

We will see how to use the various show commands and verify the NAT sessions.

To view, the list of NAT sessions use the CLI command show orgs org <org-name> session nat brief | tab

The output below shows two NAT sessions created from the Source IP 172.10.10.4 and getting natted with the IP 10.192.83.26.

admin@Branch-cli> show orgs org Tenant-Org-2 sessions nat brief | tab
                                                                                                                                       NAT     NAT
VSN  VSN  SESS                                SOURCE  DESTINATION                                        NAT SOURCE    NAT             SOURCE  DESTINATION
ID   VID  ID     SOURCE IP    DESTINATION IP  PORT    PORT         PROTOCOL  NATTED  SDWAN  APPLICATION  IP            DESTINATION IP  PORT    PORT
------------------------------------------------------------------------------------------------------------------------------------------------------------
0    2    37898  172.10.10.4  40.77.226.16    49818   443          6         Yes     No     windowslive  10.192.83.26  40.77.226.16    18971   443
0    2    42546  172.10.10.4  157.56.106.189  54866   3544         17        Yes     No     teredo       10.192.83.26  157.56.106.189  11750   3544

To view a list of all NAT sessions that have been created, closed and list of failed attempts run the CLI command show orgs org <org-name> sessions nat summary

admin@Branch-100-DIA-cli> show orgs org Tenant-Org-2 sessions nat summary
     NAT      NAT      NAT      NAT
VSN  SESSION  SESSION  SESSION  SESSION
ID   COUNT    CREATED  CLOSED   FAILED
-----------------------------------------
0    2        1370     1368     0

To view the details of a NAT session, use the CLI command show orgs org <org-name> sessions nat detail

The NAT detail shows important details about the NAT session like Source and Destination IP and the translated NAT source IP. The session also shows that the traffic is being natted by marking it with a ‘Yes‘. The ingress and egress interface details and the NAT rule.

admin@Branch-100-DIA-cli> show orgs org Tenant-Org-2 sessions nat detail
sessions nat detail 0 2 37898
 source-ip                  172.10.10.4
 destination-ip             40.77.226.16
 source-port                49818
 destination-port           443
 protocol                   6
 natted                     Yes
 sdwan                      No
 application                windowslive
 nat-source-ip              10.192.83.26
 nat-destination-ip         40.77.226.16
 nat-source-port            18971
 nat-destination-port       443
 forward-pkt-count          3150
 forward-byte-count         321818
 reverse-pkt-count          1599
 reverse-byte-count         300438
 dropped-forward-pkt-count  0
 dropped-forward-byte-count 0
 dropped-reverse-pkt-count  0
 dropped-reverse-byte-count 0
 session-age                2d18h03m
 idle-for                   00:00:26
 idle-timeout               524
 pbf-enabled                true
 forward-egress-vrf         DIA-Transport-VR
 reverse-egress-vrf         Tenant-Org-2-LAN-VR
 session-provider-zone      0
 forward-offload            false
 reverse-offload            false
 forward-ingress-interface  vni-0/2.0
 forward-egress-interface   vni-0/1.0
 reverse-ingress-interface  vni-0/1.0
 reverse-egress-interface   vni-0/2.0
 forward-fc                 fc_be
 reverse-fc                 fc_be
 forward-plp                low
 reverse-plp                low
 nat-rule-name              DIA-Rule-Tenant-Org-2-LAN-VR-DIA
 nat-direction              inside
sessions nat detail 0 2 42546
 source-ip                  172.10.10.4
 destination-ip             157.56.106.189
 source-port                54866
 destination-port           3544
 protocol                   17
 natted                     Yes
 sdwan                      No
 application                teredo
 nat-source-ip              10.192.83.26
 nat-destination-ip         157.56.106.189
 nat-source-port            11750
 nat-destination-port       3544
 forward-pkt-count          8595
 forward-byte-count         764955
 reverse-pkt-count          8415
 reverse-byte-count         1152855
 dropped-forward-pkt-count  0
 dropped-forward-byte-count 0
 dropped-reverse-pkt-count  0
 dropped-reverse-byte-count 0
 session-age                2d13h23m
 idle-for                   00:00:10
 idle-timeout               32
 pbf-enabled                true
 forward-egress-vrf         DIA-Transport-VR
 reverse-egress-vrf         Tenant-Org-2-LAN-VR
 session-provider-zone      0
 forward-offload            false
 reverse-offload            false
 forward-ingress-interface  vni-0/2.0
 forward-egress-interface   vni-0/1.0
 reverse-ingress-interface  vni-0/1.0
 reverse-egress-interface   vni-0/2.0
 forward-fc                 fc_be
 reverse-fc                 fc_be
 forward-plp                low
 reverse-plp                low
 nat-rule-name              DIA-Rule-Tenant-Org-2-LAN-VR-DIA
 nat-direction              inside

The NAT translations can also be viewed in the Versa Director GUI under the Monitor tab.

Navigate to the Service Tab and click on CGNAT to view the NAT translations. Click on the ‘eye’ icon to view more detailed session information.

Summary

In this article, we saw how to verify NAT operability on Versa VOS using the show commands. We can see that using the information provided in the show command, we can troubleshoot any issues with regard to NAT.