High-Speed Logging for NAT
Network Address Translation (NAT) supports high-speed logging (HSL) for upto 4 destinations. When HSL is configured, NAT provides a log of the packets flowing through the routing devices (similar to the Version 9 NetFlow-like records) to an external collector. Records are sent for each binding (binding is the address binding between the local address and the global address to which the local address is translated) and when sessions are created and destroyed. Session records contain the full 5-tuple of information (the source IP address, destination IP address, source port, destination port, and protocol). A tuple is an ordered list of elements. NAT also sends an HSL message when a NAT pool runs out of addresses (also called pool exhaustion ). Because the pool exhaustion messages are rate limited, each packet that hits the pool exhaustion condition does not trigger an HSL message.
The table below describes the templates for HSL bind and session create or destroy.
Field |
Format |
ID |
Value |
||
---|---|---|---|---|---|
Source IP address |
IPv4 address |
8 |
varies |
||
Translated source IP address |
IPv4 address |
225 |
varies |
||
Destination IP address |
IPv4 address |
12 |
varies |
||
Translated destination IP address |
IPv4 address |
226 |
varies |
||
Original source port |
16-bit port |
7 |
varies |
||
Translated source port |
16-bit port |
227 |
varies |
||
Original destination port |
16-bit port |
11 |
varies |
||
Translated destination port |
16-bit port |
228 |
varies |
||
Virtual routing and forwarding (VRF) ID |
32-bit ID |
234 |
varies |
||
Protocol |
8-bit value |
4 |
varies |
||
Event |
8-bit value |
230 |
0-Invalid 1-Adds event 2-Deletes event |
||
Unix timestamp in milliseconds |
64-bit value |
323 |
|
The table below describes the HSL pool exhaustion templates.
Field |
Format |
ID |
Values |
---|---|---|---|
NAT pool ID |
32-bit value |
283 |
varies |
NAT event |
8-bit value |
230 |
3-Pool exhaust |