Description

This article describes the issue of only pport index 0 being allocated, due to Interface port overloading being off by default.

Symptoms

In 10.2R2, 10.2R3, 10.3R1:

  1. vty command - show usp nat source-pool , does not have any output. After the command - show security nat source pool all is executed from CLI, show usp nat source-pool has output. 
    2. [flowd]FPC7.PIC0(vty)# show usp nat source-pool

root> show security nat source pool all 
Total pools: 0

root@% vty fpc7.pic0
BSD platform (XLR processor, 4095MB memory, 16384KB flash)

[flowd]FPC7.PIC0(vty)# show usp nat source-pool    
Port translation address sticky: Off
Interface port overloading: Off
Port allocation randomization: Off
DIP pool utilization alarm: Disabled, Raise threshold 0%, Clear threshold 0%
  2. The default Interface port overloading is off after rebooting, if nat src pool is not configured. It is set on by using the command -  set security nat source interface port-overloading off twice. With the default Interface port overloading off; only pport index 0 can be allocated. So, only 64510 nat session with single pport can be setup. 
    3. root# run show security nat interface-nat-ports    
Pool   Total  Single ports  Single ports  Twin ports  Twin ports
index  ports     allocated     available   allocated   available
    0  64510            88         63398           0        1024
    1  64510             0         63486           0        1024
    2  64510             0         63486           0        1024
    3  64510             0         63486           0        1024
    4  64510             0         63486           0        1024
    5  64510             0         63486           0        1024
    6  64510             0         63486           0        1024
    7  64510             0         63486           0        1024
    8  64510             0         63486           0        1024
    9  64510             0         63486           0        1024
   10  64510             0         63486           0        1024
   11  64510             0         63486           0        1024
   12  64510             0         63486           0        1024
   13  64510             0         63486           0        1024
   14  64510             0         63486           0        1024
   15  64510             0         63486           0        1024
   16  64510             0         63486           0        1024
   17  64510             0         63486           0        1024
   18  64510             0         63486           0        1024 
   19  64510             0         63486           0        1024
   20  64510             0         63486           0        1024
   21  64510             0         63486           0        1024
   22  64510             0         63486           0        1024
   23  64510             0         63486           0        1024
   24  64510             0         63486           0        1024
   25  64510             0         63486           0        1024
   26  64510             0         63486           0        1024
   27  64510             0         63486           0        1024
   28  64510             0         63486           0        1024
   29  64510             0         63486           0        1024
   30  64510             0         63486           0        1024
   31  64510             0         63486           0        1024

Solution

It is a known issue, which will be fixed in 10.3R3, 10.2R4.

Before the above MR is released, there is a workaround. You can set security nat source pool to have port overloading on, even after rebooting.