In DS-Lite+NAT scenario with prefix-length=56 , NAT sessions may be failed due to port block limit is being exceeded . issue seen with the below configuration using SPC3
set services nat source pool <*> port block-allocation block-size 512 set services nat source pool <*> port block-allocation maximum-blocks-per-host 20 set services nat source pool <*> port block-allocation active-block-timeout 0 set services service-set <*> softwire-options dslite-ipv6-prefix-length 56
NAT sessions failure due to port block limit is being exceeded (i.e 20 blocks per customer in our configuration). ports are not released properly from the block from previous user sessions. old sessions are related to ALG translation context (i.e active/passive FTP sessions). Nat session failures can be tracked using the below command
user@router> show services nat source pool <*> | match "Port blocks limit exceeded errors" Port blocks limit exceeded errors : 5505344 Port blocks limit exceeded errors : 5505400 <<<<<<this counter is increasing
also port release/freeing can be tracked using the below command
user@router>show services nat source port-block pool <*> | match "XXXX:XXXX:XXXX:XXXX::" <<<<<<match user IPv6 subnet Host_IP External_IP Port_Block Ports_Used/ Block_State/ XXXX:XXXX:XXXX:XXXX:: X.X.X.X 49664-50175 512/512*1 Inactive/- <<<<<<<<all the blocks are full from old sessions which was already closed XXXX:XXXX:XXXX:XXXX:: X.X.X.X 56832-57343 512/512*1 Inactive/- XXXX:XXXX:XXXX:XXXX:: X.X.X.X 5632-6143 512/512*1 Inactive/- XXXX:XXXX:XXXX:XXXX:: X.X.X.X 11776-12287 512/512*1 Inactive/- <..>
This issue happens only during freeing of ALG Translation context due to failure in Subscriber lookup when prefix length 56 is configured. customer need to fix the issue using :
1- as workaround , customer need to modify DSlite prefix-length from 56 to 64
set services service-set <*> softwire-options dslite-ipv6-prefix-length 64
OR
2- customer need to have Junos with the fix of PR1785403