Customer has noticed that some CGNAT routers have an increasing out-of-address counter and also they are showing 0 available addresses in each mams-interface when checking the NAT pool utilization.
op@R1> show services nat pool AMS0_NAT44 detail
Interface: mams-0/0/0 (ams0), Service set: IPV4_AMS0
NAT pool: AMS0_NAT44, Translation type: DYNAMIC NAT44
Address range: 1.128.128.1-1.128.133.85
Address range: 1.128.255.249-1.128.255.254
Available addresses: 0
Out of address errors: 784552, Addresses in use: 1371
Interface: mams-0/1/0 (ams0), Service set: IPV4_AMS0
Address range: 1.128.133.86-1.128.138.170
Out of address errors: 766774, Addresses in use: 1365
Interface: mams-0/2/0 (ams0), Service set: IPV4_AMS0
Address range: 1.128.138.171-1.128.143.255
Out of address errors: 643207, Addresses in use: 1365
Interface: mams-0/3/0 (ams0), Service set: IPV4_AMS0
Address range: 1.128.144.0-1.128.149.84
Out of address errors: 765112, Addresses in use: 1365
Here's the config of the NAT pool and NAT rule, dynamic NAT44 type of natting (source address translation) for the following traffic types has been used.
op@R1> show configuration applications application-set AMS0_NAT44
application IPSEC_UDP_10000;
application IPSEC_UDP_10001;
application IPSEC_UDP_42001;
application junos-ike;
application IPSEC_NAT_T;
application junos-h323;
application junos-smtp;
application SMTPS_TCP_465;
application MSA_TCP_587;
application junos-sip;
{master}
op@R1> show configuration services nat pool AMS0_NAT44 | display set
set services nat pool AMS0_NAT44 address 1.128.128.0/17
set services nat pool AMS0_NAT44 snmp-trap-thresholds address-port low 60
set services nat pool AMS0_NAT44 snmp-trap-thresholds address-port high 80
op@R1> show configuration services nat rule AMS0_NAT44 | display set
set services nat rule AMS0_NAT44 match-direction input
set services nat rule AMS0_NAT44 term NGP from source-address 10.5.138.64/26
set services nat rule AMS0_NAT44 term NGP from source-address 10.4.188.64/26
set services nat rule AMS0_NAT44 term NGP from source-address 10.4.56.64/26
set services nat rule AMS0_NAT44 term NGP then translated source-pool NGP_NAT44
set services nat rule AMS0_NAT44 term NGP then translated translation-type dynamic-nat44
set services nat rule AMS0_NAT44 term MS_MOBILE from source-prefix-list MS_MOBILE
set services nat rule AMS0_NAT44 term MS_MOBILE from application-sets MS_MOBILE_PORTS_UDP
set services nat rule AMS0_NAT44 term MS_MOBILE from application-sets MS_MOBILE_PORTS_TCP
set services nat rule AMS0_NAT44 term MS_MOBILE then translated source-pool AMS0_NAT44
set services nat rule AMS0_NAT44 term MS_MOBILE then translated translation-type dynamic-nat44
set services nat rule AMS0_NAT44 term CATCH_ALL_OR from source-address 10.0.0.0/8
set services nat rule AMS0_NAT44 term CATCH_ALL_OR from source-address 9.0.0.0/8
set services nat rule AMS0_NAT44 term CATCH_ALL_OR from source-address 100.64.0.0/10
set services nat rule AMS0_NAT44 term CATCH_ALL_OR from source-address 21.0.0.0/8
set services nat rule AMS0_NAT44 term CATCH_ALL_OR from source-address 22.0.0.0/8
set services nat rule AMS0_NAT44 term CATCH_ALL_OR from source-address 26.0.0.0/8
set services nat rule AMS0_NAT44 term CATCH_ALL_OR from application-sets AMS0_NAT44
set services nat rule AMS0_NAT44 term CATCH_ALL_OR then translated source-pool AMS0_NAT44
set services nat rule AMS0_NAT44 term CATCH_ALL_OR then translated translation-type dynamic-nat44
set services nat rule AMS0_NAT44 term CATCH_ALL_OR then translated secure-nat-mapping mapping-refresh outbound
set services nat rule AMS0_NAT44 term DESTINATIONS from destination-prefix-list NAT44_DESTINATIONS_PREFIXES
set services nat rule AMS0_NAT44 term DESTINATIONS from application-sets NAT44_DESTINATIONS
set services nat rule AMS0_NAT44 term DESTINATIONS then translated source-pool AMS0_NAT44
set services nat rule AMS0_NAT44 term DESTINATIONS then translated translation-type dynamic-nat44
When customer checked in the debug shell, there had hundreds of stale NAT mappings for SIP traffic as below. The mappings were not cleared after the SIP traffic was ended.
Bucket index 1921 entry index 1
Side1 (C2S): IP address 10.189.64.109 IP port 5060 svc set id 19 sw_src_addr :: protocol 0 flag 0x3
Side2 (S2C): IP address 1.128.176.235 IP port 5060 svc set id 19 sw_src_addr :: protocol 0 flag 0x1
ref count 4 pool id 42 mapping timeout 300000 mapping_state 4 flags 0x6 mapping time remaining 0
As can be seen above, the mapping time is '0' but the mapping is still active.
CGNAT pool with large number of out-of-address errors and stale NAT mappings for SIP traffic
Customer disabled the CGNAT for SIP traffic and stopped the errors.
The root cause of this issue had been identified by Juniper engineering team. A fix is under going at the time of this KB written.