NAT Command Reference

Command Hierarchies

•	ISA Configuration Commands

•	NAT Service Configuration Commands

→	VPRN Commands

•	NAT Subscriber Management Commands

•	NAT Router Configuration Commands

•	Show Commands

•	Filter Commands

•	Show Commands

•	Clear Commands

•	Tools Commands

•	Filter Commands

 

 

ISA Configuration Commands

config

—

isa

—	nat-group nat-group-id [create]

—	no nat-group

—	­active-mda-limit number

—	no ­active-mda-limit

—	­description description-string

—	no ­description

—	[no] ­mda mda-id

—	­radius-accounting-policy nat-accounting-policy

—	no ­radius-accounting-policy

—	­session-limits

—	­reserved num-sessions

—	no ­reserved

—	­watermarks high percentage low percentage

—	no ­watermarks

—	[no] ­shutdown

 

NAT Service Configuration Commands

configure

—

service

—

­nat

—	­deterministic-script

—	­location remote-url

—	no ­location

—	­nat-policy nat-policy-name [create]

—	no ­nat-policy nat-policy-name

—

­alg

—

[no] ­ftp

—	[no] ­rtsp

—

[no] ­sip

—	­block-limit [1..40]

—	no ­block-limit

—	­description description-string

—	no ­description

—	­filtering filtering-mode

—	no ­filtering

—	­ipfix-export-policy [32 chars max]

—	no ­ipfix-export-policy

—	­pool nat-pool-name service-name service-name

—	­pool nat-pool-name router router-instance

—

no ­pool

—	­port-limits

—	­forwarding limit

—	no ­forwarding

—	­reserved num-ports

—	no ­reserved

—	­watermarks high percentage-high low percentage-low

—	no ­watermarks

—	[no] ­priority-sessions

—	[no] ­fc fc-name

—	­session-limits

—	­max num-sessions

—

no ­max

—	­reserved num-sessions

—	no ­reserved

—	­watermarks high percentage-high low percentage-low

—	no ­watermarks

—	­tcp-mss-adjust segment-size

—	no ­tcp-mss-adjust

—	[no] ­timeouts

—	­icmp-query [min minutes] [sec<seconds]

—	no ­icmp-query

—	­sip min minutes] [sec<seconds]

—

no ­sip

—	­subscriber-retention [hrs hours] [min minutes]

—	no ­subscriber-retention

—	­tcp-established [hrs hours] [min minutes] [sec seconds]

—	no ­tcp-established

—	­tcp-syn [hrs hours] [min minutes] [sec seconds]

—	no ­tcp-syn

—	­tcp-time-wait [min minutes] [sec seconds]

—	no ­tcp-time-wait

—	­tcp-transitory [hrs hours] [min minutes] [sec seconds]

—	no ­tcp-transitory

—	­udp [hrs hours] [min minutes] [sec seconds]

—

no ­udp

—	­udp-dns [hrs hours] [min minutes] [sec seconds]

—	no ­udp-dns

—	­udp-initial [min minutes] [sec seconds]

—	no ­udp-initial

—	[no] ­udp-inbound-refresh

 

 

configure

—

service

—

­ipfix

—	­ipfix-export-policy policy-name [create]

—	no ­ipfix-export-policy policy-name

—	­collector router router-instance ip ip-address [create]

—	no ­collector router router-instance ip ip-address

—	­mtu [512..9212]

—	no ­collector

—	[no] ­shutdown

—	­source-address ip-address

—	no ­source-address

—	­template-refresh-timeout [hrs hours] [min minutes] [sec seconds]

—	no ­template-refresh-timeout

—	­description description-string

—	no ­description

 

 

 

configure

—

aaa

—	­nat-accounting-policy policy-name [create]

—	no ­nat-accounting-policy policy-name

—	­description description-string

—	no ­description

—	[no] ­include-radius-attribute

—	[no] ­called-station-i

—	[no] ­frame-counters

—	[no] ­framed-ip-addr

—	[no] ­hardware-timestamp

—	[no] ­inside-service-id

—	[no] ­multi-session-id

—	[no] ­nas-identifier

—	[no] ­nat-subscriber-string

—	[no] ­octet-counters

—	[no] ­outside-ip

—	[no] ­outside-service-id

—	[no] ­port-range-block

—	[no] ­release-reason

—	[no] ­session-time

—	[no] ­subscriber-data

—	[no] ­user-name

—	­radius-accounting-server

—	­access-algorithm {direct|round-robin}

—	no ­access-algorithm

—	­retry count

—

no ­retry

—	­router router-instance

—	­router service-name service-name

—	no ­router

—	­server server-index address ip-address secret key [hash|hash2] [port port]

—	no ­server server-index

—	­source-address-range start-ip-address end-ip-address

—	no ­source-address-range

—	­timeout [sec seconds] [min minutes]

—	no ­timeout

 

 

VPRN Commands

config

—

service

—	vprn service-id customer cust-id create

—

­nat

—

­inside

—	[no] ­destination-prefix ip-prefix/length

—	­deterministic

—	­classic-lsn-max-subscriber-limit max

—	no ­classic-lsn-max-subscriber-limit

—	­dslite-max-subscriber-limit max

—	no ­dslite-max-subscriber-limit

—	­prefix ip-prefix/length subscriber-type nat-sub-type nat-policy nat-policy-name [create]

—	­prefix ip-prefix/length subscriber-type nat-sub-type

—	no ­prefix ip-prefix/length subscriber-type nat-sub-type

—	­map start inside-ip-address end inside-ip-address to outside-ip-address

—	no ­map start inside-ip-address end inside-ip-address

—	[no] shutdown

—	­dual-stack-lite

—	[no] ­address ipv6-address

—	­ip-fragmentation {disabled|fragment-ipv6|fragment-ipv6-unless-ipv4-df-set}

—	no ­ip-fragmentation

—	­tunnel-mtu mtu-bytes

—	no ­tunnel-mtu

—	[no] ­shutdown

—	­subscriber-prefix-length prefix-length

—	no ­subscriber-prefix-length

—

­l2-aware

—	[no] ­address ip-address/mask

—	­nat-policy nat-policy-name

—	no ­nat-policy

—	|[no] ­nat64

—	[no] ­drop-zero-ipv4-checksum

—	[no] ­ignore-tos

—	[no] ­insert-ipv6-fragment-header

—	­ip-fragmentation {disabled|fragment-ipv6|fragment-ipv6-unless-ipv4-df-set}

—	no ­ip-fragmentation

—	­ipv6-mtu [1280..9212]

—	no ­ipv6-mtu

—	­prefix ipv6-prefix/prefix-length

—	no ­prefix

—	­set-tos [0..255]

—	no ­set-tos

—	[no] ­shutdown

—	­subscriber-prefix-length prefix-length

—	no ­subscriber-prefix-length

—	­redundancy

—	­peer ip-address

—

no ­peer

—	­steering-route ip-prefix/length

—	no ­steering-route

—

­outside

—	­mtu [512..9000]

—

no ­mtu

—	­pool nat-pool-name [nat-group nat-group-id type pool-type create]

—	no ­pool nat-pool-name

—	­address-range start-ip-address end-ip-address [create]

—	no ­address-range start-ip-address end-ip-address

—	­description description-string

—	no ­description

—	[no] ­drain

—	­description description-string

—	no ­description

—	­deterministic

—	­port-reservation num-ports

—	no ­port-reservation

—	­mode {auto|napt|one-to-one}

—

no ­mode

—	[no] ­port-forwarding-dyn-block-reservation

—	­port-forwarding-range range-end

—	no ­port-forwarding-range

—	­port-reservation blocks num-blocks

—	­port-reservation ports num-ports

—	no ­port-reservation

—	[no] ­shutdown

—	­subscriber-limit [1..65535]

—	no ­subscriber-limit

—	­watermarks high percentage-high low percentage-low

—	no ­watermarks

—	­upstream-ip-filter filter-id

—	no ­upstream-ip-filter

 

 

NAT Subscriber Management Commands

configure

—	subscriber-mgmt

—	sub-profile

—	­nat-policy policy-name

—	no ­nat-policy

 

 

NAT Router Configuration Commands

 

config

—

router

—

­nat

—

­inside

—	[no] ­destination-prefix ip-prefix/length

—	­dual-stack-lite

—	[no] ­address ipv6-address

—	­tunnel-mtu mtu-bytes

—	no ­tunnel-mtu

—	­ip-fragmentation {disabled|fragment-ipv6|fragment-ipv6-unless-ipv4-df-set}

—	no ­ip-fragmentation

—	[no] ­shutdown

—	­subscriber-prefix-length prefix-length

—	no ­subscriber-prefix-length

—

­l2-aware

—	[no] ­address ip-address/mask

—	­nat-policy nat-policy-name

—	no ­nat-policy

—	|[no] ­nat64

—	[no] ­drop-zero-ipv4-checksum

—	[no] ­ignore-tos

—	[no] ­insert-ipv6-fragment-header

—	­ip-fragmentation {disabled|fragment-ipv6|fragment-ipv6-unless-ipv4-df-set}

—	no ­ip-fragmentation

—	­ipv6-mtu [1280..9212]

—	no ­ipv6-mtu

—	­prefix ipv6-prefix/prefix-length

—	no ­prefix

—	­set-tos [0..255]

—	no ­set-tos

—	[no] ­shutdown

—	­subscriber-prefix-length prefix-length

—	no ­subscriber-prefix-length

—	­redundancy

—	­peer ip-address

—

no ­peer

—	­steering-route ip-prefix/length

—	no ­steering-route

—	­subscriber-identification

—	­attribute [vendor vendor-id] attribute-type attribute-type

—	no ­attribute

—	­description description-string

—	no ­description

—	[no] ­drop-unidentified-traffic

—	­radius-proxy-server router router-instance name server-name

—	no ­radius-proxy-server

—	[no] ­shutdown

—

­outside

—	­mtu [512..9000]

—

no ­mtu

—	­pool nat-pool-name [nat-group nat-group-id type pool-type create]

—	no ­pool nat-pool-name

—	­address-range start-ip-address end-ip-address [create]

—	no ­address-range start-ip-address end-ip-address

—	­description description-string

—	no ­description

—	[no] ­drain

—	­description description-string

—	no ­description

—	­mode {auto | napt | one-to-one}

—

no ­mode

—	[no] ­port-forwarding-dyn-block-reservation

—	­port-forwarding-range range-end

—	no ­port-forwarding-range

—	­port-reservation blocks num-blocks

—	­port-reservation ports num-ports

—	no ­port-reservation

—	­redundancy

—	­export ip-prefix/length

—	no ­export

—	­monitor ip-prefix/length

—	no ­monitor

—	[no] ­shutdown

—	­subscriber-limit [1..65535]

—	no ­subscriber-limit

—	­watermarks high percentage-high low percentage-low

—	no ­watermarks

 

 

NAT Admin Configuration Commands

admin

—

nat

—	­save-deterministic-script

 

 

Tools Commands

tools

—

dump

—

nat

—	histogram router router-instance pool pool-name bucket-size [1..65536] num-buckets [2..50]

 

Show Commands

 

show

—

aaa

—	­nat-accounting-policy

—	­nat-accounting-policy policy-name

—	­nat-accounting-policy policy-name associations

—	­nat-accounting-policy

—

isa

—	­nat-group

—	­nat-group nat-group-id [associations]

—	­nat-group nat-group-id member [1..255] [statistics]

—	­nat-group [nat-group-id] members

—

service

—

­nat

—	­l2-aware-hosts [outside-router router-instance] [outside-ip outside-ip-address] [inside-ip-prefix ip-prefix/mask]

—	­l2-aware-subscribers [nat-policy nat-policy-name] [nat-group nat-group-id] [member [1..255]] [outside-router router-instance] [outside-ip outside-ip-address]

—	­l2-aware-subscribers subscriber sub-ident

—	­nat-policy nat-policy-name associations

—	­nat-policy nat-policy-name statistics

—	­nat-policy nat-policy-name

—	­nat-policy

—	­pcp-server-policy

—	­pcp-server-policy name

—	­port-forwarding-entries

 

show

—

router

—

­nat

—	­dual-stack-lite-subscribers subscriber dslite-sub-id

—	­dual-stack-lite-subscribers [nat-policy nat-policy-name] [nat-group nat-group-id] [member [1..255]] [outside-router router-instance] [outside-ip outside-ip-address] [inside-ip-prefix ipv6-prefix]

—	­l2-aware-blocks [outside-ip-prefix ip-prefix/length] [outside-port [1..65535]] [pool pool-name]

—	­lsn-blocks [inside-router router-instance] [inside-ip ip-address] [outside-ip-prefix ip-prefix/length] [outside-port [1..65535]] [pool pool-name]

—	­lsn-hosts host ip-address

—	­lsn-hosts [outside-router router-instance] [outside-ip ip-address] [inside-ip-prefix ip-prefix/mask]

—	­pool pool-name

—

­pool

—

­summary

 

Clear Commands

clear

—

nat

—

isa

—	­nat-group nat-group-id member [1..255] l2-aware-subscribers

—	­nat-group nat-group-id member [1..255] statistics

 

Tools Commands

 

tools

—

dump

—

­nat

—

­isa

—	­resources mda mda-id

—	­sessions [nat-group nat-group-id] [mda mda-id] [protocol {icmp|tcp|udp}] [inside-ip ip-address] [inside-router router-instance] [inside-port port-number] [outside-ip ip-address] [outside-port port-number] [foreign-ip ip-address] [foreign-port port-number]

—

perform

—

­nat

—	­port-forwarding-action

—	­l2-aware create subscriber sub-ident-string ip ip-address protocol {tcp|udp} [port port] lifetime lifetime [outside-ip ip-address] [outside-port port]

—	­l2-aware delete subscriber sub-ident-string ip ip-address protocol {tcp|udp} port port

—	­l2-aware modify subscriber sub-ident-string ip ip-address protocol {tcp|udp} port port lifetime lifetime

—	­lsn create router router-instance [b4 ipv6-address] [aftr ipv6-address] ip ip-address protocol {tcp|udp} [port port] lifetime lifetime [outside-ip ipv4-address] [outside-port port]

—	­lsn delete router router-instance [b4 ipv6-address] ip ip-address protocol {tcp|udp} port port

—	­lsn modify router router-instance [b4 ipv6-address] ip ip-address protocol {tcp|udp} port port lifetime lifetime

 

Filter Commands

 

configure

—

filter

—	ip-filter filter-id

—	entry entry-id

—	­action nat

—	no ­action