NAT Command Reference

Command Hierarchies

•	ISA Configuration Commands

•	NAT Service Configuration Commands

→	IPFIX Commands

→	UPnP Commands

→	ISA RADIUS Policy Commands

→	VPRN Commands

•	NAT Subscriber Management Commands

•	NAT Router Configuration Commands

•	Show Commands

•	Filter Commands

•	Show Commands

•	Clear Commands

•	Tools Commands

•	Filter Commands

 

 

ISA Configuration Commands

config

—

isa

—	nat-group nat-group-id [create]

—	no nat-group

—	active-mda-limit number

—	no active-mda-limit

—	description description-string

—	no description

—	failed-mda-limit [1..2]

—	no failed-mda-limit

—	[no] mda mda-id

—	radius-accounting-policy nat-accounting-policy

—	no radius-accounting-policy

—	redundancy {active-active|active-standby}

—	no redundancy

—	session-limitssession-limits

—	reserved num-sessions

—	no reserved

—	watermarks high percentage low percentage

—	no watermarks

—	[no] shutdown

 

NAT Service Configuration Commands

configure

—

service

—

nat

—	deterministic-script

—	location remote-url

—	no location

—	session-limits

—	reserved num-ports

—	no reserved

—	watermarks high percentage low percentage

—	no watermarks

—	nat-policy nat-policy-name [create]

—	no nat-policy nat-policy-name

—

alg

—

[no] ftp

—

[no] pptp

—

[no] rtsp

—

[no] sip

—	block-limit [1..40]

—	no block-limit

—	description description-string

—	no description

—	filtering filtering-mode

—	no filtering

—	ipfix-export-policy [32 chars max]

—	no ipfix-export-policy

—	pool nat-pool-name service-name service-name

—	pool nat-pool-name router router-instance

—

no pool

—	port-limits

—	forwarding limit

—	no forwarding

—	reserved num-ports

—	no reserved

—	watermarks high percentage-high low percentage-low

—	no watermarks

—	[no] priority-sessions

—	[no] fc fc-name

—	session-limits

—	max num-sessions

—

no max

—	reserved num-sessions

—	no reserved

—	watermarks high percentage-high low percentage-low

—	no watermarks

—	tcp-mss-adjust segment-size

—	no tcp-mss-adjust

—	[no] timeouts

—	icmp-query [min minutes] [sec<seconds]

—	no icmp-query

—	sip min minutes] [sec<seconds]

—

no sip

—	subscriber-retention [hrs hours] [min minutes]

—	no subscriber-retention

—	tcp-established [hrs hours] [min minutes] [sec seconds]

—	no tcp-established

—	tcp-syn [hrs hours] [min minutes] [sec seconds]

—	no tcp-syn

—	tcp-time-wait [min minutes] [sec seconds]

—	no tcp-time-wait

—	tcp-transitory [hrs hours] [min minutes] [sec seconds]

—	no tcp-transitory

—	udp [hrs hours] [min minutes] [sec seconds]

—

no udp

—	udp-dns [hrs hours] [min minutes] [sec seconds]

—	no udp-dns

—	udp-initial [min minutes] [sec seconds]

—	no udp-initial

—	[no] udp-inbound-refresh

—	pcp-server-policy name [create]

—	no pcp-server-policy name

—	description description-string

—	no description

—	lifetime minimum [60..86399] maximum [61..86400]

—	no lifetime

—	max-description-size size

—	no max-description-size

—	[no] opcode

—	[no] announce

—

[no] get

—

[no] map

—	[no] option

—	[no] description

—

[no] next

—	[no] port-reservation

—	[no] prefer-failure

—	[no] third-party

—	version minimum [1..255] maximum [1..255]

—	no version

 

IPFIX Commands

configure

—

service

—

ipfix

—	ipfix-export-policy policy-name [create]

—	no ipfix-export-policy policy-name

—	collector router router-instance ip ip-address [create]

—	no collector router router-instance ip ip-address

—	mtu [512..9212]

—	no collector

—	[no] shutdown

—	source-address ip-address

—	no source-address

—	template-refresh-timeout [hrs hours] [min minutes] [sec seconds]

—	no template-refresh-timeout

—	description description-string

—	no description

 

UPnP Commands

configure

—

service

—

upnp

—	upnp-policy policy-name [create]

—	no upnp-policy policy-name

—	description description-string

—	no description

—	http-listening-port [1..65535]

—	no http-listening-port

—	mapping-limit [1..256]

—	no mapping-limit

—	[no] strict-mode

 

configure

—	subscriber-management

—	sub-profile subscriber-profile-name [create]

—	no sub-profile subscriber-profile-name

—	upnp-policy policy-name

—	no upnp-policy

 

ISA RADIUS Policy Commands

configure

—

aaa

—	isa-radius-policy name [create]

—	no isa-radius-policy name

—	[no] acct-include-attributes

—	[no] acct-delay-time

—	[no] acct-trigger-reason

—	[no] called-station-id

—	[no] calling-station-id

—	[no] circuit-id

—	[no] dhcp-options

—	[no] dhcp6-options

—	[no] dhcp-vendor-class-id

—	[no] frame-counters

—	[no] framed-ip-addr

—	[no] framed-ip-netmask

—	[no] framed-ipv6-prefix

—	[no] hardware-timestamp

—	[no] inside-service-id

—	[no] ipv6-address

—	[no] mac-address

—	[no] multi-session-id

—	[no] nas-identifier

—	[no] nas-port-id

—	[no] nas-port-type

—	[no] nat-subscriber-string

—	[no] octet-counters

—	[no] outside-ip

—	[no] outside-service-id

—	[no] port-range-block

—	[no] release-reason

—	[no] remote-id

—	[no] session-time

—	[no] subscriber-data

—	[no] subscriber-id

—	[no] ue-creation-type

—	[no] user-name

—	[no] wifi-rssi

—	[no] wifi-ssid-vlan

—	acct-update-triggers

—	[no] address-state

—	[no] auth-include-attributes

—	[no] called-station-id

—	[no] calling-station-id

—	[no] circuit-id

—	[no] dhcp-options

—	[no] dhcp-vendor-class-id

—	[no] dhcp6-options

—	[no] framed-ip-addr

—	[no] ipv6-address

—	[no] mac-address

—	[no] nas-identifier

—	[no] nas-port-id

—	[no] nas-port-type

—	[no] remote-id

—	[no] wifi-ssid-vlan

—	description description-string

—	no description

—	nas-ip-address-origin {isa-ip|system-ip}

—	no nas-ip-address-origin

—	password password [hash|hash2]

—	no password

—

servers

—	access-algorithm {direct|round-robin|hash-based}

—	no access-algorithm

—	retry count

—

no retry

—	router router-instance

—	router service-name service-name

—

no router

—	server server-index [create]

—	no server server-index

—	accounting [port udp-port]

—	no accounting

—	authentication [port udp-port]

—	no authentication

—	coa [port udp-port]

—

no coa

—	ip-address ip-address

—	no ip-address

—	secret secret-key | hash-key [hash|hash2]

—

no secret

—	[no] shutdown

—	source-address-range start-ip-address

—	no source-address-range

—	timeout [sec seconds] [min minutes]

—	no timeout

—	user-name-format user-name-format [mac-format mac-format]

—	no user-name-format

 

VPRN Commands

config

—

service

—	vprn service-id customer cust-id create

—

nat

—

inside

—	[no] destination-prefix ip-prefix/length

—	deterministic

—	classic-lsn-max-subscriber-limit max

—	no classic-lsn-max-subscriber-limit

—	dslite-max-subscriber-limit max

—	no dslite-max-subscriber-limit

—	prefix ip-prefix/length subscriber-type nat-sub-type nat-policy nat-policy-name [create]

—	prefix ip-prefix/length subscriber-type nat-sub-type

—	no prefix ip-prefix/length subscriber-type nat-sub-type

—	map start inside-ip-address end inside-ip-address to outside-ip-address

—	no map start inside-ip-address end inside-ip-address

—	[no] shutdown

—	dual-stack-lite

—	[no] address ipv6-address

—	ip-fragmentation {disabled|fragment-ipv6|fragment-ipv6-unless-ipv4-df-set}

—	no ip-fragmentation

—	tunnel-mtu mtu-bytes

—	no tunnel-mtu

—	[no] shutdown

—	subscriber-prefix-length prefix-length

—	no subscriber-prefix-length

—

l2-aware

—	[no] address ip-address/mask

—	nat-policy nat-policy-name

—	no nat-policy

—	[no] nat64

—	[no] drop-zero-ipv4-checksum

—	[no] ignore-tos

—	[no] insert-ipv6-fragment-header

—	ip-fragmentation {disabled|fragment-ipv6|fragment-ipv6-unless-ipv4-df-set}

—	no ip-fragmentation

—	ipv6-mtu [1280..9212]

—	no ipv6-mtu

—	prefix ipv6-prefix/prefix-length

—

no prefix

—	set-tos [0..255]

—	no set-tos

—	[no] shutdown

—	subscriber-prefix-length prefix-length

—	no subscriber-prefix-length

—	redundancy

—	peer ip-address

—

no peer

—	peer6 ip-address

—

no peer6

—	steering-route ip-prefix/length

—	no steering-route

—

outside

—	downstream-ip-filter filter-id

—	no downstream-ip-filter

—	downstream-ipv6-filter filter-id

—	no downstream-ipv6-filter

—	mtu [512..9000]

—

no mtu

—	pool nat-pool-name [nat-group nat-group-id type pool-type [applications applications ] create]

—	no pool nat-pool-name

—	address-range start-ip-address end-ip-address [create]

—	no address-range start-ip-address end-ip-address

—	description description-string

—	no description

—	[no] drain

—	description description-string

—	no description

—	deterministic

—	port-reservation num-ports

—	no port-reservation

—	mode {auto|napt|one-to-one}

—

no mode

—	[no] port-forwarding-dyn-block-reservation

—	port-forwarding-range range-end

—	no port-forwarding-range

—	port-reservation blocks num-blocks

—	port-reservation ports num-ports

—	no port-reservation

—	redundancy

—	export ip-prefix/length

—

no export

—	follow router router-instance pool name

—

no follow

—	monitor ip-prefix/length

—	no monitor

—	[no] shutdown

—	[no] shutdown

—	subscriber-limit [1..65535]

—	no subscriber-limit

—	watermarks high percentage-high low percentage-low

—	no watermarks

—	upstream-ip-filter filter-id

—	no upstream-ip-filter

—	upstream-ipv6-filter filter-id

—	no upstream-ipv6-filter

 

 

NAT Subscriber Management Commands

configure

—	subscriber-mgmt

—	sub-profile subscriber-profile-name [create]

—	no sub-profile subscriber-profile-name

—	nat-policy policy-name

—	no nat-policy

 

NAT Router Configuration Commands

config

—

router

—

nat

—

inside

—	[no] destination-prefix ip-prefix/length

—	deterministic

—	classic-lsn-max-subscriber-limit max

—	no classic-lsn-max-subscriber-limit

—	dslite-max-subscriber-limit max

—	no dslite-max-subscriber-limit

—	prefix prefix/ip-prefix-length subscriber-type nat-sub-type nat-policy nat-policy-name [create]

—	prefix ip-prefix/ip-prefix-length subscriber-type nat-sub-type

—	no prefix ip-prefix/ip-prefix-length subscriber-type nat-sub-type

—	map start lsn-sub-address end lsn-sub-address to outside-ip-address

—	no map start lsn-sub-address end lsn-sub-address

—	[no] shutdown

—	dual-stack-lite

—	[no] address ipv6-address

—	tunnel-mtu mtu-bytes

—	no tunnel-mtu

—	ip-fragmentation {disabled|fragment-ipv6|fragment-ipv6-unless-ipv4-df-set}

—	no ip-fragmentation

—	[no] shutdown

—	subscriber-prefix-length prefix-length

—	no subscriber-prefix-length

—

l2-aware

—	[no] address ip-address/mask

—	nat-policy nat-policy-name

—	no nat-policy

—	|[no] nat64

—	[no] drop-zero-ipv4-checksum

—	[no] ignore-tos

—	[no] insert-ipv6-fragment-header

—	ip-fragmentation {disabled|fragment-ipv6|fragment-ipv6-unless-ipv4-df-set}

—	no ip-fragmentation

—	ipv6-mtu [1280..9212]

—	no ipv6-mtu

—	prefix ipv6-prefix/prefix-length

—

no prefix

—	set-tos [0..255]

—	no set-tos

—	[no] shutdown

—	subscriber-prefix-length prefix-length

—	no subscriber-prefix-length

—	redundancy

—	peer ip-address

—

no peer

—	peer6 ip-address

—

no peer6

—	steering-route ip-prefix/length

—	no steering-route

—	subscriber-identification

—	attribute [vendor vendor-id] attribute-type attribute-type

—	no attribute

—	description description-string

—	no description

—	[no] drop-unidentified-traffic

—	radius-proxy-server router router-instance name server-name

—	no radius-proxy-server

—	[no] shutdown

—

outside

—	downstream-ip-filter filter-id

—	no downstream-ip-filter

—	downstream-ipv6-filter filter-id

—	no downstream-ipv6-filter

—	mtu [512..9000]

—

no mtu

—	pool nat-pool-name [nat-group nat-group-id type pool-type create]

—	no pool nat-pool-name

—	address-range start-ip-address end-ip-address [create]

—	no address-range start-ip-address end-ip-address

—	description description-string

—	no description

—	[no] drain

—	description description-string

—	no description

—	mode {auto | napt | one-to-one}

—

no mode

—	[no] port-forwarding-dyn-block-reservation

—	port-forwarding-range range-end

—	no port-forwarding-range

—	port-reservation blocks num-blocks

—	port-reservation ports num-ports

—	no port-reservation

—	redundancy

—	export ip-prefix/length

—

no export

—	follow router router-instance pool name

—

no follow

—	monitor ip-prefix/length

—	no monitor

—	[no] shutdown

—	subscriber-limit [1..65535]

—	no subscriber-limit

—	watermarks high percentage-high low percentage-low

—	no watermarks

—	upstream-ipv6-filter filter-id

—	no upstream-ipv6-filter

 

 

NAT Admin Configuration Commands

admin

—

nat

—	save-deterministic-script

 

 

Tools Commands

tools

—

dump

—

nat

—	histogram router router-instance pool pool-name bucket-size [1..65536] num-buckets [2..50]

 

Show Commands

 

show

—

aaa

—	nat-accounting-policy

—	nat-accounting-policy policy-name

—	nat-accounting-policy policy-name associations

—	nat-accounting-policy

—

isa

—

nat-group

—	nat-group nat-group-id [associations]

—	nat-group nat-group-id statistics mda mda-id

—	nat-group nat-group-id member [1..255]

—	nat-group nat-group-id member [1..255] reassembly-statistics

—	nat-group nat-group-id member [1..255] statistics

—	nat-group [nat-group-id] members

—

service

—

nat

—	l2-aware-hosts [outside-router router-instance] [outside-ip outside-ip-address] [inside-ip-prefix ip-prefix/mask]

—	l2-aware-subscribers [nat-policy nat-policy-name] [nat-group nat-group-id] [member [1..255]] [outside-router router-instance] [outside-ip outside-ip-address]

—	l2-aware-subscribers subscriber sub-ident

—	nat-policy nat-policy-name associations

—	nat-policy nat-policy-name statistics

—	nat-policy nat-policy-name

—	nat-policy

—	pcp-server-policy

—	pcp-server-policy name

—	port-forwarding-entries

—

upnp

—	upnp-policy policy-name

—	upnp-policy policy-name statistics

—	upnp-policy

 

show

—

router

—

nat

—	dual-stack-lite-subscribers subscriber dslite-sub-id

—	dual-stack-lite-subscribers [nat-policy nat-policy-name] [nat-group nat-group-id] [member [1..255]] [outside-router router-instance] [outside-ip outside-ip-address] [inside-ip-prefix ipv6-prefix]

—	l2-aware-blocks [outside-ip-prefix ip-prefix/length] [outside-port [1..65535]] [pool pool-name]

—	lsn-blocks [inside-router router-instance] [inside-ip ip-address] [outside-ip-prefix ip-prefix/length] [outside-port [1..65535]] [pool pool-name]

—	lsn-hosts host ip-address

—	lsn-hosts [outside-router router-instance] [outside-ip ip-address] [inside-ip-prefix ip-prefix/mask]

—	pool pool-name

—

pool

—

summary

 

Clear Commands

clear

—

nat

—	upnp-mappings subscriber sub-ident-string protocol {tcp|udp} outside-port port-number

—	upnp-mappings subscriber sub-ident-string

—	upnp-policy-statistics policy-name

—

isa

—	nat-group nat-group-id member [1..255] l2-aware-subscribers

—	nat-group nat-group-id member [1..255] statistics

 

Tools Commands

 

tools

—

dump

—

nat

—

isa

—	resources mda mda-id

—

sessions [nat-group nat-group-id] [mda mda-id] [protocol {gre|icmp| tcp|udp}] [inside-ip ip-address] [inside-router router-instance] [inside-port port-number] [outside-ip ipv4-address] [outside-port port-number] [foreign-ip ipv4-address] [foreign-port port-number] [dslite-address ipv6-address] [wlan-gw-ue ieee-address] [next-index index] [upnp]

—

perform

—

nat

—	port-forwarding-action

—	l2-aware create subscriber sub-ident-string ip ip-address protocol {tcp|udp} [port port] lifetime lifetime [outside-ip ip-address] [outside-port port]

—	l2-aware delete subscriber sub-ident-string ip ip-address protocol {tcp|udp} port port

—	l2-aware modify subscriber sub-ident-string ip ip-address protocol {tcp|udp} port port lifetime lifetime

—	lsn create router router-instance [b4 ipv6-address] [aftr ipv6-address] ip ip-address protocol {tcp|udp} [port port] lifetime lifetime [outside-ip ipv4-address] [outside-port port]

—	lsn delete router router-instance [b4 ipv6-address] ip ip-address protocol {tcp|udp} port port

—	lsn modify router router-instance [b4 ipv6-address] ip ip-address protocol {tcp|udp} port port lifetime lifetime

 

Filter Commands

 

configure

—

filter

—	ip-filter filter-id

—	ipv6-filter filter-id

—	entry entry-id

—	action nat [nat-policy-name nat-policy-name]

—

no action