background image
352 Chapter 11: Scaling IP Addresses with NAT
To troubleshoot NAT, you can use the debug ip nat command. The output from this command
shows which addresses were translated and, for a TCP connection, what the transaction
numbers are. The output in Example 11-10 shows a sample output from a NAT debug.
The translation is shown clearly from the source address to the destination and the reverse
communications. The * indicates that the translation was done in the fast path or by using cache.
To watch and debug this output in real time would be daunting at best. The number in brackets
indicates the sequencing number for a TCP session that could be useful for debugging a
protocol analyzer trace of the session.
The administrator can shut down a translated session using the clear command for ip nat. The
syntax for clearing a simple NAT translation is as follows:
clear ip nat translation inside global-ip-address local-ip-address
The administrator must type the addresses without error to clear the correct translation session.
Any typographical error in the command syntax can clear the wrong session! It is also possible
to clear all current translated sessions on the router by using this command:
clear ip nat translation *
The use of the asterisk (*) as a wildcard clears all currently established NAT sessions. The use
of this command might be needed on a periodic basis to clear out any hung NAT sessions. It is
common practice at some sites to clear all translations at the end of Friday to allow all tables a
chance to reset.
Port Address Translation
PAT is a form of NAT in which the port is also replaced at the translating device. PAT is the only
address translation feature for the Cisco 700 series router. Only a minor treatment of the PAT
syntax was discussed in both the CMTD and BCRAN course material. In addition, PAT was not
discussed in the 700 series router chapter, so some additional 700 series commands need to be
discussed here.
Example 11-10
Troubleshooting a NAT Installation with debug ip nat
Router#debug ip nat
NAT: s=10.1.0.1->12.1.3.2, d=155.5.5.5 [1]
NAT: s=155.5.5.5, d=12.1.3.2->10.1.0.1 [1]
NAT: s=10.1.0.1->12.1.3.2, d=155.5.5.5 [2]
NAT*: s=155.5.5.5, d=12.1.3.2->10.1.0.1 [2]
!Additional output omitted...............