ip nat ager cpu占用率高

[kingisme]

213616820 7136657 29932 95.75% 95.52% 95.33% 0 IP NAT Ager
Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.3(3)M4, RELEASE SOFTWARE (fc2)
也做了ip nat translation max-entries ，IP NAT Ager进程的CPU还是降不下来

[bo chen · Accepted solution]

kingisme 发表于 2019-11-20 15:29
#show ip nat statistics
Total active translations: 1390 (0 static, 1390 dynamic; 1390 extended)
...

ip nat translation max-entries all-host 300
把这条命令敲上才可以看到。

[bo chen]

首先瞻仰一下C1900系列路由器，没见过实体真机。
鉴于这种问题我是这样来尝试解决。
ip nat translation timeout 180
ip nat translation tcp-timeout 180
ip nat translation udp-timeout 80
ip nat translation syn-timeout 10
ip nat translation icmp-timeout 20
ip nat translation max-entries 6000
ip nat translation max-entries all-host 300
先通过这些命令来限制nat的session
再通过sh ip nat statistics 来查看每个host的missed，记录其中数值最大的几个host。
定位几台嫌疑host后，针对host进行抓包，查毒或者重装系统。
希望我的回答能帮助你。{:2_27:}

[kingisme]

CSCO12178277 发表于 2019-11-19 14:44
首先瞻仰一下C1900系列路由器，没见过实体真机。
鉴于这种问题我是这样来尝试解决。
ip nat translation ...

Hits: 22924772 Misses: 0
Misses信息是0:'(

[bo chen]

kingisme 发表于 2019-11-20 08:43
Hits: 22924772 Misses: 0
Misses信息是0

不是看总数，是看下面所有host的参数。{:3_51:}

[kingisme]

CSCO12178277 发表于 2019-11-20 09:44
不是看总数，是看下面所有host的参数。

#show ip nat statistics
Total active translations: 1390 (0 static, 1390 dynamic; 1390 extended)
Peak translations: 2306, occurred 03:44:04 ago
Outside interfaces:
GigabitEthernet0/0, Dialer1, Virtual-Access2
Inside interfaces:
GigabitEthernet0/1
Hits: 37262689 Misses: 0
CEF Translated packets: 37181944, CEF Punted packets: 158860
Expired translations: 311287
Dynamic mappings:
-- Inside Source
[Id: 1] route-map nonat interface Dialer1 refcount 1390
Total doors: 0
Appl doors: 0
Normal doors: 0
Queued Packets: 0

[18653465190]

:o:o:o:o已经解决了？是NAT的问题吗？解决方案是升级IOS吗？