NAT Errors [Add nat user data fail(Search Public Addr Fail)]

Hi user_3896063,
You can run the display nat instance [ instance-name ] command to check the configuration of a NAT instance.

You can run the display nat address-usage [ by-session ] instance instance-name address-group address-group-name [ slot slot-id { engine engine-id | card card-id } ] [ verbose ] command to check the public port usage of a NAT address pool.

You can compare this with the basic NAT configuration in the product documentation. Please refer to https://support.huawei.com/hedex/hdx.do?docid=EDOC1100136152&id=EN-US_TASK_0172374489&lang=en

Finally, I found a case for your reference.

Fault Description

After the NAT service is configured on an NE40E, some users fail to go online.

Troubleshooting Procedure

Run the display aaa online-fail-record command to check causes for user access failures.

The user fails to go online because they fail to receive a public IP address.

Check the public IP address and port number of the user.

The port range size is 4096. Each public IP address is assigned 16 (65536/4096) port segments, and there are 256 public IP addresses. Therefore, at most 4096 (256 x 16) users can obtain the port segment.

Check the ACL configuration. Check that fewer than 4096 private network users are allowed access, and the ratio between public and private IP addresses does not exceed the limit.

The private IP address of the user is 10.1.1.1, which is not defined in ACL 3001. Therefore, the user fails to be assigned a public IP address because the private IP address 10.1.1.1 does not match the ACL.

Summary

The private network segment is not specified in the ACL. As a result, the NAT service board fails to find a matching public IP address and the user fails to go online.

I hope it helps!