Brief:
After implementing CGN we need the NAT user log information before adding device to production, but we are not receiving anything in the Syslog server using the Syslog information. Configuration so far based on documentation is:
#
nat instance nat1 id 1
service-instance-group group1
nat address-group group1 group-id 1 bind-ip-pool pool1
nat outbound 2900 address-group group1
nat log host 1.1.1.1 514 source 1.1.1.2 20000 name nat1syslog
nat log user enable
#
Error:
N/A. The packets are not received incoming on the syslog server.
Handling Process:
1. Check if there is route between NE and Syslog, we can ping the server because is directly connected to device;
2. By default the NE send the log in txt format so we make sure that the server is also set with this format and not netstream format;
nat log user enable [ { syslog | netstream }[ secondary { syslog | netstream } ] ]
3. Also, by default, the extended format for syslogs is type3, so we make sure that the syslog server is also with default mode; If you wish other format, please use command below:
[~HUAWEI] nat syslog descriptive format [format type]
4. We also initiated nat log session enable as well for more detailed logs;
#
nat instance nat1 id 1
service-instance-group group1
nat address-group group1 group-id 1 bind-ip-pool pool1
nat outbound 2900 address-group group1
nat log host 1.1.1.1 514 source 1.1.1.2 20000 name nat1syslog
nat log user enable
nat log session enable
#
5. Check the "Session log packets" or "User log packets" if increasing by executing multiple times the below command. If the counters are increasing, we could check on the server if syslog packets are received using packet capture but it was not;
<NE40-1>display nat statistics transmitted slot 1 engine 0
This operation will take a few minutes. Press 'Ctrl+C' to break ...
Slot: 1 Engine: 0
---------------------------------------------------------------------------
Packets transmitted to interface :16699702
Packets transmitted to mainboard :16620609
Session log packets transmitted :0
User log packets transmitted :0
Transparent packet with nat :161903
Transparent packet without nat :0
Packets transmitted to remote backup interface :0
---------------------------------------------------------------------------
Root Cause:
After several checking we noticed that there was missing port range command;
Solution:
[~HUAWEI] nat instance cpe1 id 1
[*HUAWEI-nat-instance-cpe1] port-range 1024
