CG-NAT and NAT (Service 11)

Product Description

DPI

To ensure that a subscriber receives their designated public address, the pool must contain at least as many addresses as there are worker threads (typically 2 for SSG-6 and 4 for SSG-10 and higher). You can determine the number of worker threads with the command

expr $(ps -p `pidof fastdpi` H -o comm | grep wrk | wc -l) / $(ps -p `pidof fastdpi` H -o comm | grep rx | wc -l)

If the pool contains only one address, it may not be assigned to all subscribers but only to those who fit the load balancing algorithm.

fdpi_ctrl list status --service 11 --ip 192.168.4.20
Parameter descriptions at this link

SSG

lifetime_flow_long=600 — lifetime in seconds of inactive TCP sessions

lifetime_flow=60 — lifetime in seconds of other sessions

These parameters should not be set to excessively large values, as the session table may grow too large, impacting CG-NAT performance, and the subscriber may run out of session limits (set in the nat pool parameters).

tcp keep-alive

tcp keep-alive

Example/etc/ssh/ssh_config

ServerAliveInterval 60

Example~/.ssh/config

Host * ServerAliveInterval 60
ssh -o TCPKeepAlive=yes -o ServerAliveInterval=60 user@example.com

Example/etc/sysctl.conf

net.ipv4.tcp_keepalive_time = 600 net.ipv4.tcp_keepalive_intvl = 60 net.ipv4.tcp_keepalive_probes = 20
It is recommended to maintain a ratio from 1:10 (better) to 1:100 (worse).

When Service 11 is enabled for a subscriber, a Public IP is assigned based on the distribution algorithm

When a subscriber starts establishing sessions, ports are taken from the common SSG DPI queue and assigned with certain timeouts

If a specific Public IP has many subscribers competing for free ports, subscribers may experience access issues.

Subscribers under blocking (Service 5 + policing) should be placed in a separate NAT Pool to avoid impacting active subscribers. For instance, an iPhone may establish many sessions searching for an active service.

Create sparse pools and separate clients into different NAT Pools by type: individuals and corporate users.

Monitor clients generating high load and work with them. For receiving, processing, and storing NetFlow from DPI, we suggest using the QoE Store software product for statistics collection and the DPIUI2 graphical interface. You can analyze subscriber traffic and conclude that their PC is infected.

Parameter descriptions at this link

Changing the session limit:

fdpi_ctrl load profile --service 11 --profile.name test_nat_2000 --profile.json '{ "nat_ip_pool" : "111.111.111.0/24", "nat_tcp_max_sessions" : 2000, "nat_udp_max_sessions" : 2000, "nat_type" : 0 }'

Use the pool creation command identical to the previous one but with different nat_tcp_max_sessions and nat_udp_max_sessions settings.

Adding additional addresses to the pool:

fdpi_ctrl load profile --service 11 --profile.name test_nat_2000 --profile.json '{ "nat_ip_pool" : "111.111.111.0/24,222.222.222.0/25", "nat_tcp_max_sessions" : 2000, "nat_udp_max_sessions" : 2000, "nat_type" : 0 }'

Use the pool creation command identical to the previous one but with an additional pool specified by a comma.

Reducing the pool

The current version does not support dynamic pool size reduction and address exclusion. In this case, you will need to free the pool, delete it, and create it with new parameters.
yum install epel-release yum-utils yum-config-manager --disable epel yum --enablerepo epel install jq
fdpi_ctrl list all --service 11 --profile.name test_nat_4000 --outformat json | jq '.lservices[] | .login | select(. != null)' > save_users.txt fdpi_ctrl list all --service 11 --profile.name test_nat_4000 --outformat json | jq -r '.lservices[] | .ipv4 | select(. != null)' >> save_users.txt fdpi_ctrl del all --service 11 --profile.name test_nat_4000 fdpi_ctrl del profile --service 11 --profile.name test_nat_4000 fdpi_ctrl load profile --service 11 --profile.name test_nat_4000 --profile.json '{ "nat_ip_pool" : "111.111.111.0/30", "nat_tcp_max_sessions" : 4000, "nat_udp_max_sessions" : 4000, "nat_type" : 0 }' fdpi_ctrl load --service 11 --profile.name test_nat_4000 --file save_users.txt
The method described below is inactive when rx_dispatcher=1

DPI

subscriber_public_address & mask = subscriber_private_address & mask

with 4 working threads, mask=3 (typical for SSG >= 10)

with 2 working threads, mask=1 (typical for SSG <= 6)

SSG

DPI

grep nat_hash_mask /var/log/dpi/fastdpi_alert.log

service fastdpi reload

Thus, this partially deterministic distribution scheme essentially assumes that private addresses will also be statically assigned to the subscriber. In cases where a specific public IP address is specified in the contract and the current private address of the subscriber does not fit the formula mentioned above, it will be necessary to change the subscriber's private address to one that matches the formula.

Example for SSG-20:

Assign the address to the subscriber with the command:

fdpi_ctrl load profile --ip 10.0.0.15 --service 11 --profile.json '{ "nat_ip_pool" : "188.99.99.27/32", "nat_type" : 1 }'

Parameter description via this link
Parameter description via this link

1) The requirement is not relevant if rx_dispatcher=1 or rx_dispatcher=2

type_profile=1, ref_cnt=0 d3 { "nat_ip_pool" : "1.1.2.0/28,1.1.3.0/28", "nat_tcp_max_sessions" : 2000, "nat_udp_max_sessions" : 2000, "nat_type" : 0 } 11 (0x400)

type_profile=1, ref_cnt=0 d3 { "nat_ip_pool" : "1.1.2.0/28,1.1.3.0/26", "nat_tcp_max_sessions" : 2000, "nat_udp_max_sessions" : 2000, "nat_type" : 0 } 11 (0x400)

fdpi_ctrl list all status --service 11 --profile.name nat_pool |grep whiteip|cut -f7|sort|uniq -c|sort -n

fdpi_ctrl list all status --service 11 --profile.name nat_pool | awk 'BEGIN {FS="[=| }\t]+"} $15>$P {print $1, $14, $15}' | wc -l

fdpi_ctrl list all status --service 11 --profile.name nat_pool |grep whiteip|cut -f7|cut -d"." -f1,2,3|sort|uniq -c|sort -n