> -----Original Message----- > From: Ibariouen Khalid [mailto:[email protected]] > Sent: Sunday, March 28, 2010 2:45 PM > To: [email protected]; [email protected] > Subject: RE: [j-nsp] NAT > > > Hi again > Yes it's untrust interface ; > I'm taking stats every morning and do clear stats; > This mean that during 24 hours I got around 1977 not nat vector. And > it's confusing me
Do a 'get interface ethernet1/3 dip detail' and take a look at what your NAT values are. Is the status listed as Free? Also, I would suggest ratcheting down the timers for your more commonly used protocols (if you've got NSM you can run a report on 'Top FW/VPN Rules' - you might want to try to identify which rules are being used the most and check the applications which are being allowed. Are the timeouts for those applications set at the default? Have they been adjusted? I would suggest lowering them as it sounds like you have sessions which are remaining open and holding on to NAT/PAT allocations without releasing them. Finally, do you have ALGs enabled? Take a look at 'get xlate' and try to identify if there is an issue with failed allocations in an ALG. Stefan Fouant, CISSP, JNCIE-M/T www.shortestpathfirst.net GPG Key ID: 0xB5E3803D _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
