Cisco ASR 5000 Series - Firewall-And-NAT Policy

Network Address Translation Overview
NAT Feature Overview ▀
Cisco ASR 5000 Series Product Overview ▄
OL-22938-02
SN1-NAT-IP-Address
Important: For SN1-NAT-IP-Address, this release supports VSA-Type values 0 and 1.
For a successful query, the CoA ACK response contains the following attributes:
Acct-Session-Id
Correlation-Id
Framed-IP-Address
NAT-IP-Address
NAT-Port-Block-End
NAT-Port-Block-Start
User-Name
Important: For information on the AVPs/VSAs, please refer to the AAA Interface Administration and Reference.
Firewall-and-NAT Policy
Firewall-and-NAT policies are configured in the CLI Firewall-and-NAT Policy Configuration Mode. Each policy
contains a set of access ruledefs with priorities and actions, and the NAT configurations. On a system, multiple such
policies can be configured, however at any point of time only one policy is associated to a subscriber.
Important: In StarOS 8.x, NAT for CDMA and early UMTS releases used rulebase-based configurations,
whereas in later UMTS releases NAT used policy-based configurations. In StarOS 9.0 and later releases, NAT for
UMTS and CDMA releases both use policy-based configurations. For more information, please contact your local
service representative.
Important: In a Firewall-and-NAT policy, a maximum of three NAT IP pools/NAT IP pool groups can be
configured. A subscriber can be allocated only one NAT IP address per NAT IP pool/NAT IP pool group, hence at
anytime, there can only be a maximum of three NAT IP addresses allocated to a subscriber.
New NAT IP pools/NAT IP pool groups cannot be added to a policy if the maximum allowed is already configured in it.
However, a pool/pool group can be removed and then a new one added. When a pool/pool group is removed and a new
one added, the pool/pool group that was removed will stay associated with the subscriber as long as the subscriber has
active flows using that pool/pool group. If the subscriber is already associated with three NAT IP pools (maximum
allowed), any new flows from that subscriber for the newly added pool will be dropped. A deleted pool is disassociated
from the subscriber on termination of all flows from that subscriber using that pool. The new pool/pool group is
associated with the subscriber only when the subscriber sends a packet to the newly added pool.