NAT translations

aleksander · Post by **aleksander** » Wed Nov 17, 2004 6:49 am

Does anyone knows how to capture NAT translations on Cisco router with SNMP and insert it in to Cacti?

Thx
Aleksander

Post by **rony** » Wed Nov 17, 2004 10:51 am

For the purpose of?

aleksander · Post by **aleksander** » Thu Nov 18, 2004 3:36 am

If there is a lot od translations you could assume that you have a virus or some program that is sending some traffic through the router.

Post by **rony** » Thu Nov 18, 2004 9:19 am

Oh, so you just want a count.

I'm not sure if that information is exposed in the Cisco MIB for the routers.

What version of IOS and hardware is this router. I can try to do some research.

If anyone else know, please do tell...

aleksander · Post by **aleksander** » Fri Nov 19, 2004 3:08 am

This is Soho91 router. IOS: soho91-k9oy6-mz.123-2.T8.bin

I give you also sh ver:

Cisco Internetwork Operating System Software
IOS (tm) SOHO91 Software (SOHO91-K9OY6-M), Version 12.3(2)T8, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2004 by cisco Systems, Inc.
Compiled Fri 03-Sep-04 09:47 by eaarmas
Image text-base: 0x800131D8, data-base: 0x80A1A60C

ROM: System Bootstrap, Version 12.2(8r)YN, RELEASE SOFTWARE (fc1)
ROM: SOHO91 Software (SOHO91-K9OY6-M), Version 12.3(2)T8, RELEASE SOFTWARE (fc3)

HOME uptime is 3 days, 3 hours, 32 minutes
System returned to ROM by power-on
System restarted at 05:34:54 CET Tue Nov 16 2004
System image file is "flash:soho91-k9oy6-mz.123-2.T8.bin"

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

CISCO SOHO91 (MPC857DSL) processor (revision 0x200) with 29492K/3276K bytes of memory.
Processor board ID AMB07100744 (3120780318), with hardware revision 0000
CPU rev number 7
Bridging software.
2 Ethernet/IEEE 802.3 interface(s)
128K bytes of non-volatile configuration memory.
8192K bytes of processor board System flash (Read/Write)
2048K bytes of processor board Web flash (Read/Write)

Configuration register is 0x2102

sohailb · Post by **sohailb** » Wed Feb 08, 2006 3:06 am

I know this is an old thread, but I have been requested to graph nat translations as well. The request was nat translations over time. A total is what I am in need of.

Any ideas? I searched around quite a bit for this and can not find much or anything really.

Thanks

BSOD2600 · Post by **BSOD2600** » Wed Feb 08, 2006 2:35 pm

I bet the data is there via the IOS which can be accessed via telnet/ssh. Could take my ZyXEL NAT script/template and modify it to do the same for Cisco.

knobdy · Post by **knobdy** » Thu Feb 09, 2006 10:02 am

BSOD2600 wrote:I bet the data is there via the IOS which can be accessed via telnet/ssh. Could take my ZyXEL NAT script/template and modify it to do the same for Cisco.

Interesting. One question though, why use PHP rather than Perl (with the telnet module)? Would one be faster than the other? I have several scripts that log into my cisco boxes, which I only hacked on (don't really know any language) to serve my purposes. If there's no serious perfomance loss I might borrow your way of doing this...

mforrest · Post by **mforrest** » Thu Feb 09, 2006 10:55 am

This is something i've got to do and after a brief look around the cisco site, came back with (have not tested this yet, but seems like it should work) :-

Object: alNatStatsActiveTranslations
OID: 1.3.6.1.4.1.3076.2.1.2.23.1.4

http://tools.cisco.com/Support/SNMP/do/ ... 1.2.23.1.4

From the above link, you can browse about to find any other stats you might want

knobdy · Post by **knobdy** » Thu Feb 09, 2006 11:30 am

That's in the altigaMIB. I'm not sure what all devices support it, but I think the only things we have are VPN concentrators.

There's also an altigaRoot. but I can't find anything that supports it either - in my environment... <searching>

Another one is ciscoIetfNatMIB OID 1.3.6.1.4.1.9.10.77 - but again, not in our environment.

fla_roadkill · Post by **fla_roadkill** » Mon Feb 27, 2006 4:28 pm

Any new information on this? To graph this would be great, as the original poster suggested for Virus's and Worms

mader · Post by **mader** » Thu Mar 09, 2006 9:10 am

Try this OID 1.3.6.1.4.1.9.10.77.1.2.3
http://tools.cisco.com/Support/SNMP/do/ ... icked=true

NAT translations

NAT translations

Who is online