Re: [vpp-dev] nat with multiple in single out

Hi, Please use "set interface nat44 in loop0 in loop1 in loop2 in loop3 out BondEthernet0" (you should set your one outside NAT interface only once). Regards, Matus -Original Message- From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Carlito Nueno Sent

Re: [vpp-dev] nat64 local ping problem

, Matus From: Juan Salmon [mailto:salmonju...@gmail.com] Sent: Thursday, January 11, 2018 10:08 AM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) Cc: vpp-dev@lists.fd.io Subject: Re: [vpp-dev] nat64 local ping problem I run with following configuration: set int state

Re: [vpp-dev] nat64 local ping problem

Hi Juan, What do you mean by that? Do you have packet trace? Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Juan Salmon Sent: Thursday, January 11, 2018 8:45 AM To: vpp-dev@lists.fd.io Subject: [vpp-dev] nat64 local ping problem Hi, Does nat

Re: [vpp-dev] problem in enabling nat44 and nat64 simultaneously

Hi, NAT plugin currently doesn’t support same output interface for NAT44 and NAT64. Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Juan Salmon Sent: Tuesday, January 9, 2018 9:07 AM To: vpp-dev@lists.fd.io Subject: [vpp-dev] problem in enabling nat44

Re: [vpp-dev] The performance problem of NAT plugin

Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) Cc: vpp-dev@lists.fd.io Subject: Re: The performance problem of NAT plugin I find that when I use NAT , the ARP is abnormal; AS, I use the 3.3.3.5 as the NAT pool address: nat44 add address 3.3.3.5 On target NIC(3.3.3.1), the tcpdump can

Re: [vpp-dev] The performance problem of NAT plugin

Hi, Could you please provide your full startup config? I will try reproduce issue and fix it. Regards, Matus From: 李洪亮 [mailto:lihongli...@360.cn] Sent: Thursday, December 28, 2017 5:09 PM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) Cc: vpp-dev@lists.fd.io Subject: Re

Re: [vpp-dev] The performance problem of NAT plugin

translations 10.16.81.61: 1 dynamic translations, 0 static translations 10.16.81.205: 1 dynamic translations, 0 static translations 10.16.83.191: 2 dynamic translations, 0 static translations 发件人: "Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco)" mailto:matfa...

Re: [vpp-dev] The performance problem of NAT plugin

Hi, What is your VPP version? From output you provided I see some NAT sessions. Could you please provide “show node counters” output and interface counters? I tested NAT plugin with 10K sessions and packet rate was over 10Mpps (2 interfaces and 2 worker threads). Regards, Matus From: vpp-dev

Re: [vpp-dev] Deprecate [S]NAT APIs

Old SNAT APIs removed https://gerrit.fd.io/r/#/c/9617/ Matus -Original Message- From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Ole Troan Sent: Monday, November 20, 2017 8:54 PM To: Jon Loeliger Cc: vpp-dev@lists.fd.io Subject: Re: [vpp-dev] Deprecate

Re: [vpp-dev] IKE & IPsec configuration example

Hi Yang Here is example configuration https://wiki.fd.io/view/VPP/IPSec_and_IKEv2#Example_configuration_2 Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Yang, Xiaowen 1. (NSB - CN/Hangzhou) Sent: Wednesday, November 22, 2017 10:35 AM To: vpp-

Re: [vpp-dev] nat44 address pool not fully used

From: Yuliang Li [mailto:yuliang...@yale.edu] Sent: Monday, October 30, 2017 8:21 PM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) Cc: vpp-dev@lists.fd.io Subject: Re: [vpp-dev] nat44 address pool not fully used Here are the results: CountNode

Re: [vpp-dev] nat44 address pool not fully used

Hi, Are you on latest? Could you please provide “show node counters” output. Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Yuliang Li Sent: Saturday, October 28, 2017 8:48 PM To: vpp-dev@lists.fd.io Subject: [vpp-dev] nat44 address pool not

Re: [vpp-dev] syslog in snat

ed for 17.07? I see it mentioned on the release plan wiki(https://wiki.fd.io/view/Projects/vpp/Release_Plans/Release_Plan_17.07) but not on the snat work list(https://wiki.fd.io/view/VPP/SNAT). Thanks On Tue, May 23, 2017 at 10:45 PM, Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisc

Re: [vpp-dev] Invalid NAT addresses with 17.10rc

Hi, 17.10 has new CLI syntax after plugin was renamed https://wiki.fd.io/view/VPP/NAT#CLI From your show command output I see same external address for both ICMP translations (172.56.0.2) Regards, Matus -Original Message- From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@list

Re: [vpp-dev] NAT plugin -- Input ACL support before NAT and Multiple outside interfaces

Hi, Your use case is not supported now, you can configure multiple outside interfaces but it has very limited usage, “multiple outside interfaces” is in work list https://wiki.fd.io/view/VPP/NAT#Work_list. Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] O

Re: [vpp-dev] snat and fragmented packet

Hi, NAT plugin currently doesn't support fragmented packet translation, but it is currently under development (https://gerrit.fd.io/r/#/c/8056/). Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of yug...@telincn.com Sent: Monday, September 4, 20

Re: [vpp-dev] VPP S-NAT rename

I’ve fixed link in jira. Matus From: Jim Thompson [mailto:j...@netgate.com] Sent: Wednesday, August 23, 2017 11:40 PM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) Cc: vpp-dev Subject: Re: [vpp-dev] VPP S-NAT rename there is also some impact in jira https://jira.fd.io

Re: [vpp-dev] VPP S-NAT rename

Hi, I’ve updated NAT plugin wiki page https://wiki.fd.io/view/VPP/NAT after renaming. Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Ed Warnicke Sent: Monday, August 21, 2017 6:03 PM To: Marek Gradzki -X (mgradzki - PANTHEON TECHNOLOGIES at

Re: [vpp-dev] Workers for SNAT may compete for the same outside address and port?

https://gerrit.fd.io/r/#/c/7893/ Regards, Matus From: yug...@telincn.com [mailto:yug...@telincn.com] Sent: Thursday, August 3, 2017 1:27 PM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) ; chupenghong ; vpp-dev Subject: Re: Re: [vpp-dev] Workers for SNAT may compete for the

Re: [vpp-dev] Workers for SNAT may compete for the same outside address and port?

Hi, You are right, there is a chance to allocate same outside address and port pair for different users. I will fix it (assign a block of port numbers to each worker). Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of chupenghong Sent: Wednesd

Re: [vpp-dev] stop handoff in SNAT

right and handoff is faster than locking Matus From: Yuliang Li [mailto:yuliang...@yale.edu] Sent: Friday, July 21, 2017 12:48 AM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) Cc: vpp-dev@lists.fd.io Subject: Re: [vpp-dev] stop handoff in SNAT I think I get the reason. If

Re: [vpp-dev] stop handoff in SNAT

Hi, You need handoff when running multithread because traffic for specific inside network user must be processed always on same thread in both directions. Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Yuliang Li Sent: Thursday, July 20, 2017

Re: [vpp-dev] det nat expire

Hi, Life time (expire time) is updated when packet is translated, session expire only when no packets are processed. Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of yug...@telincn.com Sent: Thursday, June 15, 2017 10:07 AM To: vpp-dev Subject

Re: [vpp-dev] SNAT problem between users

Hi, There is bug in hairpinning code for ICMP protocol, TCP/UDP should work, I will fix it. Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Denis Lotarev via vpp-dev Sent: Tuesday, May 30, 2017 2:01 PM To: vpp-dev@lists.fd.io Subject: [vpp-de

Re: [vpp-dev] IPSEC IPV6

Hi, IPSec AH (authentication only) is not supported. Regards, Matus From: 薛欣颖 [mailto:xy...@fiberhome.com] Sent: Friday, May 26, 2017 7:51 AM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) ; vpp-dev Subject: 回复: RE: [vpp-dev] IPSEC IPV6 Hi Matus, In https://wiki.fd.io/view

Re: [vpp-dev] syslog in snat

Hi, I find bug when you use custom src-port, template is sent to configured port but data use default port 4793. I will fix it. Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) Sent

Re: [vpp-dev] syslog in snat

, On Wed, May 24, 2017 at 10:15 AM, Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) mailto:matfa...@cisco.com>> wrote: Hi, Snat plugin doesn’t support syslog logging, currently support only IPFIX. Regards, Matus From: vpp-dev-boun...@lists.fd.io<mailto:vpp-dev-boun...@li

Re: [vpp-dev] syslog in snat

Hi, Snat plugin doesn’t support syslog logging, currently support only IPFIX. Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Matt Paska Sent: Tuesday, May 23, 2017 8:23 PM To: vpp-dev@lists.fd.io; Jim Thompson Cc: Andrew Taylor Subject: Re:

Re: [vpp-dev] IPSEC IPV6

[mailto:xy...@fiberhome.com] Sent: Monday, May 22, 2017 8:09 AM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) ; vpp-dev Subject: 回复: RE: [vpp-dev] IPSEC IPV6 Hi Matus, There is only ip4 address in create_ipsec_tunnel_command_fn and ipsec_add_del_tunnel_args_t if (unformat

Re: [vpp-dev] five tuple nat

Hi, You probably use older VPP version, ICMP support for deterministic NAT was added later on Apr 11 (https://gerrit.fd.io/r/#/c/6031/). Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of yug...@telincn.com Sent: Sunday, May 21, 2017 5:32 AM To:

Re: [vpp-dev] IPSEC IPV6

Hi, IPSec has IPv6 support, see examples here https://wiki.fd.io/view/VPP/IPSec_and_IKEv2#IPSec and use IPv6 adresses instead of IPv4. Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of ??? Sent: Saturday, May 20, 2017 8:05 AM To: vpp-dev@lists.

Re: [vpp-dev] SNAT deterministic crash

Sent: Monday, May 15, 2017 8:10 AM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) ; vpp-dev Subject: Re: RE: [vpp-dev] SNAT deterministic crash Hi, Do we have any plan to allocate memory dynamicly, i mean use the memory when it needed in the packets forwarding proc

Re: [vpp-dev] snat crash

https://wiki.fd.io/view/VPP/Command-line_Arguments#.22heapsize.22_parameter Matus From: yug...@telincn.com [mailto:yug...@telincn.com] Sent: Monday, May 15, 2017 7:51 AM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) ; vpp-dev Subject: Re: RE: [vpp-dev] snat crash Hi, You me

Re: [vpp-dev] SNAT deterministic crash

Hi, Deterministic mode of SNAT plugin prealocate memory for 1000 session slots (one session 15B) for each host from inside network range, you need approximately 10GB for sessions vector. You need to set heap size in VPP startup configuration with heapsize parameter. Regards, Matus From: vpp-

Re: [vpp-dev] snat crash

Hi, Deterministic mode of SNAT plugin prealocate memory for 1000 session slots (one session 15B) for each host from inside network range, so fo /16 network you need approximately 10GB memory for sessions vector. This require to compile VPP with 64 bit vector (-DCLIB_VEC64) and add heapsize para

Re: [vpp-dev] SNAT 64bit performance issue

Hi, If you want use SNAT plugin with large number of users try to use CGN/deterministic mode https://wiki.fd.io/view/VPP/SNAT#CGN_-_deterministic_NAT Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Juan Salmon Sent: Wednesday, May 3, 2017 8:01

Re: [vpp-dev] An issue about SNAT when using different in and out interfaces

s From: Ni, Hongjun [mailto:hongjun...@intel.com] Sent: Tuesday, April 25, 2017 7:51 AM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) ; vpp-dev@lists.fd.io Cc: nsh_sfc-...@lists.fd.io Subject: RE: [vpp-dev] An issue about SNAT when using different in and out interfaces Hi M

Re: [vpp-dev] An issue about SNAT when using different in and out interfaces

Hi, It looks like there is some bug when snat interface doesn't have address (if snat interfaces have address it works fine). I will fix issue. Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Ni, Hongjun Sent: Tuesday, April 25, 2017 6:05 AM T

Re: [vpp-dev] what's wrong with my ipsec tunnel mode test?

Hi, Probably missing following config in vpp ipsec policy add spd 1 priority 100 inbound action bypass protocol 50 ipsec policy add spd 1 priority 100 outbound action bypass protocol 50 If it not help please provide HOST A (ubuntu) config too. Regards, Matus __

Re: [vpp-dev] api to get swIdx.

Hi, sw_interface_dump has name filter and reply sw_interface_details contains sw_if_index Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Sharath Sent: Thursday, April 13, 2017 7:15 AM To: vpp-dev@lists.fd.io Subject: [vpp-dev] api to get swIdx. HI,

Re: [vpp-dev] snat -- multiple outside interfaces

Hi, You can configure multiple outside interface with SNAT plugin feature (you can specify only outside interface and you can enter out/in multiple times in CLI command) set interface snat out GigabitEthernet0/8/0 out GigabitEthernet0/9/0 or set interface snat out GigabitEthernet0/8/0 set int

Re: [vpp-dev] SNAT Future API Questions

Hi, There is currently work on dump API for SNAT runtime data (users and sessions). It will be finished in next few days. Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of Jon Loeliger Sent: Wednesday, February 22, 2017 9:42 PM To: vpp-dev Subject: [vp

Re: [vpp-dev] SNAT API Question

Hi Jon, comments inline, Matus From: Jon Loeliger [mailto:j...@netgate.com] Sent: Monday, February 20, 2017 9:14 PM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) Cc: vpp-dev Subject: Re: [vpp-dev] SNAT API Question Hi Matus, Thanks for your answers here. On Sat, Feb 18

Re: [vpp-dev] SNAT API Question

09 PM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) Cc: vpp-dev Subject: Re: [vpp-dev] SNAT API Question On Tue, Feb 14, 2017 at 11:52 PM, Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) mailto:matfa...@cisco.com>> wrote: Hi Jon, snat_static_mapping_dum

Re: [vpp-dev] SNAT API Question

Hi Jon, snat_static_mapping_dump list only static mappings with resolved outside address so snat_static_mapping_details doesn’t contain external_sw_if_index. But we missing read API for static mappigs with unresolved outside address, I will add those to snat_static_mapping_dump too. Thanks, Ma

Re: [vpp-dev] Verify job failures due to external IP address lookup

Hi, same issue https://gerrit.fd.io/r/#/c/4966/ Regards, Matus Fabian Engineer - Software matfa...@cisco.com Tel: Cisco Systems, Inc. Slovakia cisco.com [http://www.cisco.com/assets/swa/img/thinkbeforeyouprint.gif]Think before you print. This email may conta

Re: [vpp-dev] SNAT Plugin Use

You should use SNAT plugin like all other plugins. Documentation for SNAT plugin is here https://wiki.fd.io/view/VPP/SNAT Regards, Matus Fabian Engineer - Software matfa...@cisco.com Tel: Cisco Systems, Inc. Slovakia cisco.com [http://www.cisco.com/assets/swa/

Re: [vpp-dev] SNAT and tap for SSH problem

Hi, please try latest VPP code, https://gerrit.fd.io/r/#/c/4751/ should fix your problem. Regards, [banner3a1] Matus Fabian Engineer - Software matfa...@cisco.com Tel: Cisco Systems, Inc. Slovakia cisco.com [http://www.cisco.com/assets/swa/img/thinkbeforeyoup

Re: [vpp-dev] snat multi-thread support problem

Tue, Dec 20, 2016 at 1:27 PM, Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) mailto:matfa...@cisco.com>> wrote: Hi, Fix for port allocation was merged to master yesterday. Could you please provide SNAT plugin configuration and some information about traffic, I didn’t see work

Re: [vpp-dev] snat multi-thread support problem

ndex.html> for Company Registration Information. From: Juan Salmon [mailto:salmonju...@gmail.com] Sent: Tuesday, December 20, 2016 8:59 AM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) ; vpp-dev@lists.fd.io Subject: Re: [vpp-dev] snat multi-thread support problem Hi, Tha

Re: [vpp-dev] snat multi-thread support problem

Hi, You can use same configuration and snat will use all workers or you can specify worker by “set snat workers ” https://wiki.fd.io/view/VPP/SNAT#Set_S-NAT_workers_example. Could you please provide more details? Regards, [banner3a1] Matus Fabian Engineer - Software matfa...@cisco.com

Re: [vpp-dev] VPP || Limiting interface rate

Hi, There is no documentation for policer. Simple example To configure policer (you can set conform/exceed/violate action transmit/mark-and-transmit/drop) use: configure policer name policy2 cir 102 eir 2345 cb 12 eb 67 rate pps round up type 2r3c-4115 conform-action transmit exceed-action mark

Re: [vpp-dev] Some problems about VPP/snat

Hi, 1) set interface snat in out 2) snat add addresses Regards, Matus From: yug...@telincn.com [mailto:yug...@telincn.com] Sent: Wednesday, October 12, 2016 2:09 PM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) ; 李原1 ; vpp-dev Subject: Re: RE: [vpp-dev] Some

Re: [vpp-dev] Some problems about VPP/snat

Hi, You can use N:1 and 1:1 SNAT. Regards, Matus From: yug...@telincn.com [mailto:yug...@telincn.com] Sent: Wednesday, October 12, 2016 1:49 PM To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) ; 李原1 ; vpp-dev Subject: Re: Re: [vpp-dev] Some problems about VPP/snat Hi, Can we

Re: [vpp-dev] Some problems about VPP/snat

Hi, SNAT plugin is part of vpp-plugins package. SANT in master currently does not support dump and delete for addresses, it waiting for review https://gerrit.fd.io/r/#/c/3240/ Regards, Matus From: vpp-dev-boun...@lists.fd.io [mailto:vpp-dev-boun...@lists.fd.io] On Behalf Of liyu...@telincn.co

Re: [vpp-dev] Some problems about VPP/snat

Hi, It should be “snat add static mapping local 172.16.1.3 6303 external 4.4.4.4 3606” not “snat add static mapping local0 172.16.1.3 6303 external 4.4.4.4 3606”. You also need to run first “snat add addresses 192.168.15.14” if you are not running “static mapping only” mode (you can set this in

Re: [vpp-dev] [csit-dev] Cannot add route to ipsec0 interface

> -Original Message- > From: Neale Ranns (nranns) > Sent: Wednesday, October 12, 2016 10:26 AM > To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) > ; Zdenko Olsovsky -X (zolsovsk - PANTHEON > TECHNOLOGIES at Cisco) ; vpp-dev@lists.fd.io > Cc: csit-...@

Re: [vpp-dev] [csit-dev] Cannot add route to ipsec0 interface

Comments inline Regards, Matus > -Original Message- > From: Neale Ranns (nranns) > Sent: Wednesday, October 12, 2016 9:33 AM > To: Matus Fabian -X (matfabia - PANTHEON TECHNOLOGIES at Cisco) > ; Zdenko Olsovsky -X (zolsovsk - PANTHEON > TECHNOLOGIES at Cisco) ; vpp-de

Re: [vpp-dev] [csit-dev] Cannot add route to ipsec0 interface

Hi Neale, IPSec interface is tunnel interface created by IKEv2 code when child SA is successfully established. You can't set IP on it because there is missing "ip4_sw_interface_enable_disable" when interface is created, I will fix it. Regards, Matus > -Original Message- > From: csit-de