vpp之nat44

Nat44

从18.07发布的NAT44代码已经被拆分为普通的NAT44和额外的特性NAT44端点依赖模式。NAT44端点依赖模式支持对某些特性需要的所有会话进行端点依赖的过滤和映射。一些现有功能，如服务负载平衡、两次nat、out2in-only静态映射、未知协议动态转换和带有动态转换的转发特性，现在仅在端点依赖模式下可用。端点依赖模式使用6元组(源IP地址、源端口、目标IP地址、目标端口、协议、FIB表索引)会话哈希表键，而不是4元组(源IP地址、源端口、协议、FIB表索引)。要启用NAT插件端点依赖模式，请在statrup配置中添加以下内容

#要启用NAT插件端点依赖模式，请在statrup配置中添加以下内容
nat { endpoint-dependent }

API

显示NAT插件启动配置

define nat_show_config {
 u32 client_index;
 u32 context;
};
define nat_show_config_reply {
 u32 context;
 i32 retval;
 u8 static_mapping_only;
 u8 static_mapping_connection_tracking;
 u8 deterministic;
 u32 translation_buckets;
 u32 translation_memory_size;
 u32 user_buckets;
 u32 user_memory_size;
 u32 max_translations_per_user;
 u32 outside_vrf_id;
 u32 inside_vrf_id;
};

设置NAT插件workers

define nat_set_workers {
 u32 client_index;
 u32 context;
 u64 worker_mask;
};

dump NAT 插件 workers:

define nat_worker_dump {
 u32 client_index;
 u32 context;
};
define nat_worker_details {
 u32 context;
 u32 worker_index;
 u32 lcore_id;
 u8 name[64];
};

启用/禁用NAT IPFIX日志

define nat_ipfix_enable_disable {
 u32 client_index;
 u32 context;
 u32 domain_id;
 u16 src_port;
 u8 enable;
};

添加/删除NAT44地址范围(仅为twice_nat端点依赖模式)

define nat44_add_del_address_range {
 u32 client_index;
 u32 context;
 u8 first_ip_address[4];
 u8 last_ip_address[4];
 u32 vrf_id;
 u8 twice_nat;
 u8 is_add;
};

转储NAT44地址

define nat44_address_dump {
 u32 client_index;
 u32 context;
};
define nat44_address_details {
 u32 context;
 u8 ip_address[4];
 u8 twice_nat;
 u32 vrf_id;
};

在接口上开启/关闭NAT44特性

define nat44_interface_add_del_feature {
 u32 client_index;
 u32 context;
 u8 is_add;
 u8 is_inside;
 u32 sw_if_index;
};

有NAT44特性的转储接口

define nat44_interface_dump {
 u32 client_index;
 u32 context;
};
define nat44_interface_details {
 u32 context;
 u8 is_inside;
 u32 sw_if_index;
};

add/delete 1:1 NAT (twice_nat/out2in_only endpoint dependent mode only):

define nat44_add_del_static_mapping {
 u32 client_index;
 u32 context;
 u8 is_add;
 u8 addr_only;
 u8 local_ip_address[4];
 u8 external_ip_address[4];
 u8 protocol;
 u16 local_port;
 u16 external_port;
 u32 external_sw_if_index;
 u32 vrf_id;
 u8 twice_nat;
 u8 out2in_only;
 u8 tag[64];
};

dump 1:1 NAT:

define nat44_static_mapping_dump {
 u32 client_index;
 u32 context;
};
define nat44_static_mapping_details {
 u32 context;
 u8 addr_only;
 u8 local_ip_address[4];
 u8 external_ip_address[4];
 u8 protocol;
 u16 local_port;
 u16 external_port;
 u32 external_sw_if_index;
 u32 vrf_id;
 u8 twice_nat;
 u8 out2in_only;
 u8 tag[64];
};

添加/删除指定接口的NAT44池地址(只支持twice_nat端点依赖模式)

define nat44_add_del_interface_addr {
 u32 client_index;
 u32 context;
 u8 is_add;
 u8 twice_nat;
 u32 sw_if_index;
};

dump NAT44池地址接口

define nat44_interface_addr_dump {
 u32 client_index;
 u32 context;
};
define nat44_interface_addr_details {
 u32 context;
 u32 sw_if_index;
 u8 twice_nat;
};

转储NAT44用户

nat44_user_dump {
 u32 client_index;
 u32 context;
};
define nat44_user_details {
 u32 context;
 u32 vrf_id;
 u8 ip_address[4];
 u32 nsessions;
 u32 nstaticsessions;
};

dump NAT44用户会话

define nat44_user_session_dump {
 u32 client_index;
 u32 context;
 u8 ip_address[4];
 u32 vrf_id;
};
define nat44_user_session_details {
 u32 context;
 u8 outside_ip_address[4];
 u16 outside_port;
 u8 inside_ip_address[4];
 u16 inside_port;
 u16 protocol;
 u8 is_static;
 u64 last_heard;
 u64 total_bytes;
 u32 total_pkts;
 u8 is_twicenat;
 u8 ext_host_valid;
 u8 ext_host_address[4];
 u16 ext_host_port;
 u8 ext_host_nat_address[4];
 u16 ext_host_nat_port;
};

启用/禁用NAT44作为接口输出特性(postrouting in2out翻译)

define nat44_interface_add_del_output_feature {
 u32 client_index;
 u32 context;
 u8 is_add;
 u8 is_inside;
 u32 sw_if_index;
};

有NAT44输出特性的dump接口

define nat44_interface_output_feature_dump {
 u32 client_index;
 u32 context;
};
define nat44_interface_output_feature_details {
 u32 context;
 u8 is_inside;
 u32 sw_if_index;
};

添加/删除负载均衡的NAT44静态映射(仅支持端点依赖模式)

typeonly define nat44_lb_addr_port {
 u8 addr[4];
 u16 port;
 u8 probability;
};
define nat44_add_del_lb_static_mapping {
 u32 client_index;
 u32 context;
 u8 is_add;
 u8 external_addr[4];
 u16 external_port;
 u8 protocol;
 u32 vrf_id;
 u8 twice_nat;
 u8 out2in_only;
 u8 tag[64];
 u8 local_num;
 vl_api_nat44_lb_addr_port_t locals[local_num];
};

转储负载均衡的NAT44静态映射

define nat44_lb_static_mapping_dump {
 u32 client_index;
 u32 context;
}; 
define nat44_lb_static_mapping_details {
 u32 context;
 u8 external_addr[4];
 u16 external_port;
 u8 protocol;
 u32 vrf_id;
 u8 twice_nat;
 u8 out2in_only;
 u8 tag[64];
 u8 local_num;
 vl_api_nat44_lb_addr_port_t locals[local_num];
};

删除NAT44会话

define nat44_del_session {
 u32 client_index;
 u32 context;
 u8 is_in;
 u8 address[4];
 u8 protocol;
 u16 port;
 u32 vrf_id;
 u8 ext_host_valid;
 u8 ext_host_address[4];
 u16 ext_host_port;
};

添加/删除NAT44用户映射

define nat44_add_del_identity_mapping {
 u32 client_index;
 u32 context;
 u8 is_add;
 u8 addr_only;
 u8 ip_address[4];
 u8 protocol;
 u16 port;
 u32 sw_if_index;
 u32 vrf_id;
 u8 tag[64];
};

转储NAT44用户映射

define nat44_identity_mapping_dump {
 u32 client_index;
 u32 context;
};
define nat44_identity_mapping_details {
 u32 context;
 u8 addr_only;
 u8 ip_address[4];
 u8 protocol;
 u16 port;
 u32 sw_if_index;
 u32 vrf_id;
 u8 tag[64];
};

CLI

set interface nat44 in <intfc> out <intfc> [output-feature] [del]
show nat44 interfaces
nat44 add address <ip4-range-start> [- <ip4-range-end>] [tenant-vrf <vrf-id>] [twice-nat] [del]
show nat44 addresses
nat44 add static mapping tcp|udp|icmp local <ip4-addr> [<port>] external (<ip4-addr>|<intfc>) [<port>] [vrf <table-id>] [twice-nat] [out2in-only] [del]
nat44 add load-balancing static mapping protocol tcp|udp external <addr>:<port> local <addr>:<port> probability <n> [vrf <table-id>] [twice-nat] [out2in-only] [del]
nat44 add identity mapping <interface>|<ip4-addr> [<protocol> <port>] [vrf <table-id>] [del]
show nat44 static mappings
set nat workers <workers-list>
show nat workers
nat ipfix logging [domain <domain-id>] [src-port <port>] [disable]
nat44 add interface address <interface> [twice-nat] [del]
show nat44 interface address
nat44 del session in|out <addr>:<port> tcp|udp|icmp [vrf <id>] [external-host <addr>:<port>]
show nat44 sessions [detail]
nat addr-port-assignment-alg default | map-e psid <n> psid-offset <n> psid-len <n> | port-range <start-port> - <end-port>
nat44 forwarding enable|disable