T7181: VPP add initial source NAT implentation #16
Conversation
sever-sever
requested review from
dmbaturin,
jestabro and
zdc
as code owners
sever-sever
force-pushed
the
T7181
branch
5 times, most recently
from
5713a9e to
c4f5e7e
Compare
There was a problem hiding this comment.
I think it's a good start but we should think how we will extend that syntax when we add more options. My particular concern is how do we plan to go about identity mapping. We should design the CLI now to ensure that those things can be added without config syntax changes and migration scripts.
| nat44.enable_nat44_ed() | ||
| https://github.com/FDio/vpp/blob/stable/2410/src/plugins/nat/nat44-ed/nat44_ed.api | ||
| """ | ||
| self.vpp.api.nat44_ed_plugin_enable_disable(enable=True) |
There was a problem hiding this comment.
What's the default value for the number of sessions per thread? The docs use examples like nat44 plugin enable sessions 10000. Is the default unlimited?
There was a problem hiding this comment.
I cant find default value, what I saw some calculations here FDio/vpp@5f694d1
vpp# show nat44 summary
max translations per thread: 64512 fib 0
transitory tcp LRU min session timeout 1376 (now 1136)
udp LRU min session timeout 1007 (now 1136)
icmp LRU min session timeout 1196 (now 1136)
total sessions: 6 (timed out: 1)
tcp sessions:
total: 1 (timed out: 0)
established: 0 (timed out: 0)
transitory: 1 (timed out: 0)
udp sessions:
total: 4 (timed out: 1)
icmp sessions:
total: 1 (timed out: 0)
other sessions:
total: 0 (timed out: 0)
vpp#
interface-definitions/vpp.xml.in
Outdated
| </completionHelp> | ||
| </properties> | ||
| </leafNode> | ||
| <leafNode name="translation-pool"> |
There was a problem hiding this comment.
There are examples in the dynamic NAT section like nat44 add address 10.0.1.1 where it's using a single external address. In other places the "address pool" is an interface name.
It can also take options such as tenant-vrf or twice-nat.
Expanding a leaf node to support those things will require an incompatible change and a migration script, so I think we should make a plan for extending it right away.
The translation-pool option certainly shouldn't be a leaf node. We should likely have mutually-exclusive sub-nodes there like range, address, and interface. Ideally, they should be grouped under a node, although I'm not sure what we might call that node... external?
There was a problem hiding this comment.
Changed translation-pool to translation address x.x.x.x
set vpp nat44 source translation address '192.0.2.1'
possible usage with a range
set vpp nat44 source translation address '192.0.2.1-192.0.2.2'
07eac72 to
6735394
Compare
Add initial source NAT implementation ``` set vpp nat44 source inbound-interface 'eth2' set vpp nat44 source outbound-interface 'eth1' set vpp nat44 source translation address '192.0.2.1-192.0.2.2' ``` Add initial simple implementation of the source NAT In the future, we'll extend it to the rules if it is possible to do via VPP API
|
PoC works; it is necessary to think about CLI style and possible configuration options based on the VPP API. We can talk about any ideas about this stuff here. |
Change Summary
Add initial source NAT implementation
Add initial simple implementation of the source NAT In the future, we'll extend it to the rules if it is possible to do via VPP API
https://github.com/FDio/vpp/blob/stable/2410/src/plugins/nat/nat44-ed/nat44_ed.api
Related Task(s)
Related PR(s)
Proposed changes
How to test
Check VPP
Some real sessions:
Checklist: