某局点使用CR16018-F CGN单板做NAT444之后网吧用户看视频卡顿问题

某运营商局点使用CR16018-F+CGN单板，设备做BRAS PPPoE Server，并采用CGN单板做NAT转换，组网图可以简化为：

终端-------网吧路由器------CR16018-F--------外网

在使用过程中网吧用户反馈，当上网用户较多的时候，存在有普遍的打开网页慢，视频卡顿情况。

调研发现，个人用户报障极少，报障用户都集中于网吧用户。   

要取一个网吧用户的IP地址，从BRAS上使用display ppp access-user ip-address  100.X.114.X  可以看到该用户已在线很久，在线信息并无异常，且从BRAS上ping测试该用户地址无异常。

因该运营商局点对于PPPoE拨号用户做了端口限制，每个用户分配了2048个NAT端口，所以怀疑可能是网吧用户大量用户并发访问时，导致分配的NAT端口数被耗尽。

在设备上查看用户NAT端口占用情况，发现给该终端分配的NAT端口号已经被耗尽，如下：

[H3C]display nat user-information local ipv4 100.X.114.X                                                                                                                                 

Slot 9:                                                                                                                            

Total Users found: 0                                                                                                                

Slot 10:                                                                                                                            

Total Users found: 0                                                                                                               

Slot 11:                                                                                                                           

Total Users found: 0                                                                                                                

Slot 12:                                                                                                                            

Total Users found: 0                                                                                                               

Slot 13:                                                                                                                           

User ID                                            : 0x2868ec62                                                                    

Local IP                                           : 100.X.114.X                                                                

VPN instacne                                       : ---(0)                                                                        

Address group                                      : 1                                                                              

NAT instance                                       : nat1                                                                          

Global IP                                          : 122.X.151.X                                                                 

Start port                                         : 62465                                                                         

Block size                                         : 2048                                                                           

Port total                                         : 2048                                                                          

Extend port alloc times                            : 0                                                                                                                                                     

Extend port alloc number                           : 0                                                                             

First/Second/Third/Fourth/Fifth extend port start  : 0/0/0/0/0                                                                     

Total/TCP/UDP/ICMP port limit                      : ---/---/---/---                                                                

TCP/UDP/ICMP port current                          : 2048/526/25                                                                   

Total Users found: 1                                                                                                               

Slot 14:                                                                                                                           

User ID                                            : 0x2868ec62                                                                     

Local IP                                           : 100.X.114.X                                                               

VPN instacne                                       : ---(0)                                                                         

Address group                                      : 1                                                                             

NAT instance                                       : nat1                                                                           

Global IP                                          : 122.X.151X                                                                

Start port                                         : 62465                                                                         

Block size                                         : 2048                                                                          

Port total                                         : 2048                                                                          

Extend port alloc times                            : 0                                                                             

Extend port alloc number                           : 0                                                                             

First/Second/Third/Fourth/Fifth extend port start  : 0/0/0/0/0                                                                     

Total/TCP/UDP/ICMP port limit                      : ---/---/---/---                                                               

TCP/UDP/ICMP port current                          : 2048/523/22                                                                   

Total Users found: 1    

从信息可见，给该用户分配的端口块大小为2048，当前已经占用完，这样前面连接不释放端口的话，后面的报文将无NAT端口可用，无法进行NAT转换，进而导致网页无法打开，点新视频卡顿。   

在NAT地址池组中扩大端口段，增加弹性增量端口块，当2048个端口占完之后，可以弹性扩展2048个端口，使用命令：

在NAT地址组中视图下

[H3C-address-group-1]port-block block-size 2048 extended-block-number 1

针对大并发需求的网吧用户，扩展弹性增量端口块端口也无法解决的，直接通过Radius服务器授权公网IP。