SR8804-X nat outbound不生效经验案例

S7510E上的接口为vlan 920，SR8804-X的接口终结vlan 920

SR8804-X作为出口设备，配置了nat outbound。从核心S7510E上ping  SR8804-X的内网口能通，ping SR8804-X的外网口下一跳不通。SR8804-X带内网口源地址ping外网下一跳不通。

查看配置，设备已经配置了引流策略

interface Route-Aggregation1.920

ip address 192.168.255.102 255.255.255.252

qos apply policy 1 inbound

vlan-type dot1q vid 920

#

interface Ten-GigabitEthernet1/4/0/2

port link-mode route

port link-aggregation group 1

#

interface Ten-GigabitEthernet2/4/0/2

port link-mode route

port link-aggregation group 1

#

interface GigabitEthernet1/2/1/1

port link-mode route

ip address 112.17.xx.xxx 255.255.255.224

nat outbound 2000

#

traffic classifier 1 operator and

if-match acl 2001

#

traffic behavior 1

redirect chassis 1 slot 2

#

qos policy 1 classifier 1 behavior 1

#

interface GigabitEthernet1/3/0/1

port link-mode route

ip address 10.101.0.1 255.255.248.0

qos apply policy 1 inbound

查看单板nat支持情况，支持

从S7510E上ping外网，查看SR8804-X上的会话，发现无任何会话信息

dis nat session verbose

dis session table ipv4 destination-ip 112.17.xx.xxx

显示的两个会话都为0

查看版本无相关软件bug

查看限制，内网口是SPC板，下发不了qos policy 。设备会报错，但是命令行里显示正常。

[Bras_SR8804X_IRF-Route-Aggregation1.920]qos apply policy 1 inbound

%Sep 13 22:25:52:121 2018 Bras_SR8804X_IRF QOS/4/QOS_POLICY_APPLYIF_CBFAIL: -MDC=1-Chassis=1-Slot=4; Failed to apply classifier-behavior 1 in policy 1 to the inbound direction of interface Route-Aggregation1.920. Part of actions are not supported.

%Sep 13 22:25:51:665 2018 Bras_SR8804X_IRF QOS/4/QOS_POLICY_APPLYIF_CBFAIL: -MDC=1-Chassis=1-Slot=3; Failed to apply classifier-behavior 1 in policy 1 to the inbound direction of interface Route-Aggregation1.920. Part of actions are not supported.

%Sep 13 22:25:51:807 2018 Bras_SR8804X_IRF QOS/4/QOS_POLICY_APPLYIF_CBFAIL: -MDC=1-Chassis=2-Slot=4; Failed to apply classifier-behavior 1 in policy 1 to the inbound direction of interface Route-Aggregation1.920. Part of actions are not supported.

%Sep 13 22:25:52:467 2018 Bras_SR8804X_IRF QOS/4/QOS_POLICY_APPLYIF_CBFAIL: -MDC=1-Chassis=1-Slot=5; Failed to apply classifier-behavior 1 in policy 1 to the inbound direction of interface Route-Aggregation1.920. Part of actions are not supported.

%Sep 13 22:25:52:257 2018 Bras_SR8804X_IRF QOS/4/QOS_POLICY_APPLYIF_CBFAIL: -MDC=1-Chassis=2-Slot=3; Failed to apply classifier-behavior 1 in policy 1 to the inbound direction of interface Route-Aggregation1.920. Part of actions are not supported.

%Sep 13 22:25:52:191 2018 Bras_SR8804X_IRF QOS/4/QOS_POLICY_APPLYIF_CBFAIL: -MDC=1-Chassis=2-Slot=5; Failed to apply classifier-behavior 1 in policy 1 to the inbound direction of interface Route-Aggregation1.920. Part of actions are not supported.

设备带源地址ping公网口下一跳时，直接从本机cpu发出的icmp报文，不走nat出去所以没有nat会话，报文源地址是内网地址，对端没有路由所以不通。

1、换其他接口板做qos引流。

2、使用SPC单板聚合的时候可以将qos policy下发在成员接口上，不能下发在聚合口下。