Session Logging; Syslog Logging; Restrictions For Syslog; Syslog Message Format - Cisco GRS Configuration Manual

Session logging

• If the size of bulk allocation is changed, then all the current dynamic transactions will be deleted. Hence
• The port numbers below the value of dynamic-port-range start value (which is 1024 by default), are not
• The algorithm that is used to allocate a public address to a user remains the same.
• When bulk allocation is enabled, session logging is not available.
• When bulk allocation is enabled, the translation record will not contain information about L4 protocol.
• Bulk port allocation features is not supported in NAT64 stateful application.
Session logging
In general, NAT translation entries contain information about private source IP, port and translated public IP
and port. However, there could be cases when the destination IP address (public IP address) and port may
also be needed. In such cases, session logging has to be enabled so that Netflow or Syslog translation records
include these values as well.

Syslog Logging

Perform the following tasks to configure Syslog Logging for NAT table entries.

Restrictions for Syslog

The restrictions for syslog are as follows:
• Syslog is supported over UDP only.
• Syslog is supported in ASCII format only.
• You cannot log onto multiple collectors or relay agents.
• All the messages comply to RFC 3954 except for the timestamp format. Timestamp is represented in a
• Syslog shall be supported for DS-Lite and NAT444 as of now. Support for NAT64 is not yet available.
• The Syslog collector shall be assumed to be in the default VRF. If not, appropriate ACLs have to

Syslog Message Format

In general, the syslog message is made up of header, structured data, and msg fields. However, in the CGv6
applications, the structured data is not used.
Cisco IOS XR Carrier Grade NAT Configuration Guide for the Cisco CRS Router, Release 5.2.x
96
it is advisable to change the bulk port allocation size (only if necessary) during a maintenance window.
allocated in bulk.
simpler way as explained later in this section.
configured and applied on to Service Infra interface to divert the Syslog packets from default VRF to
specific VRF through which the collector can be reached.
External Logging
OL-32659-01