上海電信WLAN測(cè)試報(bào)告-阿朗

Wlan私網(wǎng)地址擴(kuò)展方案測(cè)試－7750中國(guó)電信上海爭(zhēng)論院前言上海電信目前有大量的郊縣阿朗7750WLAN775032C(8K)的公網(wǎng)地址。但是10%WLANportalWLANWLANIPIP地址緊缺的狀況NAT組網(wǎng)及測(cè)試方案7750CGN7750CGNNATNAT44410/8NATinternet。整體流程如下：DHCPBRASportal(適當(dāng)?shù)木W(wǎng)絡(luò)部署方案或隧道方案，需要爭(zhēng)論)，輸入用戶名密碼，portalAAA用戶通過(guò)NAT板卡可以訪問(wèn)internet.整體流程如下：portalportal測(cè)試環(huán)境測(cè)試拓?fù)?750Radius7750RadiusClientServer1TestTestCenter3.2測(cè)試網(wǎng)元2設(shè)備名稱版本數(shù)量775011.01PCWindowsXP1PortalServer聯(lián)創(chuàng)PortalServer1RadiusServer1TestCenterSpirent1CGN單板+子卡IOM3-XP、ISA-MS14.7750-NAT444NAT映射行為7750支持兩種NAT映射行為：與目的地址/NAT映射，與目的地址/端口相關(guān)的NAT映射。與目的地址/端口無(wú)關(guān)的NAT/址/端口二元組是固定的，映射關(guān)系也是固定的，與目的地址/3所示：3#SourceinsideousideDestination與目的地址/端口相關(guān)的NAT映射，該映射行為由源地址/端口/目的地址/目的端口四元組打算，即只有源地址/端口/目的地址/目的端口四元組是固定的，映射關(guān)系才是固定的。如#SourceinsideousideDestinationip-Xport-xip-X”port-x”ip-Yport-y1192.6.1.12414 NAT81.0.0.16153630.0.0.112192.6.1.1241481.0.0.16154430.0.0.123192.6.1.1241481.0.0.16153031.0.0.114NAT資源安排、釋放和監(jiān)控7750inside私網(wǎng)地址安排一對(duì)outside公網(wǎng)地址/端口塊二元組，形成NAT映射關(guān)系。承受端口塊的方式，可以削減因NAT映射導(dǎo)致的log數(shù)量。端口塊中的端口是隨機(jī)安排的，用來(lái)削減可推測(cè)性。的inside私網(wǎng)地址會(huì)挨次使用outside公網(wǎng)地址/端口塊資源。缺省狀況下，NAT1024102465535的的。inside私網(wǎng)地址只能使用一個(gè)端口塊，為其安排的outside端口塊中的端口耗盡后，增的session會(huì)被丟棄，不會(huì)形成的NAT映射關(guān)系，也不會(huì)破壞已經(jīng)形NATsession被丟棄的同時(shí)，7750會(huì)給終端用戶回送code為13的ICMP報(bào)文ICMP通，告之終端用戶NAT可以通過(guò)配置，讓一個(gè)inside私網(wǎng)地址使用多個(gè)端口塊，一個(gè)端口塊耗盡，該私網(wǎng)用戶會(huì)挨次選擇一個(gè)未使用的端口塊。7750還可通過(guò)識(shí)別QoS標(biāo)記，為高優(yōu)先級(jí)業(yè)務(wù)預(yù)留端口，例如DNS、Email和VoIP業(yè)務(wù)，從而確保高優(yōu)先級(jí)業(yè)務(wù)使用NAT功能的牢靠性。11所示：7750還為以下端口類型規(guī)定了超時(shí)時(shí)間：TCP–SYN_SENTTCP–Transitory(FIN_WAIT1/2,CLOSE_WAIT,LAST_ACK,CLOSING)TCP–EstablishedTCP–TIME_WAIT(time-wait-assassination)UDP–InitialPacket(ie.Whenonlyonepacketissent)UDP–DNS(port53trafficonly)UDP當(dāng)一個(gè)inside時(shí)，7750會(huì)為該inside私網(wǎng)用戶釋放相關(guān)端口資源，最終一個(gè)端口資源釋放后，才會(huì)釋放整個(gè)端口塊資源。NAT7750支持兩種NAT映射模式：LargeScale式和L2AwareLargeScale式主要用于集中式的NATLargeScale模式中，只有用戶流量觸發(fā)了NAT映射條件，才會(huì)導(dǎo)致NATLargeScale模式可以由兩個(gè)觸發(fā)條件來(lái)形成NATip-filerdestination-prfixip-filterNAT映射關(guān)系，舉例如下：來(lái)自sap1/1/3:1150的流量觸發(fā)了ip-filte0的地址段為80.80.80.0/4流量觸發(fā)ip-filter5的entry180.80.80.0/4192.168.0.0/6流量觸發(fā)entry2sap所在route的natinse者流量通過(guò)natinsienat-poliy用natoutsienatpol從而實(shí)現(xiàn)NATnatoutsideponat所在的route中形成針對(duì)該地址段的下一跳為natoutsie將其公布至動(dòng)態(tài)路由中，實(shí)現(xiàn)路由回指。如圖565

6件觸發(fā)NAT映射關(guān)系，舉例如下：當(dāng)來(lái)自router51目的地址為100.100.100.0/4，觸發(fā)destination-pre0.100.100.02送往該sap所在route的natinsd該流量通過(guò)natinsi

nat-poliy用natoutsi

natpo從而實(shí)現(xiàn)NAT轉(zhuǎn)換。同ip-filternatoutsidepoolnatoutside所在的route中形成針對(duì)該地址段的下一跳為natoutsie將其公布至動(dòng)態(tài)路由中，實(shí)現(xiàn)路由回指。如圖7878LargeScalenatinsidenatoutside都在同一個(gè)routerip-filter方式實(shí)現(xiàn)NATdestination-prefix9所示：9L2Aware模式主要用于分布式的NATBRAS上。L2Aware模式中，只要用戶認(rèn)證成功獲得私網(wǎng)地址，就會(huì)馬上導(dǎo)致NAT映射關(guān)系的形成，無(wú)需流量觸發(fā)NAT映射條件。終端用戶通過(guò)認(rèn)證后獲得私網(wǎng)地址的同時(shí)，通過(guò)sub-profile屬性中的nat-policynatoutsidenatpool，且需匹配natinsidel2-awareIP地址〔該IP地址與用戶私網(wǎng)地址同網(wǎng)段即可，無(wú)需是網(wǎng)關(guān)地址，即可實(shí)現(xiàn)NAT轉(zhuǎn)換。此時(shí)NAT映射關(guān)7750中，只有用戶下線才解除NAT10和圖11所示：10115.7750NAT板卡配置configureisanat-group1create #創(chuàng)立NATgroup1active-mda-limit1 #設(shè)定該NATgroup的主用ISA板卡數(shù)量為1mda5/1 #將mda5/1參加NATgroup1noshutdownexitexitNATpolicy配置configureservicenatrouterBaserouterBaseexit

exit

nat-policy“nat-policy-ixia“create #創(chuàng)立儀表打流用戶的NATpolicypool“nat-pool-ixia“routerBase #將儀表打流用戶的NAT地址池綁定exitexitnat-policy“nat-policy-portal“create #創(chuàng)立portal用戶的NATpolicypool“nat-pool-portal“routerBase #將portal用戶的NAT地址池綁定至exitexitNAT轉(zhuǎn)換后公網(wǎng)地址池配置configurerouternatoutside #NAT轉(zhuǎn)換后的公網(wǎng)地址池配置pool“nat-pool-ixia“nat-group1typelarge-scalecreate #將儀表打流用戶地址池、相應(yīng)NATgroup、large-scale模式進(jìn)展三方綁定address-range192.168.1.3192.168.1.100 #定義NAT映射后地址池范圍，并在routerBase路由表中生成下一跳為NAT的靜態(tài)路由port-reservationports98 #98個(gè)端口exitnoshutdownexitpool“nat-pool-portal“nat-group1typel2-aware #portal用戶地址池、相應(yīng)NATgroup、l2-aware模式進(jìn)展三方綁定address-range116.228.171.84116.228.171.84create #定義NAT映射后地址池范圍，并在routerBase路由表中生成下一跳為NAT的靜態(tài)路由exitnoshutdownexitexit業(yè)務(wù)配置儀表打流用戶地址池配置configureservicecustomer1createdescription“Defaultcustomer“exitvprn444create #為儀表打流用戶創(chuàng)立VPRNdhcplocal-dhcp-server“dhcp-ser-ixia“create #為儀表打流用戶創(chuàng)立NAT轉(zhuǎn)換前私網(wǎng)地址池的local-dhcp-serveruse-gi-addresspool“dhcp-pool-ixia“create #為儀表打流用戶創(chuàng)立NAT轉(zhuǎn)換前私網(wǎng)地址池的地址池地址段

subnet10.64.0.0/18create #儀表打流用戶NAT轉(zhuǎn)換前私網(wǎng)optionsdefault-router10.64.0.1exit

exitaddress-range10.64.0.210.64.63.255地址段

subnet10.65.0.0/18create #儀表打流用戶NAT轉(zhuǎn)換前私網(wǎng)optionsdefault-router10.65.0.1exit

exitaddress-range10.65.0.210.65.63.255exit

exit

exitnoshutdown地址池接口配置configureservicecustomer1createdescription“Defaultcustomer“exitvprn444create #為儀表打流用戶創(chuàng)立VPRNinterface“l(fā)oopback-dhcp“create #為儀表打流用戶創(chuàng)立loopback接口address1.1.1.1/32 #local-dhcp-server地址local-dhcp-server“dhcp-ser-ixia“ #local-dhcp-serverloopbackexitsubscriber-interface配置configureservicecustomer1createdescription“Defaultcustomer“exitvprn444create #為儀表打流用戶創(chuàng)立VPRNsubscriber-interface“sub-inter-ixia“createallow-unmatching-subnetsaddress10.65.0.1/18address10.64.0.1/18dhcpgi-address10.64.0.1exitgroup-interface“gro-inter-ixia“createarp-populatedhcpexit

server1.1.1.1trustedlease-populate32767client-applicationsdhcppppgi-address10.64.0.1noshutdownsap2/1/1createsub-sla-mgmtdef-sub-iduse-auto-iddef-sub-profile“sub-100“def-sla-profile“sla-100“multi-sub-sap32767noshutdownexit

exit

exit

exitNATinside配置configureservicecustomer1createdescription“Defaultcustomer“exitvprn444create #為儀表打流用戶創(chuàng)立VPRNnatinsidenat-policy“nat-policy-ixia“ #綁定相應(yīng)nat-policydestination-prefix0.0.0.0/0 #IPNAT轉(zhuǎn)換，并在router444中生成一個(gè)下一跳為NAT的缺省路由exitexit

exit

exitnetwork側(cè)直連接口配置configurerouterinterface“to-ixia“address192.168.44.2/24port2/1/4noshutdownexitportal用戶地址池配置configurerouterdhcplocal-dhcp-server“dhcp-ser-portal“create #portal用戶創(chuàng)立NAT轉(zhuǎn)換前私網(wǎng)地址池的local-dhcp-serveruse-gi-addresspool“dhcp-pool-portal“create #為portal用戶創(chuàng)立NAT轉(zhuǎn)換前私網(wǎng)地址池的地址池

optionsdns-server202.96.209.5 #portal用戶配置DNS地址exit址段

subnet10.66.0.0/24create #portal用戶NAT轉(zhuǎn)換前私網(wǎng)地optionsdefault-router10.66.0.1exit

exit

exitaddress-range10.66.0.310.66.0.254exit

exit

noshutdown地址池接口配置configurerouterinterface“l(fā)oopback-dhcp“create #為portal用戶創(chuàng)立loopback接口address2.2.2.2/32 #local-dhcp-server地址local-dhcp-server“dhcp-ser-portal“ #綁定local-dhcp-serverloopbacknoshutdownexitsubscriber-interface配置configureservicecustomer1createdescription“Defaultcustomer“exities443create #portal用戶創(chuàng)立IESsubscriber-interface“sub-inter-portal“createaddress10.66.0.1/24dhcpgi-address10.66.0.1exitgroup-interface“gro-inter-portal“createarp-populatedhcpexit

server2.2.2.2trustedlease-populate32767client-applicationsdhcppppgi-address10.66.0.1noshutdownauthentication-policy“auth-policy-portal“oper-up-while-emptysap2/1/3createsub-sla-mgmtdef-sub-iduse-auto-iddef-sub-profile“sub-100“def-sla-profile“sla-portal“sub-ident-policy“sub-ident-local“multi-sub-sap1000noshutdownexitexitwpp #portal用戶觸發(fā)portal協(xié)議initial-sla-profile“sla-portal“initial-sub-profile“sub-100“portalrouter“Base“name“portal“ #portalServernoshutdownexit

exit

exitnoshutdownNATinside配置configurerouternatinsidel2-awareaddress10.66.0.1/24 #portal用戶通過(guò)該IP地址觸發(fā)NATexit

exit

exit

exit認(rèn)證配置configuresubscriber-mgmtauthentication-policy“auth-policy-portal“create #配置portal用戶的認(rèn)證策略radius-authentication-serverserver1address218.80.254.216secret“testing123“hash2port1642source-address116.228.171.72exitaccept-authorization-changepppoe-access-methodpap-chapinclude-radius-attributenas-port-idnas-identifiermac-addresscalling-station-idsap-stringexitexit計(jì)費(fèi)配置radius-accounting-policy“acct-policy-nat-wlan“create #配置portal用戶的計(jì)費(fèi)策略include-radius-attributecalling-station-idsap-stringcircuit-idframed-ip-addrframed-ip-netmasknas-identifiernas-port-idprefix-string“shgd-“remote-idsla-profilesub-profilesubscriber-iduser-nameexitsession-id-formatnumberuse-std-acct-attributesradius-accounting-serverserver1address218.80.254.216secret“testing123“hash2port1642source-address116.228.171.72exitexitPortalServer配置configurerouterportalsportal“portal“address115.239.138.17create #配置PortalServerIP地址noshutdownexit

exit

exit用戶屬性配置sub-profile配置configuresubscriber-mgmtsub-profile“sub-100“createnat-policy“nat-policy-portal“ #portal用戶的nat-policyradius-accounting-policy“acct-policy-wlan“exitsla-profile配置sla-profile“sla-portal“createexitsub-ident-policy配置sub-ident-policy“sub-ident-local“createsub-profile-mapuse-direct-map-as-defaultexitsla-profile-mapuse-direct-map-as-defaultexitexit測(cè)試?yán)齱lan〔portal〕測(cè)試編號(hào)：1 測(cè)試工程：wlan私網(wǎng)流程穿越測(cè)試測(cè)試目的：驗(yàn)證wlan的私網(wǎng)地址方式下用戶上網(wǎng)的上線和下線流程〔私網(wǎng)訪問(wèn)portal〕測(cè)試環(huán)境：模擬環(huán)境見(jiàn)圖1測(cè)試步驟：電腦終端發(fā)起DHCP懇求，獵取私網(wǎng)地址。用戶輸入網(wǎng)址后可以直接重定向到portal認(rèn)證通過(guò)后，AAA下發(fā)相關(guān)策略7750NAT在上網(wǎng)一段時(shí)間后，用戶點(diǎn)擊下線框，可以正常下線預(yù)期結(jié)果：認(rèn)證通過(guò)，可以上網(wǎng)驗(yàn)證各個(gè)需要改造網(wǎng)元接口的報(bào)文內(nèi)容和格式，符合預(yù)期要求測(cè)試結(jié)果:認(rèn)證通過(guò)，用戶能上網(wǎng)，流程也滿足測(cè)試要求。備注：備注：wlan〔portal〕測(cè)試編號(hào)：2 測(cè)試工程：wlan私網(wǎng)流程穿越測(cè)試測(cè)試目的：驗(yàn)證wlan的私網(wǎng)地址方式下用戶上網(wǎng)的上線和下線流程〔公網(wǎng)訪問(wèn)portal〕測(cè)試環(huán)境：模擬環(huán)境見(jiàn)圖1測(cè)試步驟：電腦終端發(fā)起DHCP懇求，獵取私網(wǎng)地址。用戶輸入網(wǎng)址后可以直接重定向到portal認(rèn)證通過(guò)后，AAA下發(fā)相關(guān)策略7750NAT在上網(wǎng)一段時(shí)間后，用戶點(diǎn)擊下線框，可以正常下線預(yù)期結(jié)果：認(rèn)證通過(guò)，可以上網(wǎng)驗(yàn)證各個(gè)需要改造網(wǎng)元接口的報(bào)文內(nèi)容和格式，符合預(yù)期要求測(cè)試結(jié)果:認(rèn)證通過(guò)，用戶能上網(wǎng)，流程也滿足測(cè)試要求。備注：備注：CGN測(cè)試編號(hào)：3 測(cè)試工程：CGN單板會(huì)話規(guī)格測(cè)試目的：驗(yàn)證CGN單板的NAT444的會(huì)話規(guī)格測(cè)試環(huán)境：圖2測(cè)試步驟：如圖組網(wǎng)，搭建測(cè)試環(huán)境在7750上配置配置NAT444功能。IXIA1向IXIA2發(fā)送IPv4業(yè)務(wù)流量，IPv4五元組發(fā)生變化，觸發(fā)NAT會(huì)話，檢查NAT最大可支持會(huì)話個(gè)數(shù)。檢查NAT網(wǎng)關(guān)地址轉(zhuǎn)換是否正常，會(huì)話表是否到達(dá)廠商宣稱的規(guī)格。預(yù)期結(jié)果：CGNNAT測(cè)試結(jié)果:以下內(nèi)容為：通過(guò)show命令顯示儀表打流時(shí)NAT相關(guān)內(nèi)容1nat-group中的成員：showisanat-group1members===============================================================================ISAGroup1members===============================================================================GroupMember State MdaAddressesBlocks Se-%HiSe-Prio1 1 active 5/1253 632 99 N0No.ofmembers:1===============================================================================2、顯示mda5/1的NAT資源使用狀況：toolsdumpnatisaresourcesmda5/1ResourceUsageforSlot#5Mda#1:|Total |Allocated |Free-------------------------------+--------------+--------------+--------------Flows|6291456|6291453|3Policies|256|2|254Port-rangesconfigured|1572864|632|1572232Port-rangesused|632|299|333Port-rangesretained|0|0|-Ports|12884901888|6291452|12878610436IP-addresses|65536|253|65283Large-scalehosts|262144|299|261845Dormantsubscribers|262144|0|262144L2-awaresubscribers|65536|0|65536L2-awarehosts|65536|0|65536Subscriber-cacheentries|262144|0|262144DelayedICMP”s|200|0|200ALGsession|786432|0|786432Upstreamfragmentlists|262144|0|262144Downstreamfragmentlists|65536|0|65536Upstreamfragmentholes|1048576|0|1048576Downstreamfragmentholes|262144|0|262144Upstreamfragmentbufs|262144|0|262144Downstreamfragmentbufs|65536|0|65536flowlogdest.set0|2|0|2flowlogpacketsset0|50|0|50flowlogdest.set1|2|0|2flowlogpacketsset1|50|0|50flowlogdest.set2|1|0|1flowlogpacketsset2| 50| 0| 503、顯示nat-group中的統(tǒng)計(jì)狀況：showisanat-group1member1statistics===============================================================================ISANATGroup1Member1===============================================================================noresource :0pktrxonwrongport :0unsupportedprotocol :0nohostorhostgroup :0noiporport :241228714nomatchingflow :1733maxflowexceeded :1694216TCPnoflowforRST :5TCPnoflowforFIN :39TCPnoflow :38addr.dep.filtering :0ICMPtypeunsupported :0ICMPlocalunsupported :0ICMPchecksumerror :0ICMPembeddedchecksumerror :0ICMPunsupportedL4 :0ICMPtooshort :0ICMPlengtherror :0PktnotIPv4orIPv6 :0Pktrcverror :0Pkterror :0IPv4headerchecksumviolation :0IPv4headermalformed :0IPv4malformedpacket :0IPv4ttlzero :0IPv4opt/IPv6extheaders :0IPv4undefinederror :0IPv6fragmentsunsupported :0TCP/UDPmalformed :0TCP/UDPchecksumfailure :16TCP/UDPlengtherror :0Pktsenderror :0nobuftocopypkt :0nopolicy :0lockedbymgmtcore :0portrangelogfailed :0MTUexceeded :0DSLiteunrecognizednexthdr :0DSLiteunknownAFTR :0toomanyfragmentsforIPpacket :0toomanyfragmentedpackets :0toomanyfragmentholes :0toomanyfragsbuffered :0fragmentlistexpired :0fragmentratetoohigh :0flowlogfailed :0nomultiplehostorsubscr.IPsallowed :0NAT64disabled :0NAT64invalidsrcaddr :0NAT64fraghaszerochecksum :0NAT64v4haszerochecksum :0NAT64ICMPfragunsupported :0ReassemblyFailures :0subscriber-idunknown :0packethashedtowrongMDA :0tolocal :0tolocalignored :0newflow :108418334TCPclosed :1972TCPexpired :73UDPexpired :102060037ICMPexpired :67GREexpired :0ICMPlocal :0foundflow :1092812788ARPsignored :15FragmentsRXL2A :0FragmentsRXLSN :0FragmentsRXDSL :0FragmentsRXDORMANT :0FragmentsRXOUT :0FragmentsTXL2A :0FragmentsTXLSN :0FragmentsTXDSL :0FragmentsTXDORMANT :0FragmentsTXNAT64 :0FragmentsTXOUT :0flowcreatelogged :0flowdeletelogged :0flowlogpkttx :0ReassembledPkts :0subscriber-idcached :0subscriber-iddelayed :0subscriber-idtimeout :0V6pktsfragmented :0forwardedDS-LiteV6pkts :0===============================================================================4、顯示端口塊的使用狀況：showrouternatlsn-blocks===============================================================================Large-ScaleNATblocksforBase===============================================================================192.168.1.5Pool[1024..33279]:nat-pool-ixiaPolicy:nat-policy-ixiaStarted:2013/07/2313:46:24Insiderouter :vprn444InsideIPaddress :10.64.12.241192.168.1.6Pool[1024..33279]:nat-pool-ixiaPolicy:nat-policy-ixiaStarted:2013/07/2313:46:24Insiderouter :vprn444InsideIPaddress :10.64.12.239……篇幅緣由省略假設(shè)干條目192.168.1.154Pool[33280..65535]:nat-pool-ixiaPolicy:nat-policy-ixiaStarted:2013/07/2313:46:23Insiderouter :vprn444InsideIPaddress :10.64.11.7Numberofblocks:299===============================================================================*A:Wifi_Bras-27#5、顯示NAToutside側(cè)某具體地址池的狀態(tài)信息：showrouternatpool“nat-pool-ixia“===============================================================================NATPoolnat-pool-ixia===============================================================================Description :(NotSpecified)ISANATGroup :1Pooltype :largeScaleAdminstate :inServiceMode :auto(napt)Portforwardingdynblocksreserved :0Portforwardingrange :1-1023Portreservation :32256portsBlockusageHighWatermark(%) :(NotSpecified)BlockusageLowWatermark(%) :(NotSpecified)SubscriberlimitperIPaddress :65535Active :trueDeterministicportreservation :(NotSpecified)LastMgmtChange :07/23/201310:33:27==============================================================================================================================================================NATaddressrangesofpoolnat-pool-ixia===============================================================================Range DrainNum-blk192.168.1.3-192.168.1.254 299No.ofranges:1==============================================================================================================================================================NATmembersofpoolnat-pool-ixiaISANATgroup1===============================================================================Member Block-Usage-%Hi1 59 NNo.ofmembers:1===============================================================================6、顯示NAToutside側(cè)全部地址池的概述狀況：showrouternatsummary===============================================================================NATpools===============================================================================Pool NAT-groupType Admin-statenat-pool-ixia1largeScaleinServicenat-pool-portal1largeScaleinServiceNo.ofpools:2===============================================================================7、顯示全部nat-policy的概述狀況：showservicenatnat-policy===============================================================================NATpolicies===============================================================================Policy Descriptionnat-policy-ixianat-policy-portalNo.ofNATpolicies:2===============================================================================8、顯示某具體nat-policy的綁定狀況：showservicenatnat-policy“nat-policy-ixia“associations===============================================================================NATPolicynat-policy-ixiaRouterAssociations===============================================================================vprn444No.ofrouters:1===============================================================================NoassociatedSoftGREinterfacesfound.NoassociatedSoftGREinterfaceVLANtagrangesfound.9、顯示某具體nat-policy的統(tǒng)計(jì)信息：showservicenatnat-policy“nat-policy-ixia“statistics===============================================================================NATPolicynat-policy-ixiaStatistics===============================================================================mda5/1hostsActive :299hostsPeak :498sessionsTcpCreated :0sessionsTcpDestroyed :0sessionsUdpCreated :127122442sessionsUdpDestroyed :120835950sessionsIcmpQueryCreated :4sessionsIcmpQueryDestroyed :4sessionsGreQueryCreated :0sessionsGreQueryDestroyed :0===============================================================================10、顯示NAT用戶信息：showservicenatlsn-subscribers===============================================================================Large-ScaleNATsubscribers=============================