I'm experiencing a strange NAT problem with a Cisco 2514 running 12.0(26). This router is configured with two NAT inside Ethernet interfaces for the LANs and one NAT outside serial interface for Internet. There are a few static NAT entries for servers and a pool of 1 IP address for dynamic NAT.
About 1 to 3 times a month, no workstation using dynamic NAT on either Ethernet interface is able to get out to the web. When I do a "show ip nat trans", all I see listed are the static translations, no dynamic ones. Servers setup with static NAT go in and out fine. The only solution I've found is doing a "reload". Everything works after that.
No config changes are made when these problems appear, and they seem to always occur first thing in the morning. The LAN has no more than 45 simultaneous users. The NAT setup hasn't changed for over 2 to 3 years, and this only started happening in the past year.
The number of LAN users has probably increased from 30 to 45, at most, over the past 2 years. The timeout values are at their defaults, which I can lookup if needed.
I have read about cases where the pool of port numbers is emptied or the NAT table is filled up when the timeout values are too great, but I would presume there should be at least a few dynamic NAT entries when doing a "show ip nat trans" if that were the case. Instead, I'm not seeing anything at all...
Warning - All of this is clutching at straws really but you may just fix it you never know.
Largest ~= Free ~= Lowest (more or less) Memory not fragmented and you have never run out.
Zero misses is unusual but good!
This is really, really clutching at straws but you may be lucky. The idea of the following is to try to give the router the best opportunity to cope with what may be an overloaded condition.
Failures we don't want. Lets try to get rid of them. There are several options here you could try for example.
conf t buffers big min-free 20 ! 20 * 1524 = 30000 ish
Above will use a bit more than 30k of RAM and you have enough.
You will have to balance the memory that you have with the number of buffers that you allocate.
Quite a lot of fallbacks, I think that these occur when the interface queues are full and the router allocates main memory for more queued packets. Something may be a bit busy.
How is the CPU?
I suggest that you could monitor these buffer failures to see if they occur regularly or maybe in a burst that could be swamping the router and resulting in the failure.
A 2500 is a pretty marginal device in a modern LAN. All it would need is a few broadcasts and it would be filled up for a while.
About the smallest routers that you can get today from Cisco that have not had end-of-life announced are the 850/870. they do 25000/10000 packets per second. A 2500 does 4400 pps.
I have in the past applied access lists to try to protect routers from Windows broadcasts. Search the group for the thread "too many input drops in a 1721 router" "Queue Drops" "Input Drops With An Empty Input Queue"
Did you have to reboot or did "clear ip nat tr *" fix it?
Please also post sh int after failure. If you have another grab a show tech, sorry should have suggested that before.