Template ID: 259

Common + NAT template

Element ID Name Type Description Applicable Edge Release
225 postNATSourceIPv4Address ipv4Address The definition of this information element is identical to the definition of information element sourceIPv4Address, except that it reports a modified value caused by a NAT middlebox function after the packet passed the observation point. 3.4.0
226 postNATDestinationIPv4Address ipv4Address The definition of this information element is identical to the definition of information element destinationIPv4Address, except that it reports a modified value caused by a NAT middlebox function after the packet passed the observation point. 3.4.0
Note:
  • Netflow exports are unidirectional flows. VMware SD-WAN needs to export flow stats as two flow records or implement RFC5103 (Bidirectional Flow Export).
  • flowID will need to be constructed to be unique within the Enterprise.
  • Direct NAT:
    • Consider a flow which comes from LAN client with IP 10.0.1.25 to Internet 169.254.6.18. This gets NATed due to business policy (SNAT source IP to a WAN interface IP 169.254.7.10). So, flow record for this flow will be with SIP: 10.0.1.25 and DIP: 169.254.6.18. The postNAT Source IP will be 169.254.7.10 and the postNAT Dest IP will be 169.254.6.18.