Technical Tip: How to count IP pool, DNAT and SNAT sessions

[leej]

Description

This article describes how to count IP pool, DNAT and SNAT sessions respectively.

Scope

FortiGate.

Solution

1. Count of IP pool sessions.

diagnose firewall ippool-all stats

vdom:root owns 1 ippool(s)
name: test
type: overload
startip: 172.16.14.60
endip: 172.16.14.65
total ses: 20
tcp ses: 16
udp ses: 2
other ses: 2

2. Count of SNAT sessions for originating direction.

diagnose sys session list | grep -c 'dir=org act=snat'33

This result equals to those of the output of 'dir=reply act=dnat'

diagnose sys session list | grep -c 'dir=reply act=dnat'33

3. Count of DNAT sessions for originating direction.
   
   

diagnose sys session list | grep -c 'dir=org act=dnat'1

4. This result equals to those of the output of 'dir=reply act=snat'

diagnose sys session list | grep -c "dir=reply act=snat"1

5. Complete list of sessions to which the NAT IP is currently applied. In this example, x.x.x.x is the Source NAT IP

diagnose sys session filter nsrc x.x.x.x
diagnose sys session list

Note:

v5.0 up to 6.4 is out of engineering support. So these commands might be different on higher versions. Consider upgrading the firmware level on the device to a supported version (7.0 up to 7.6). Check the firmware path and compatibility depending on the hardware: Upgrade tool.