Extended port block functionality in L2-Aware NAT contains an additional time stamp into the logging framework. In addition to the standardized Event-Timestamp that is carried in every RADIUS accounting message, a NAT-related timestamp is included. This additional timestamp is introduced in the accounting stream after the first extended port block for the subscriber is allocated and then it is present in every accounting message in the stream. It represents the time of the last extended port block allocation or de-allocation as recoded by the ISA or ESA.
The two timestamps should be interpreted as the following:
The Standard Event-Timestamp (55) attribute records the time when the accounting message was generated on the CPM.
The Alc-ISA-Event-Timestamp (241.26.6527.86) attribute records the time of the last NAT related event (extended port block allocation or de-allocation).
For example, a periodic I-U message below indicates that at the time 1000, a subscriber has two ports blocks allocated: [2001-2024] and [3000-3023]. The last change related to extended port blocks was at time 500.
The following are Periodic Interim-Updates with the NAT-related attributes:
Alc-Nat-Port-Range = "192.168.20.2 2001-2024,3000-3023 router base l2-aware"
Event-Timestamp = 1000
Alc-ISA-Event-Timestamp = 500
In the following scenario where:
the extended port block [3000-3023] was released a few milliseconds before the previous periodic Interim-Update message was sent
notification from the ISA or ESA about this event has not reached the CPM in time for the event to be included in periodic Interim-Update
Then, a triggered Interim-Update would immediately follow the above periodic Interim-Update with relevant NAT related attributes:
Alc-Nat-Port-Range = "192.168.20.2 3000-3023 router base l2-aware"
Alc-Acct-Triggered-Reason = Nat-Free
Event-Timestamp = 1000
Alc-ISA-Event-Timestamp = 999
Both messages have the same Event-Timestamp of 1000 because the resolution of this timestamp is 1 second. However, the port block [3000-3023] was released at time 999 as indicated by the Alc-ISA-Event-Timestamp. This scenario is shown in Figure: Alc-ISA-Event-Timestamp.
