I'm experiencing a problem with an application and I believe that it is due to the fact that a NAT entry times out before the state entry in the ipfilter state table times out. The NAT age is set to the default (10 minutes) and the ipfilter state timeout has been set to 1 hour.
I have a set of users who use an application which opens 3 or more connections to a remote server. These connections correspond to open windows on the client machine. If I look at the NAT table using ipnat -l, is see all three NAT mappings have been established. If I look at the ipf state table using ipfstat -t -D 0,<prot>, I see the three connections established with a timeout of 1 hour. Everything is fine so far. There are various different scenarios that can occur, however, I will choose just one for the sake of simplicity. Let's say the user gets called away from their desk. The session sits idle for 11 minutes. Now all three of the NAT mappings have timed out, but the three ipf state entries still exist. When the user returns to their desk to do work, the application reports a problem because the NAT mappings don't exist anymore. Can I adjust the DEF_NAT_AGE in ip_nat.h and bump it up to be slightly less than the ipfilter state table timeout (say 45 to 50 minutes)? How will this affect the overall performance of the firewall? I realize that I will be keeping NAT mappings longer, so I would need to adjust the size of the NAT table. I had to do this anyway because of the number of users sitting behind the firewall using NAT (1200+ users) and would be willing to make it larger, but why should I track everyone's mapping longer than needed if it is just required for this one application. What would really be helpful is to have an 'age' option when defining NAT mappings so that I define an age for a specific protocol and port number. I searched through the list and found a similar request. I also found a response from Darren which said he was thinking about this suggestion, but I haven't seen anything further about it. Any ideas? ------------------------------------------------ -jwb Jim Beers Networking Team Leader Moravian College 610-861-1449
