Darren,
I understand why it is there and am glad that it is because I don't want to
deal with file sharing connections that don't time out. Is there any way I
can run with LARGE_NAT defined and still use the 'age' option with a MAPing
in ipnat.conf? My suggestion was the only one that I could think of off the
top of my head. The only other way around the problem that I can see is to
change the code so that:
<psuedo-code on>
if LARGE_NAT is defined
if there is an age parameter, set it to the age parameter
if not age parameter, set it to the 10 minute default
<psuedo-code off>
Both suggestions are being offered with the knowledge that I do NOT know how
it will affect the rest of the operation of the firewall.
-jwb
-----Original Message-----
From: Darren Reed [mailto:[EMAIL PROTECTED]]
Sent: Thursday, February 13, 2003 10:54 AM
To: Beers, James W.
Cc: '[EMAIL PROTECTED]'
Subject: Re: IPNAT Age vs. IPFILTER Age
In some email I received from Beers, James W., sie wrote:
[...]
> The problem still exists. If I monitor connections from the 10.168.1.0
> subnet using ipnat -lv, it appears as if the age parameter is not being
> utilized. Could this be happening because I have LARGE_NAT enabled? I do
> not purport to be a coder, so please bear with me and correct me if I am
> wrong.
>
> When I look into ip_nat.c, I find the following lines of code in the
> ip_natout function:
>
> #ifdef LARGE_NAT
> else if (nat->nat_age > fr_defnatage)
> nat->nat_age = fr_defnatage;
> #endif
This is hear because the idea is that when LARGE_NAT is defined,
you are doing *lots* of sessions so you don't want any hanging
around for any large period of time, idle.
Darren
