Darren,
Thank you for taking the time to look through this for me - I truly
appreciate it. Here is an update.
I implemented the code that you gave and everything compiled, rebooted
successfully. Good. I tested the age parameter and the age is still set to
the default age of 10 minutes.
Then I decided to RTF man page. Under 'man 5 ipnat', the description of the
age parameter states:
age If more refined timeouts are required than those
available globally for NAT settings, this allows
you to set them for non-TCP use.
Ahh, the key is for non-TCP use. That explains why I have been beating my
head against the wall. I was looking at the age parameter from the
perspective that it allowed me to set age on TCP sessions. Again, my bad.
Since this only allows the age parameter for non-TCP settings, can you
suggest a way that I can boost the age for a TCP-based NAT session so that
the age can be greater than the default age? The only way that I can think
of doing this under MY circumstances is to dedicate a firewall to this
TCP-based application where the firewall would be located on the local
subnet and would be the default route for clients of that subnet for that
particular service. Since the destination address of the computer providing
the service is static, I could change the default timeout for the NAT
mapping to whatever I wanted it to be, say 1 hour, and then the only traffic
this particular firewall would handle is this special TCP-based session.
The clients would have this firewall as the default route for this
destination address only and have the core switch as the default route for
all other traffic. Does this sound reasonable?
I don't want to be a pain. I really enjoy using ipfilter and will continue
to use it. It works and works well. I do realize that my circumstances are
unique and that I may need to figure out a work-around that is not centrally
managed.
Any assistance/direction you (or anyone else) can provide is greatly
appreciated.
-jwb
-----Original Message-----
From: Darren Reed [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, February 19, 2003 7:21 AM
To: Beers, James W.
Cc: 'Darren Reed'; '[EMAIL PROTECTED]'
Subject: Re: IPNAT Age vs. IPFILTER Age
In some email I received from Beers, James W., sie wrote:
> Darren,
>
> I understand why it is there and am glad that it is because I don't want
to
> deal with file sharing connections that don't time out. Is there any way
I
> can run with LARGE_NAT defined and still use the 'age' option with a
MAPing
> in ipnat.conf? My suggestion was the only one that I could think of off
the
> top of my head. The only other way around the problem that I can see is
to
> change the code so that:
>
> <psuedo-code on>
> if LARGE_NAT is defined
> if there is an age parameter, set it to the age parameter
> if not age parameter, set it to the 10 minute default
> <psuedo-code off>
This makes a lot of sense. Try the patch below.
Darren
Index: ip_nat.c
===================================================================
RCS file: /devel/CVS/IP-Filter/ip_nat.c,v
retrieving revision 2.37.2.74
diff -c -r2.37.2.74 ip_nat.c
*** ip_nat.c 2002/12/06 11:40:21 2.37.2.74
--- ip_nat.c 2003/02/19 12:21:09
***************
*** 2510,2516 ****
if (nat->nat_age < fr_defnaticmpage)
nat->nat_age = fr_defnaticmpage;
#ifdef LARGE_NAT
! else if (nat->nat_age > fr_defnatage)
nat->nat_age = fr_defnatage;
#endif
/*
--- 2510,2517 ----
if (nat->nat_age < fr_defnaticmpage)
nat->nat_age = fr_defnaticmpage;
#ifdef LARGE_NAT
! else if ((!np || !np->in_age[1]) &&
! (nat->nat_age > fr_defnatage))
nat->nat_age = fr_defnatage;
#endif
/*
***************
*** 2731,2737 ****
if (nat->nat_age < fr_defnaticmpage)
nat->nat_age = fr_defnaticmpage;
#ifdef LARGE_NAT
! else if (nat->nat_age > fr_defnatage)
nat->nat_age = fr_defnatage;
#endif
/*
--- 2732,2739 ----
if (nat->nat_age < fr_defnaticmpage)
nat->nat_age = fr_defnaticmpage;
#ifdef LARGE_NAT
! else if ((!np || !np->in_age[0]) &&
! (nat->nat_age > fr_defnatage))
nat->nat_age = fr_defnatage;
#endif
/*
