> Your application cannot be told to do some keep-alive type message at a > frequency of less than 10 minutes over the TCP connection ?
I asked that question of the product tech support and got a 'Huh?'. I didn't pursue it. > Another thing you might want to do is use map-block. > This uses an algorithm that will result in the same NAT'ing every time, > so that if a NAT session times out, a packet sent in the direction that > caused the prior NAT mapping to be created will create another one the > same (not restricted to SYN flags.) This will not work if the next > packet sent comes from the destination of the connection, however. I tried the MAP-BLOCK today and this appears to be a satisfactory solution. The connections were 'kept alive' for at least an hour AND the users could step away from their desk for more than 10 minutes without having to log back into the application (which itself could take 2-5 minutes depending on traffic - I don't know how they kept their sanity!). This is MUCH better than what we were experiencing before. Thank you for your assistance! -jwb
