topic Re: translation limit on pix/asa in Network Security

translation limit on pix/asa

suthomas1 — Mon, 11 Mar 2019 16:08:17 GMT

Hi,

Is there any limits on amount of translation that pix/asa can handle concurrently. Any commands to see this & for correcting it.

Thanks.

Re: translation limit on pix/asa

andrew.prince — Fri, 21 Aug 2009 07:21:31 GMT

65535 is the limit for translation slots, this of course refers to PAT and not static NAT.

The limit is set by the amount of TCP/UDP ports numbers available in the TCP/IP stack.

HTH>

Re: translation limit on pix/asa

hschaefers — Fri, 21 Aug 2009 13:06:22 GMT

Correct.

If you're reaching the theoretical limit of translations, you should be investing in more IP's for further translations.

Ports 1024+ is available of the 65535 for each IP you use.

However please note:

Depending on your ASA/PIX your unit may have lower limits on max translations based on its processor and memory capabilities.

Re: translation limit on pix/asa

jan.nielsen — Fri, 21 Aug 2009 15:03:05 GMT

Also, just a heads up if youre using ASA5505, you have a host license, which can be 10, 50 or unlimited users going through the asa at the same time.

Re: translation limit on pix/asa

rameshwar — Fri, 23 Oct 2009 16:43:20 GMT

Can you please tell me how me how many muximum ip address can be natted with single public ip address.

Re: translation limit on pix/asa

andrew.prince — Fri, 23 Oct 2009 17:43:45 GMT

1:1 NAT = 1

1:Many PAT = 65535

HTH>

Re: translation limit on pix/asa

rameshwar — Mon, 26 Oct 2009 11:30:42 GMT

Thnx Andrew,

Did you meen to say, i can nat 65535 IP addresses to one IP address?

Re: translation limit on pix/asa

andrew.prince — Mon, 26 Oct 2009 11:55:13 GMT

Not really!! with a 1:many - you will be using Port Address Tranlsation. You could have 1000 internal IP addresses and NAT them to 1 external IP address - and the ASA will have a PAT translation table with specific translation ports.

You could only have 1 internal IP and you could make 10,000 seperate outbound connections to the internet and the same priciple applies.

For every seperate outbound connection, the ASA creates 1 x PAT table entry. So that would be 65535-1 = 65534 left.

HTH>

Re: translation limit on pix/asa

rameshwar — Thu, 05 Nov 2009 09:32:43 GMT

Thnx adrew,

If you have any document on this then please share with me.

Re: translation limit on pix/asa

andrew.prince — Thu, 05 Nov 2009 09:45:29 GMT

http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/bafwcfg.html