Xlate question, PIX 520

[jeasley]

Hello,

I have a host of remote users and offices that VPN to a PIX 520 daily, for access to a central system. We are implementing a DMZ to bring web and dns in house the higher ups here are afraid to execute a "clear xlate", for fear it will kill all VPN sessions and the help desk will get slammed with calls.

My question is, does "clear xlate" affect VPN tunnels originating from the outside, or does it only affect xlates that are created from the inside interfaces on the PIX?

Also what affect does this have? Will is kill users telnet sessions, or cause them to need to reconnect?

I apologize if this is a silly question in any way, but I can not find any information answering this anywhere on cisco.com.

Thanks.

[r-simpson]

Clear Xlate should only clear the translations from the NAT table and should not affect the VPN. So it will cause a momentary lapse for the internal users and for anyone hitting a static NAT address.