NAT TIMEOUT RECOMMENDATIONS

[nicolasvibert]

Hello,

My client has PAT configured, on a 3725 and its NAT Translation table has about 1000 translations.

We would like to lower this number with the following commands:

ip nat translation udp-timeout <seconds>

ip nat translation dns-timeout <seconds>

ip nat translation tcp-timeout <seconds>

ip nat translation finrst-timeout <seconds>

When port translation is configured, there is finer control over translation entry timeouts, because each entry contains more context about the traffic using it. Non-DNS UDP translations time out after 5 minutes; DNS times out in 1 minute. TCP translations time out after 24 hours, unless a RST or FIN is seen on the stream, in which case it times out in 1 minute.

I was wondering if Cisco recommended any timeout, obviously lower than the default ones above, but not too low to disrupt the network.

any ideas?

Thanks,

Nicolas

[thomas.chen]

Don't think there are any low values defined for the timeout values. The default values are the same as you had mentioned. Non-DNS UDP translations time out after 5 minutes, and DNS times out in 1 minute. TCP translations time out in 24 hours, unless an RST or FIN bit is seen on the stream, in which case they will time out in 1 minute.