Global Address Guidelines; Configuring An Idle Timeout For Nat - Cisco 4700M Configuration Manual

Configuring an Idle Timeout for NAT

Global Address Guidelines

Configuring an Idle Timeout for NAT
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
5-8
When you translate the local address to a global address, you can use the
following global addresses:
Addresses on the same network as the global interface—If you use addresses
•
on the same network as the global interface (through which traffic exits the
ACE), the ACE uses proxy ARP to answer any requests for translated
addresses and thus intercepts traffic destined for a local address. This solution
simplifies routing, because the ACE does not need to be the gateway for any
additional networks. However, this approach does put a limit on the number
of available addresses used for translations.
Note You cannot use the IP address of the global interface for NAT or PAT.
• Addresses on a unique network—If you need more addresses than are
available on the global interface network, you can identify addresses on a
different subnet. The ACE uses proxy ARP to answer any requests for
translated addresses, so it intercepts traffic destined for a local address. You
need to add a static route on the upstream router that sends traffic destined for
the translated addresses on the ACE.
You cannot configure global IP address ranges across subnets. For example, the
following command is not allowed and will generate an Invalid IP address error:
nat-pool 2 10.0.6.1 10.0.7.20 netmask 255.255.255.0.
You must configure a netmask when configuring a NAT pool. A netmask of
255.255.255.255 instructs the ACE to use all the IP addresses in the range.
You can configure an idle timeout for NAT by using the timeout xlate command
in configuration mode. The syntax of this command is as follows:
timeout xlate seconds
The seconds argument is an integer from 60 to 2147483. The default is 10800
seconds (3 hours). The seconds value determines how long the ACE waits to free
the Xlate slot after it becomes idle.
Chapter 5 Configuring Network Address Translation
OL-16202-01