Newly Configured NAT Does not Take Effect Because the Session has not Aged

Publication Date:  2012-07-17 Views:  46 Downloads:  0
Issue Description

1.          According to the original NAT configuration on the USG5000, the internal server C.C.C.C uses the address A.A.A.A in the public address pool. Later, the internal server C.C.C.C uses the address B.B.B.B in another address pool, and the NAT is re-configured. After the address change, the TCP service provided by the C.C.C.C is down.

Alarm Information
None.
Handling Process
When the workload is comparatively light, run the reset firewall session table command to clear the session table. The problem is rectified.
Root Cause

1.          Check the configuration. No error is found.

2.          Run the display firewall session command to check the session table. The session of the C.C.C.C for accessing the public network still uses the address pool where A.A.A.A is. The session is for the TCP service that runs uninterruptedly on the internal server C.C.C.C. Server C.C.C.C sends TCP traffic uninterruptedly, preventing the TCP session from aging. Therefore, the TCP session still uses the address pool where A.A.A.A is after the configuration is changed. As a result, the TCP service is interrupted.

Suggestions
None.

END