Configuring the NAT Flow Table
Context
The timeout interval of a session varies for different protocols or ports. If a session is not used within a specified period, the session becomes invalid and the system deletes it from the NAT flow table. For example, if a user establishes a TCP connection with an extranet host using an IP address and a port, this session is created in the NAT flow table. If the TCP connection is not used within the specified period of time, the session record is deleted from the NAT flow table.
Procedure
- Run the system-view command to enter the system view.
- Run the firewall-nat session { { dns | ftp | ftp-data | http | icmp | tcp | tcp-proxy | udp | sip | sip-media | rtsp | rtsp-media | pptp | pptp-data } | { tcp | udp } user-define port-number } aging-time time-value command to set the aging time of NAT mapping entries.
By default, the aging time of different protocols is as follows: DNS (120s), FTP (120s), FTP-data (120s), HTTP (120s), ICMP (20s), TCP (600s), TCP-proxy (10s), UDP (120s), SIP (1800s), SIP-media (120s), RTSP (60s), RTSP-media (120s), PPTP (600s), and PPTP-data (600s). The default aging time of session entries on a user-defined TCP or UDP port is the same as that of the corresponding protocol.
- (Optional) Run the reset nat session { all | transit interface interface-type interface-number [ .subnumber ] } command to clear NAT mapping entries.
Verifying the Configuration
Run the display nat session { all [ verbose ] | number } command to display information about entries in the NAT mapping table.
Run the display nat session protocol { protocol-name | protocol-number } [ source source-address [ source-port ] ] [ destination destination-address [ destination-port ] ] [ verbose ] command to display information about NAT mapping entries with a specified protocol or port number.
Run the display nat session source source-address [ source-port ] [ destination destination-address [ destination-port ] ] [ verbose ] command to display information about NAT mapping entries with a specified source IP address and port number before translation.
Run the display nat session destination destination-address [ destination-port ] [ verbose ] command to display information about NAT mapping entries with a specified destination IP address and port number before translation.
Run the display firewall-nat session aging-time command to check the aging time of NAT mapping entries.