Filter
Top Products
5-51
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter 5 Configuring Twice NAT (ASA 8.3 and Later)
Feature History for Twice NAT
NAT support for reverse DNS lookups 9.0(1) NAT now supports translation of the DNS PTR record for
reverse DNS lookups when using IPv4 NAT, IPv6 NAT, and
NAT64 with DNS inspection enabled for the NAT rule.
Per-session PAT 9.0(1) The per-session PAT feature improves the scalability of PAT
and, for clustering, allows each member unit to own PAT
connections; multi-session PAT connections have to be
forwarded to and owned by the master unit. At the end of a
per-session PAT session, the ASA sends a reset and
immediately removes the xlate. This reset causes the end
node to immediately release the connection, avoiding the
TIME_WAIT state. Multi-session PAT, on the other hand,
uses the PAT timeout, by default 30 seconds. For
“hit-and-run” traffic, such as HTTP or HTTPS, the
per-session feature can dramatically increase the
connection rate supported by one address. Without the
per-session feature, the maximum connection rate for one
address for an IP protocol is approximately 2000 per
second. With the per-session feature, the connection rate for
one address for an IP protocol is 65535/average-lifetime.
By default, all TCP traffic and UDP DNS traffic use a
per-session PAT xlate. For traffic that requires multi-session
PAT, such as H.323, SIP, or Skinny, you can disable
per-session PAT by creating a per-session deny rule.
We introduced the following screen: Configuration >
Firewall > Advanced > Per-Session NAT Rules.
Table 5-1 Feature History for Twice NAT (continued)
Feature Name
Platform
Releases Feature Information