Cisco IOS Cookbook, 2nd Edition (2024)

You want to change the length of time that NAT entries remain active.

The router will keep NAT entries in the translation table for a configurable length of time. For TCP connections, the default timeout period is 86,400 seconds, or 24 hours. Because UDP is not connection based, the default timeout period is much shorter—only 300 seconds, or 5 minutes. The router will remove translation table entries for DNS queries after only 60 seconds.

You can adjust these parameters using the ip nat translation command, which accepts arguments in seconds:

Router#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)#ip nat translation tcp-timeout 500Router(config)#ip nat translation udp-timeout 30Router(config)#ip nat translation dns-timeout 30Router(config)#ip nat translation icmp-timeout 30Router(config)#ip nat translation finrst-timeout 30Router(config)#ip nat translation syn-timeout 30Router(config)#endRouter#

To save router memory, you can also define a maximum number of NAT translation table entries:

Router#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)#ip nat translation max-entries 1000Router(config)#endRouter#

There are many reasons for adjusting these various timeout parameters; most are related to router performance. If sessions are generally short-lived, it is a waste of memory to maintain the NAT entries for a long time. The finrst-timeout and ...