Forum Discussion

dragonflymr's avatar
dragonflymr
Icon for Cirrostratus rankCirrostratus
Mar 18, 2015

SNAT, VS and multiple Idle Timeout setting

Hi,   I am a bit lost how Idle Timeout (IT) is managed when there are different object involved for given connection.   VS has Idle Timeout set via TCP profile (let's say it's Standard VS), SNA...
application delivery
design
LTM
TMOS
Hannes_Rapp_162's avatar
Hannes_Rapp_162
Icon for Nacreous rankNacreous
Mar 19, 2015

In a given scenario, the connection's TCP idle timeout is 5 minutes (300 sec). The difference is that once the connection's record is removed from the Connections Table (due to timeout exceeded), the SNAT translation record will be retained for another 10 minutes (600 sec). In this state, the SNAT record will only consume memory and do nothing useful. For this reason, the SNAT record's Idle Timeout should be equal to the Idle Timeout value set in TCP profile, or less than that.

 

  • dragonflymr's avatar
    dragonflymr
    Icon for Cirrostratus rankCirrostratus
    Mar 19, 2015
    Are you sure about that? That can cause quite a mess (if I am not wrong) when setting is other way around: TCP IT - 300 s SNAT IT - 100s Will in this case SNAT record be removed before connection is removed for Connection Table? If so what will happen with connection - it will be broken because there will be no SNAT record used for src IP translation presesnt any more? Piotr
  • Hannes_Rapp_162's avatar
    Hannes_Rapp_162
    Icon for Nacreous rankNacreous
    Mar 19, 2015
    In an idle scenario, yes, the SNAT record will be removed before the TCP record. If the SNAT record is not in place while a packet for an existing TCP connection is received, a new SNAT record will be created and the session will not be interrupted. The impact to consider is very similar to TCP Idle Timeout vs. ARP record Idle Timeout - ARP records time out a lot sooner, but the TCP sessions are not interrupted because of that. Only thing you may want to consider is that setting a SNAT Idle Timeout value too low will start to consume CPU (due to the necessity of re-adding those SNAT records).
  • dragonflymr's avatar
    dragonflymr
    Icon for Cirrostratus rankCirrostratus
    Mar 24, 2015
    I was thinking about idle situation and I am a bit afraid that it is not so simple. If SNAT record will be removed and then new record created then new record can use different source port or even different src.IP (when SNAT pool used) - at least that is my view - there is no info about previous ip and port used for given connection because SNAT record was deleted. In this case connection should broke as at least different src port can be used for packets, and if I am not wrong receiving side will not recognize it as any existing connection and reject such packet. Am I wrong here? Piotr