Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

xlate count and connection count

Can a firewall show more XLATE created than CONNECTIONS?

Is that theoretically possible to have more XLATEs than the total number of connections?. the reason I am asking, that assuming a Cisco 5510 has have maximum 130,000 total connections, however xlate limit on an ASA is considered as UNLIMITED.

I am designing a large network having multiple CIsco ASAs deployed as multi context mode to cater various networks inside the organization. I want to create proper resources per class. So far Xlate count vs. connection count is not very clear.. I tried putting a very large value for xlate and the firewall accepted it, and still showed the total percentage as 0%

Xlates           default          all      CA  unlimited                     

                 123                2       C 2147483647 4294967294      0.00%

                 All Contexts:      3                    4294967294      0.00%

Whereas connection count is shown as

Conns            default          all      CA  unlimited                     

                 123                2       C      65000     130000    100.00%

                 All Contexts:      3                        130000    100.00%

Any help is highly appreciated.

Thank you,

FNK    

2 REPLIES
Cisco Employee

xlate count and connection count

Hi Fawad,

Yes, this is possible. Keep in mind that the ASA immediately builds an xlate for any static NAT you have configured. Therefore, even with 0 connections on the box, the ASA can still have existing idle xlates (in the case of static NAT).

-Mike

xlate count and connection count

Hi

as far as i remember xlate is nat (regardless if it is static or not)

and on the IOS systems it is the same, static entries are in the table.

connections are actual session in the packetfilter/firewall sessions this is a differnet operation.

Patrick

1006
Views
0
Helpful
2
Replies
CreatePlease to create content