clear xlate

[aksher]

after finishing off with the nat statements we give clear xlate command

but where as for conn we dont give clear conn. when initiating a connection and if we see it on firewall using sh conn we can see the conn details but to see this nat info using sh xlate it takes 3 hrs by default or we can see it only if clear xlate is given..is it correct?

[a.kiprawih]

Hi Aksher,

The "clear xlate" command allows you to manually clear the current (live) translation table. This command is useful if you configure your NAT and want to test it immediately.

By default, the translation (xlate) table is set to remain for 3 hours (so what you see was correct) before it starts to flush/refresh again (use 'show xlate" to view this table ). You can see this in your firewall config as follow:

timeout xlate 3:00:00 --> default 3 hour

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

You can also use "clear conn" to manually flush the current connection table. Bear in mind clearing xlate or connection will flush the whole active translation & connections, but useful for testing purposes.

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_chapter09186a008042d6f9.html#wp1054048

Rgds,

AK