This article describes the NAT table timeout value behaviour on SRX.

The incoming dip NAT table is replaced with ALG cone NAT binding table and the

"show security nat incoming-table" command is obsolete from Junos OS Release 11.2 onward.

For the details about "show security nat incoming-table"command, please refer to KB22205 [juniper.net].

We want to check the nat table from 11.2 onward.

Cone nat indicates persistent nat.

We should use following command to check the nat table timeout value.

> show security nat source persistent-nat-table

e.g:

[edit]

root@SRX# run show security nat source persistent-nat-table pool test

Internal Reflective Source Type Left_time/ Curr_Sess_Num/ Source

In_IP In_Port I_Proto Ref_IP Ref_Port R_Proto NAT Pool Conf_time Max_Sess_Num NAT Rule

1.1.1.x 64524 tcp 172.16.10.xx 7888 tcp test any-remote-host 94/100 0/32 pnat-rule 

Note: The inactivity-timeout value is for persistent nat.

Persistent NAT is used to maintain the same NAT binding for a specific internal transport address, even after the original session is closed. This allows external hosts to initiate new sessions to the internal host using the same reflexive transport address.

For normal Source NAT and Destination NAT, it follows security flow session.

We don't have NAT table timeout value.