cisco nat entries / firewall
Hi all.
I'm using a cisco 831 as my boarder router/nat/firewall.
I have a couple of static nat entries to forward certain ports to certian computers.
These nat entries are accompanied by ACLs (cisco firewall).
Only certain src. IPs can access the destination ports which are then forwared to the correct computers on the internal network.
I've found that the dynamic nat entries are not clearing out very quickly after 2 months+ uptime of the router. The only way I can get them to clear out is to reset the router(reload) (which causes several minutes of downtime).
A good sign that is is happening is my connection starts lagging. I then ssh into the router and issues the "sh ip nat tran" command and I see tons of dynamic nat entries (along with the static entries) that have not reset. (this would be similar to running the netstat -an command in windows to see connections that have not closed. I know that these connections are indeed closed because I've shut down the computer. The router just thinks that they are still active. I've seen these entries stay in there for over an hour. After a reboot they clear out and the dynamic nat entries are closed pretty quickly. (couple of seconds, if even that long.)
Why would this be happening? Is there a possible memory leak?
When this happens, does that create a vulnerability or hole in the firewall because the router has mapped certain ips to certain ports on the various comptuers? Since its a "stateful firewall", the router will allow traffic from those PCs even though the connection should be have been closed?
I'm using the latest IOS for my router, so there is no "firmware" to update at the moment.
This seems to happen with other IOS versions too.
I can attach a clean copy of my config if that would help.
It is kind of bloated at the moment, but I'll can clean it up. (lots of remarks)
OH, FYI- my flash memory is pretty much maxed out. (IOS and SDM) I'm going to add more flash when I have the extra cash, but can't do it for a couple more months. But that is just storage, not actual RAM.
The uptime on the router doesn't normally last a couple months. I end up with a power outage or such and I don't have a backup battery on the router. I only have batteries on the server. It is a home network, and not *that* big of deal... but its bugging the hell out of me.
Thanks for any insight as to what the problem could be.