Cisco ASA Per-Session vs Multi-Session PAT

Hello Chris

Multi-session PAT is the default configuration within an ASA device. Any PAT translations that exist are kept open for 30 seconds before being flushed out. The reason for this is that it takes CPU power and resources to tear down and to reinitialize a PAT translation, so if a session that has ended restarts sending using the same translation and ports within those 30 seconds, there is no need to re-establish the connection, the translation already exists.

Per-session PAT is an improvement to this default because it quickly frees up translated ports, thus allowing them to be immediately available for use by new sessions. This is especially useful when you have a single external IP address that is being shared by a large number of internal hosts each running a multitude of applications. It results in a more efficient use of the available ports for use with PAT.

Now there is a problem with such a setup especially for real-time applications such as voice and video. A voice session for example, will have several packets being exchanged when users are talking, however, when both stop talking for any period of time, no new packets are exchanged. The Per-session configuration will consider such a case a terminated session and will tear down any translations that may exist. The users however continue talking, packets are exchanged, and new translations must be established. This takes time and resources and can cause disruptions in the voice conversation. Due to the nature of voice and of human speech, this can result in multiple re-establishments of translations causing an increase in resource usage as well as disruption in the voice conversation.

It is for this reason that VoIP sessions should be exempt from any per-session PAT and should remain under the default Multi-session PAT configuration.

I hope this has been helpful!

Laz

4 Likes