The state entry should stay active as long as matching packets are flowing through the router. You can change the amount of time that an entry waits to time-out if no matching packets are seen (the ...
I have written this config on a 1811 where two vlans are natted to the internet while protecting one from the other. Basically the 10 network will be considered private or administrative and the 172 ...