diff --git a/src/afs/afs_conn.c b/src/afs/afs_conn.c
index 38cdf23d93..ce4dc0b76d 100644
--- a/src/afs/afs_conn.c
+++ b/src/afs/afs_conn.c
@@ -295,7 +295,12 @@ afs_ConnBySA(struct srvAddr *sap, unsigned short aport, afs_int32 acell,
 	}
 	rx_SetConnIdleDeadTime(tc->id, afs_rx_idledead);
 
-	rx_SetConnSecondsUntilNatPing(tc->id, 20);
+	/*
+	 * Only do this for the base connection, not per-user.
+	 * Will need to be revisited if/when CB gets security.
+	 */
+	if (isec == 0)
+	    rx_SetConnSecondsUntilNatPing(tc->id, 20);
 
 	tc->forceConnectFS = 0;	/* apparently we're appropriately connected now */
 	if (csec)