topic TCP session timeout in Next-Generation Firewall Discussions

TCP session timeout

Doyenadmin — Mon, 19 Sep 2022 15:29:52 GMT

Hello Team,

Just a query - wanted to understand few things related to PA- sessions timeout.

We have a server - which needs to connect to a specific port say 8xxx or 9xxx but unfortunately it requires connection to be established till more that 10 hours say 12 hours for example.

So how can i achieve this ?

1. can i change global setting of TCP session of 3600 to 43200 -12 hours , if yes that what impact will i be facing.

current scenario my MP and DP load is 3-6%

2. For that security policy - under service ports - 8xxx and 9xxx if i increase the TCP session timeout setting to 43200 -12 hours.

will it override the global settings which is applied for all sessions ?

Please guide or at least provide a specific document to justify to the customer.

Re: TCP session timeout

PavelK — Wed, 21 Sep 2022 21:45:48 GMT

Hello @Doyenadmin

thank you for the post.

1. Personally, I would start with changing it on application / service port level first instead of changing it globally for all sessions. Regarding impact changing this globally, it is hard to give estimate without knowing your customer traffic environment, however since firewall has to maintain sessions for prolog time, you could doble your DP utilization. Also you should watch for maximum session count and memory utilization.

2. This is correct understanding. Changing time out on service port level will override global setting: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/app-id/service-based-session-timeouts

Kind Regards

Pavel

Re: TCP session timeout

Doyenadmin — Thu, 22 Sep 2022 04:26:23 GMT

Thanks alot @PavelK for confirming the same, appreciate your help.