topic Session length calculation - PaloAlto in General Topics

Session length calculation - PaloAlto

EMIND — Thu, 24 Feb 2022 13:08:28 GMT

Hello,

does anybody know, how exactly the Session length for a session is calculated in PAN-OS?
Is it depended on the system time?
--> Would my TTL decrease if the system time changes and therefore reset my TCP session if the threshold of the TTL is reached (Or aged-out with UDP)?

Regards,

Eric

Re: Session length calculation - PaloAlto

BPry — Fri, 25 Feb 2022 02:47:34 GMT

@EMIND,

I'm not positive on this, but I'm assuming that the TTL is actually handled on Epoch time like most session related networking hardware.

Re: Session length calculation - PaloAlto

Kuhic567 — Wed, 02 Mar 2022 21:45:51 GMT

@EMIND wrote:

Hello,

does anybody know, how exactly the Session length for a session is calculated in PAN-OS?
Is it depended on the system time?
--> Would my TTL decrease if the system time changes and therefore reset my TCP session if the threshold of the TTL is reached (Or aged-out with UDP)?

Regards,

Eric

Select Rematch all sessions on config policy change to apply newly configured Security policy rules to sessions that are already in progress. This capability is enabled by default. If you clear this check box, any policy rule changes you make apply only to sessions initiated after you commit the policy change.

Re: Session length calculation - PaloAlto

Adrian_Jensen — Fri, 25 Feb 2022 19:03:40 GMT

The bot accounts in the PA forums are really getting out of control. New user "Kuhic567":

- account created 2022-02-14

- 02-15 makes reply post on 2 month old thread that is direct quote from a third party article searched by keyword

- 02-15 makes reply post that is direct quote from Cisco forum

- 02-25 makes giberish reply post

$10 says that tomorrow morning the new account edits the above post to include a spam/phishing link.

Re: Session length calculation - PaloAlto

EMIND — Mon, 28 Feb 2022 15:57:45 GMT

I researched the toppic a little bit further.
Some vendors implemented a function to mitigate a session timeout problem.
They implemented some sort of dif. time value to the Epoch time after a big time change.
I wasn't able to find any documentations from palo if this feature is present in PAN-OS.
(@Adrian: You lost 10 bucks 😄 )

Re: Session length calculation - PaloAlto

Adrian_Jensen — Mon, 28 Feb 2022 16:23:34 GMT

@EMIND So it seems, for the moment... But if some other threads are an indication, where most of the replies are bots, I don't think I will have to what long to make up the loss.

Re: Session length calculation - PaloAlto

Adrian_Jensen — Wed, 02 Mar 2022 20:56:39 GMT

@EMIND I win my $10 bet... Bot account edited previous reply to include spam link "MiBridges Login" pointing to www(.)mibridges(.)me

Re: Session length calculation - PaloAlto

jdelio — Thu, 03 Mar 2022 16:10:49 GMT

Sorry about Kuhic567, he has been banned..