topic Re: Default application timeout values in General Topics

Default application timeout values

smccall — Wed, 18 Sep 2013 16:22:13 GMT

Is there a document that shows what the default application specific timeout values are?

Re: Default application timeout values

shasnain — Wed, 18 Sep 2013 16:24:43 GMT

On the PA on the Gui if you go to Objects and then applications and then click on any of the application it will show the timeout values.

Thanks,

Syed R Hasnain

Re: Default application timeout values

Phoenix — Wed, 18 Sep 2013 16:29:00 GMT

Hello,

In the below screenshot as explained by shasnain we can select any application in specific and look for the timeouts. If needed we can modify right there by Customizing it.

Hope this helps.

Re: Default application timeout values

mbutt — Wed, 18 Sep 2013 17:13:13 GMT

The default session timeout values can be seen by running the command from CLI

show session info

Session timeout

TCP default timeout: 3600 secs

TCP session timeout before SYN-ACK received: 5 secs

TCP session timeout before 3-way handshaking: 10 secs

TCP session timeout after FIN/RST: 30 secs

UDP default timeout: 30 secs

ICMP default timeout: 6 secs

other IP default timeout: 30 secs

Captive Portal session timeout: 30 secs

Session timeout in discard state:

TCP: 90 secs, UDP: 60 secs, other IP protocols: 60 secs

--------------------------------------------------------------------------------

Session accelerated aging: True

Accelerated aging threshold: 80% of utilization

Scaling factor: 2 X

--------------------------------------------------------------------------------

However there is no existing doc that i am aware of which will show the session timeout value for each application. As explained above you and look at each application to find their individual timeout values.

Thanks

Numan

Re: Default application timeout values

smccall — Thu, 19 Sep 2013 13:47:40 GMT

I was aware on how to check the applications and the system timeouts, but thanks for the try.

I was just wondering if Palo or anyone has taken the time to create a spreadsheet with the default application timeouts. I wanted to distribute to our application development teams so they could identify network settings as the build their applications.

Guess this isn't around quite yet, maybe if I get some time I will try to create it and post it.

Re: Default application timeout values

ukhapre — Fri, 20 Sep 2013 01:02:55 GMT

You can check with SE if he is able to get default timeout information.

FYI - if you need application timeout changed only for certain traffic and not all the traffic then,

1. create a custom app with higher timeout value.

2. Setup application override policy

https://live.paloaltonetworks.com/docs/DOC-1071

3. Create a security rule to allow new custom application.

This way you have control timeout for interesting traffic only.

Re: Default application timeout values

zarina — Fri, 27 Sep 2013 19:20:21 GMT

You can get this list using API. Generate an API key for the session:

https://<ip_address>/api/?type=keygen&user=<username>&password=<password>

and use it in the syntax below:

https://<ip_address>/api/?type=config&key=<obtained_from_above>&action=get&xpath=/config/predefined/application