topic idle traffic sessions in General Topics

idle traffic sessions

jdprovine — Tue, 17 Nov 2015 19:30:23 GMT

I know that you set timeout for global protecte sessions that go idle but can you set other idle traffic to time out?

Re: idle traffic sessions

kiwi — Wed, 18 Nov 2015 08:30:07 GMT

Under Device tab > Setup > Session you will find all the configurable session timeouts :

Also configurable in CLI :

set session timeout-tcp <1-15999999>

set session timeout-udp <1-15999999>

set session timeout-icmp <1-15999999>

set session timeout-default <1-15999999>

set session timeout-tcpinit <1-60>

set session timeout-tcphandshake <1-60>

set session timeout-tcp-half-closed <1-604800>

set session timeout-tcp-unverified-rst <1-600>

set session timeout-tcp-time-wait <1-600>

set session timeout-captive-portal <1-15999999>

set session timeout-scan <5-30>

set session timeout-discard-tcp <1-15999999>

set session timeout-discard-udp <1-15999999>

set session timeout-discard-default <1-15999999>

Also, per application you can configure your timeout :

Objects tab > Applications > Select your application :

Hope this helps,

-Kim.

Re: idle traffic sessions

jdprovine — Wed, 18 Nov 2015 13:40:39 GMT

Interesting but that is all tcp traffic correct?

Re: idle traffic sessions

Raido_Rattameister — Wed, 18 Nov 2015 14:21:20 GMT

What is TCP?

GlobalProtect can be UDP also (and it usually is).

Re: idle traffic sessions

kiwi — Wed, 18 Nov 2015 15:06:13 GMT

Hi jprovine,

Notice there are TCP, UDP, ICMP and default session timers in the first screenshot and CLI commands (so not only tcp).

Also, if you select an application from the list you can change the timeouts depening on the application options (f.e. application 'dns' has both TCP and UDP timeouts).

Hope this helps,

-Kim.

Re: idle traffic sessions

jdprovine — Thu, 19 Nov 2015 13:36:20 GMT

We actually want to be able to set time outs on specific traffic or security policies. Can that be done?

Re: idle traffic sessions

reaper — Thu, 19 Nov 2015 13:43:22 GMT

you can't set idle timers on specific session but you can for specific applications

if that is still too broad you could set an application override so a certain connection becomes a custom application, which you can then control from the custom app's settings

hope this helps

Tom

Re: idle traffic sessions

jdprovine — Thu, 19 Nov 2015 21:29:08 GMT

That's what I thought but I just wanted to make sure