topic Re: Override Application timeouts in General Topics

Override Application timeouts

jkw117 — Mon, 21 Dec 2015 21:43:01 GMT

Okay, so the basic gist of what is going.

We are moving from an ASA to a PA-3020 a vendor we work with needs to have these timeout settings:

arp timeout 14400
timeout xlate 3:00:00
timeout conn 12:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 12:30:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00

we set them globally on our ASA, but now we want to use an application specific timeout on the paloalto. I made a custom app, and then made an override for it so that as long as the traffic was going over the specified port and between specific clients and their server it was marked as the new custom appid I made with these timeouts:

Timeout: 3600

TCP Timeout:3600

UDP Timeout: blank

TCP half closed: 600

TCP Time Wait: 600

Even with these settings the application is still resetting it's tcp session and essentially logging them out of the app. Any suggestions, and I really don't want to set these settings globally.

Re: Override Application timeouts

glastra1 — Tue, 22 Dec 2015 02:27:41 GMT

Pretty high timeouts, is it possible they can configure a keep alive in the application?

I think that the equivalent to 12 hours would be 43200 seconds (TCP timeout to configure in PAN) try changing it, I recomend you to check the session end reason in the logs and see if you've "age-outs".

https://live.paloaltonetworks.com/t5/Learning-Articles/Session-Tracker-Feature/ta-p/61790

Regards,

Gerardo.

Re: Override Application timeouts

jdelio — Mon, 04 Jan 2016 20:09:19 GMT

I would recommend that you first look in your traffic logs, and ensure that the App Override is showing up with your Custom App name as you have configured.

If the custom app name is showing up, then you do not have the App override configured properly.

If the custom app name is NOT showing up, then you have to go into the session information and look for the timeout values there.

Hopefully this helps, otherwise It is recommended that you contact support