topic Re: Ageout in General Topics

Ageout

KotreshaMC — Wed, 08 Jun 2016 12:41:45 GMT

Hi all,

I was able to ping external server from firewall and getting reply back from the server without any issues, however in firewall log it's showing aged out.

Anybody know the reason behind this?why we are getting agedout after proper response from the external server??

Regards,

Kotresha

Re: Ageout

Raido_Rattameister — Wed, 08 Jun 2016 13:18:07 GMT

Because ping (icmp) and udp protocols don't have session setup (3way handshake) and session turndown (4way handshake) just request and reply so palo will just fade out the session when timeout expires.

Re: Ageout

KotreshaMC — Wed, 08 Jun 2016 13:43:53 GMT

You mean to say it's common?? like it'ss be default agedout for ping request?

Re: Ageout

reaper — Wed, 08 Jun 2016 14:23:22 GMT

This is expected behavior because ICMP is a stateless protocol and does not have FIN or RST flags, so unless it is blocked by the firewall the session end reason will be aged-out