topic Re: Session timeout in General Topics

Session timeout

frankieyahoo — Wed, 19 Oct 2016 02:56:01 GMT

Hi,

From reading this article below:

Connection Timeout Even When Heartbeat Packet Sent

https://live.paloaltonetworks.com/t5/Management-Articles/Connection-Timeout-Even-When-Heartbeat-Packet-Sent/ta-p/61435

It says "The session timeout is set to 60 minutes"; what does it mean of this sentence? Which timer represents the session timeout value here (set to 60 minutes)?

It says "This means 16 heartbeat packets are required to reset the timeout value."

If the heartbeat interval is 3 minutes. 3x16 = 48 minutes, which is shorter than 60 minutes. Does it mean that it won't encounter this 60 minutes of session timeout?

What is the function of "session offload"?

Re: Session timeout

kiwi — Wed, 19 Oct 2016 07:32:45 GMT

Hi,

Session timeout

TCP default timeout: 3600 secs

Also this article explains offloading :

https://live.paloaltonetworks.com/t5/Management-Articles/Why-and-When-are-Sessions-Offloaded/ta-p/61278

Kind regards,

-Kim.

Re: Session timeout

frankieyahoo — Wed, 19 Oct 2016 12:55:16 GMT

Hi Kim,

Session timeout

TCP default timeout: 3600 secs

Function of this timer, does it mean that if the TCP session has no activity or no any new packets exchange within this 3600 seconds (1 hour), then the TCP session will be dropped (TCP aged-out)?

But if there are heartbeat packets communicating within this 1 hour, why this TCP default timeout could still take effect after 1 hour? Or heartbeat message can not be counted as monitored packet here?

Re: Session timeout

TranceforLife — Wed, 19 Oct 2016 13:12:19 GMT

Good question. l want to hear reply as well

Re: Session timeout

kiwi — Wed, 19 Oct 2016 14:15:13 GMT

That is correct.

For offloaded TCP sessions the following rules apply :

# TCP session, 16 packets per flow (i.e. 32 packets per session, bi-directional) is needed to refresh session TTL timer. This is a performance consideration.

In addition to the mentioned workarounds in the first article you posted you could also disable offloading. Note that this approach can have a noticeable impact on the CPU and is not recommended.

-Kim.