topic Command: clear session id 135269 not working in General Topics

Command: clear session id 135269 not working

TranceforLife — Thu, 08 Dec 2016 13:20:45 GMT

Hi All,

Strange but cannot clear the session below. Did try from GUI first then from CLI. CLI says: session 135269 cleared after still able to see it as active

Any idea?

PAN-OS 6.1.7 PA-5050

Thx,

Myky

Re: Command: clear session id 135269 not working

BPry — Thu, 08 Dec 2016 13:54:32 GMT

@TranceforLife you can review this link that reaper put together but essentially the session id is going to keep showing the same information until it is overwritten. To verify you could run show session all filter source ip and replace IP with whatever the source IP address is to verify that the session itself isn't actually there anymore. You can replace source ip with destination ip depending on what direction this was actually going and what makes more sense on this session.

Re: Command: clear session id 135269 not working

TranceforLife — Thu, 08 Dec 2016 13:57:47 GMT

Hmm. Nice one. Didn't know that 🙂 Thank you

Re: Command: clear session id 135269 not working

TranceforLife — Thu, 08 Dec 2016 14:08:24 GMT

@BPry Even more interesting. Still active

Re: Command: clear session id 135269 not working

BPry — Thu, 08 Dec 2016 14:28:33 GMT

If it's a tunnel I would bet that it's reopening so fast that it must be taking the same session. The interseting thing is that it's keeping the same session number, one would suspect that if it's relaunching the session ID would change since you have cleared the session id from the table.

The only way that I could really see this happening is if 135269 is the last session that you have open, therefore when the tunnel brings itself back up it's just taking the session id since it's the next one available?

Re: Command: clear session id 135269 not working

TranceforLife — Thu, 08 Dec 2016 14:41:21 GMT

@BPryCould be. What l could see that the time when session is established still Nov 8 10:28:36 2016 and TTL is decrementing)))

timeout : 268435455 sec
time to live : 265828673 sec

timeout : 268435455 sec
time to live : 265828639 sec

Re: Command: clear session id 135269 not working

BPry — Thu, 08 Dec 2016 15:29:19 GMT

Very interesting. I would say to try to create a deny rule in your policy list but since the session is already active that isn't going to work anyways. I'd be interested in hearing what TAC has to say about it and if they can find a way to clear it out successfully; this is a very weird issue to run into.

Re: Command: clear session id 135269 not working

reaper — Thu, 08 Dec 2016 15:59:44 GMT

i'm a bit late to the party:

you can't clear 'tunnel' sessions for vpn tunnels configured on the firewall, those are maintained by the system and depend on ikemgr releasing the session

Re: Command: clear session id 135269 not working

TranceforLife — Thu, 08 Dec 2016 16:27:51 GMT

Hi reaper,

That actually answer the question. l also noticed that this tunnel session a bit different than traditional:

no ingress/egress interface and TTL is very high.

Thanks All,

Myky