topic Re: set up TCP ports timeout in General Topics

set up TCP ports timeout

Apadilla — Fri, 30 Dec 2016 00:29:27 GMT

Hello Community,

I need to know if it is possible?

change the timeout for the following TCP ports to 4 hours (14400 seconds)

TCP 1521
TCP 2101
TCP 1601-1630
TCP 2101
TCP 18400-18430

Best Regards

Andres Padilla

Re: set up TCP ports timeout

santonic — Fri, 30 Dec 2016 08:05:44 GMT

You can change the 'TCP timeout' option on the aplication which is recognised for that traffic. Or even better; make app override for that traffic and change the setting on this new app.

Re: set up TCP ports timeout

kiwi — Fri, 30 Dec 2016 08:25:47 GMT

Hi @Apadilla,

You can change the TCP timeout for an application, but not for the services.
For the services, there is no option to change the timeout. By default it will use global timeout setting.

That being said, it should be possible to achieve your objective by using a custom application together with application override.

Create the Custom Application:
Leaving the defaults set to none on the advanced tab. Here you can also adjust the timeout setting.
Create the Service Port.
Create the Policy for Application Override.
Policies > Application Override.
In here define the source and destination traffic. then map your port and the custom application.
Under the Protocol/Application tab, set the port number and your custom app that you created in step 1
Create the Security Policy.
Define source and destination as specific as possible. Map the new service you defined in Step 2, and the custom application you created in Step 1.

Cheers !

-Kim.

Re: set up TCP ports timeout

TranceforLife — Fri, 30 Dec 2016 09:26:10 GMT

Morning All,

Agreed with all comments. Custom APP with Application Override Policy is the way to go. Below detailed link on how to get this done:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-an-Application-Override-Policy/ta-p/60044