topic Re: Session Timeout Settings in General Topics

Session Timeout Settings

Retired Member — Thu, 15 Aug 2013 08:55:37 GMT

Hi,

we are using a PA environment in combination with Bluecoat Proxy SG for caching and user authentication. Bluecoat describes on his knowledgbase KB3323 the differences for session timeouts on proxie servers and firewalls.

From our proxies I have many retransmissions to the Internet and so I want to change my timout settings on the PA in a bluecoat conform value. Where I have to change the timeout seitting?

On session timeouts (and which value)

Or on application settings

greetings from germany

Robert

Re: Session Timeout Settings

ExclusiveNetworksGermany — Thu, 15 Aug 2013 12:28:10 GMT

Both will work.

You can override the default timeout for ALL Applications (1st window)

and/or for a specific Application (2nd window)

Regards

Marco

Re: Session Timeout Settings

mbutt — Thu, 15 Aug 2013 16:57:21 GMT

Keeping in mind the first window that you have displayed is a global change and will effect all the session. The change will override the default timeout for ALL Applications.

The second windows display is for a particular application. The change would apply to specific Application. So it would be important to know if you want to change it globally or just for a particular application.

Let us know if this helps.

Thank you

Numan

Re: Session Timeout Settings

Retired Member — Mon, 19 Aug 2013 09:56:23 GMT

My question was a little bit imprecise. I know the differences between application and timeout settings. My intensions are more which value in timeout settings I have to change? Discard TCP or TCP or TCP wait? The PA help is very futile and says "Specify timeouts in seconds for each of the categories. Ranges and defaults are listed." Nice.

I changed alle TCP settings to 900s (except TCP itself) and in application I changed it to 900s too. But it doesn't work.

I have "non-syn-tcp" application still.

In my session browser, the session timeout is shown as 30s still.

Re: Session Timeout Settings

Retired Member — Mon, 19 Aug 2013 10:43:51 GMT

Proxy Server not Able to Access the Internet

did you read that ?

Re: Session Timeout Settings

mbutt — Mon, 19 Aug 2013 15:43:07 GMT

Hi Robert,

If you are getting non-syn-tcp that tcp handshake is not happening properly and may you are seeing ack for a packet which had not syn.

You can enable "set session tcp-reject-non-syn no" command from the operational mode. This will allow non-syn traffic in you environment. However if you want this setting to be permanent you would need to run the "set deviceconfig setting session tcp-reject-non-syn" command from the configuration mode. Usually this is not recommended unless you have a specific problem in your environment e.g asymmetric routing.

As far as the session timeout goes there are few more timers which you can see under "show session info"

Session timeout

TCP default timeout: 3600 secs

TCP session timeout before SYN-ACK received: 5 secs

TCP session timeout before 3-way handshaking: 10 secs

TCP session timeout after FIN/RST: 30 secs

UDP default timeout: 30 secs

ICMP default timeout: 6 secs

other IP default timeout: 30 secs

Captive Portal session timeout: 30 secs

Session timeout in discard state:

TCP: 90 secs, UDP: 60 secs, other IP protocols: 60 secs

Let us know if this helps.
Thanks

Numan

Re: Session Timeout Settings

Maneesh.Pant — Wed, 15 Aug 2018 04:55:59 GMT

Did this get resolved finally ? If yes what settings were modified I am facing similar issues and kinda urgent if someone can respond back pls.

Users----Bluecoat Child------Palo Alto (FW)-----Parent Bluecoat

Having intemittent disconnects.