topic Re: Application Aged out in General Topics

Application Aged out

LaportePitts — Mon, 14 Dec 2020 17:21:50 GMT

Hey guys can anyone provide a little insight I set up action to allow an outbound rule for a group but I am getting an error of an "aged-out" and its coming from port 443. Any suggestions would be greatly appreciated

Re: Application Aged out

reaper — Mon, 14 Dec 2020 22:19:28 GMT

can you provide a little more context, is the session failing?

an "aged-out" session end reason means both sides stopped communication without there having been a FIN or a RST, but it's not necessarily a problem as there was a handshake and some communication (else there would have been an application "incomplete")

if the application is indeed showing up as incomplete, it means the TCP handshake is not being completed (no syn-ack most likely)

take a look at the packets received/packets sent to get an indication if there's communication and if it's an expected amount or not

Re: Application Aged out

LaportePitts — Mon, 14 Dec 2020 22:24:43 GMT

Yes the session is failing but its a mystery as into why this is happening its "aged out" this was the message I received

Session ID	127785
Action	allow

Action Source	from-policy
Application	incomplete

Rule	Clearspan outbound
Rule UUID	aa3c90d3-5190-49da-9746-d60ba6cc7332

Session End Reason	aged-out
Category	any

Device SN
IP Protocol	tcp

Log Action

default

Re: Application Aged out

reaper — Mon, 14 Dec 2020 22:30:50 GMT

you can either find the log entry and click the little magnifying glass to the far-left of the log entry to get more details, or run this command from CLI:

show session ID 127785

that will pop up more details about the session. you can look at the number of packets and bytes sent/received which will tell you what went on

if you see 0 packets/bytes received, the server side simply didn't answer, if there's 1 packet received, the server completed the handshake but then stopped nswering after that

in both cases, something is up on the server side

next you will want to check if there were other sessions that succeeded, and how long ago. if theres a mix of succeeded and failed sessions, the server may be overloaded/throttled, if there's no succeeded sessions for a while, the server may be down

see if anything changed: was routing changed, or NAT since the connection started failing

hope this helps

Re: Application Aged out

LaportePitts — Mon, 14 Dec 2020 22:51:36 GMT

Thanks a lot it does will look into this further... and keep you guys posted just incase any one else runs into this problem