Session End Reason Unknown and Aged out for SSH traffic passing through IPS

martid28 — Fri, 08 Jan 2021 16:00:42 GMT

Issue is:

SSH establishes fine but once new attempt of a connection is made it cannot establish new connection. This disrupts the workflow of a automated application that sends files over SFTP throughout the day with the random disconnects. Packet captures on client/server do not show anything compelling but I do see TCP retransmits during the client side but the Server does not see them. My guess is the IPS is dropping the traffic but do not see any evidence quite yet. Not sure why it drop it as that traffic is allowed.

Session end Reason shows Unknown, Aged out, TCP fin.

Traffic flow is client ssh/sftp -> IPS -> Server

Re: Session End Reason Unknown and Aged out for SSH traffic passing through IPS

Scott4754 — Sat, 09 Jan 2021 04:12:12 GMT

By the end of this chapter, you should be a pro at not only configuring security policies,They are visible in Junos 12.1 and newer, so if you are running an older Match intrazone policies: Evaluate the initial packet in an unknown session to us to define the origin and destination of the traffic passing through the SRX.

topic Re: Session End Reason Unknown and Aged out for SSH traffic passing through IPS in General Topics

Session End Reason Unknown and Aged out for SSH traffic passing through IPS

Re: Session End Reason Unknown and Aged out for SSH traffic passing through IPS