topic Re: Why tcp aged-out? in General Topics

Why tcp aged-out?

rjdahav163 — Sun, 28 Feb 2021 23:29:43 GMT

Hi all,

Our developers are connecting from Zone1 to Zone2 with tcp (on ports between 2000 and 3000)

The tcp session timeout on firewall is 3 hours.

The security policy allows any application, any port from Zone1 to Zone2. But there are all default security profiles applied on that rule.

When going to Zone2, the source IP is NATted to the firewall interface IP of Zone2.

Still the sessions end with reason "aged-out" after 1 hour when there is no activity.

If we bypass the firewall, this behaviour is not observed. All other devices with and without firewall bypass are the same. Hence the suspicion on firewall.

Any idea what could be the reason or what parameters I can check?

Thanks!

Re: Why tcp aged-out?

marcomi — Mon, 01 Mar 2021 11:01:58 GMT

Hi @rjdahav163

When monitoring the traffic logs using Monitor > logs > Traffic, some traffic is seen with the Session. Try this - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMjLCAW

Re: Why tcp aged-out?

reaper — Mon, 01 Mar 2021 15:27:17 GMT

are the connections being identified as an app-id? cause then the default timeout will be inored in favor of the app timeout

you could create a custom app with a 3 hour timeout and set an app override so all connections from zone1 to zone2 on those ports are forced to your custom app-id, which will also enforce the timeout