Override Application timeouts

Reply
Highlighted
L0 Member

Override Application timeouts

Okay, so the basic gist of what is going.

We are moving from an ASA to a PA-3020 a vendor we work with needs to have these timeout settings:

arp timeout 14400
timeout xlate 3:00:00
timeout conn 12:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 12:30:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00

 

we set them globally on our ASA, but now we want to use an application specific timeout on the paloalto. I made a custom app, and then made an override for it so that as long as the traffic was going over the specified port and between specific clients and their server it was marked as the new custom appid I made with these timeouts:

Timeout: 3600

TCP Timeout:3600

UDP Timeout: blank

TCP half closed: 600

TCP Time Wait: 600

 

Even with these settings the application is still resetting it's tcp session and essentially logging them out of the app. Any suggestions, and I really don't want to set these settings globally.

 

Tags (3)
L4 Transporter

Re: Override Application timeouts

Pretty high timeouts, is it possible they can configure a keep alive in the application?

I think that the equivalent to 12 hours would be 43200 seconds (TCP timeout to configure in PAN) try changing it, I recomend you to check the session end reason in the logs and see if you've "age-outs". 

https://live.paloaltonetworks.com/t5/Learning-Articles/Session-Tracker-Feature/ta-p/61790

 

Regards,

Gerardo.

Community Team Member

Re: Override Application timeouts

I would recommend that you first look in your traffic logs, and ensure that the App Override is showing up with your Custom App name as you have configured.

If the custom app name is showing up, then you do not have the App override configured properly. 

If the custom app name is NOT showing up, then you have to go into the session information and look for the timeout values there.

 

Hopefully this helps, otherwise It is recommended that you contact support

Stay Secure,
Joe
End of line
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!