Okay, so the basic gist of what is going.
We are moving from an ASA to a PA-3020 a vendor we work with needs to have these timeout settings:
arp timeout 14400
timeout xlate 3:00:00
timeout conn 12:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 12:30:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
we set them globally on our ASA, but now we want to use an application specific timeout on the paloalto. I made a custom app, and then made an override for it so that as long as the traffic was going over the specified port and between specific clients and their server it was marked as the new custom appid I made with these timeouts:
UDP Timeout: blank
TCP half closed: 600
TCP Time Wait: 600
Even with these settings the application is still resetting it's tcp session and essentially logging them out of the app. Any suggestions, and I really don't want to set these settings globally.
Pretty high timeouts, is it possible they can configure a keep alive in the application?
I think that the equivalent to 12 hours would be 43200 seconds (TCP timeout to configure in PAN) try changing it, I recomend you to check the session end reason in the logs and see if you've "age-outs".
I would recommend that you first look in your traffic logs, and ensure that the App Override is showing up with your Custom App name as you have configured.
If the custom app name is showing up, then you do not have the App override configured properly.
If the custom app name is NOT showing up, then you have to go into the session information and look for the timeout values there.
Hopefully this helps, otherwise It is recommended that you contact support
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!