Application Aged out

Reply
L1 Bithead

Application Aged out

Hey guys can anyone provide  a little insight  I set up action to allow an outbound rule for a group  but I am getting an error of an "aged-out"  and its coming from port 443. Any suggestions would be greatly appreciated 

L7 Applicator

can you provide a little more context, is the session failing?

 

an "aged-out" session end reason means both sides stopped communication without there having been a FIN or a RST, but it's not necessarily a problem as there was a handshake and some communication (else there would have been an application "incomplete")

 

if the application is indeed showing up as incomplete, it means the TCP handshake is not being completed (no syn-ack most likely)

take a look at the packets received/packets sent to get an indication if there's communication and if it's an expected amount or not

 

 

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374
L1 Bithead

Yes the session is failing but its a mystery as into why this is happening its "aged out" this was the message I received  

Session ID

127785

Action

allow

 

Action Source

from-policy

Application

incomplete

 

Rule

Clearspan outbound

Rule UUID

aa3c90d3-5190-49da-9746-d60ba6cc7332

 

Session End Reason

aged-out

Category

any

 

Device SN

 

IP Protocol

tcp

 

Log Action

default

 

L7 Applicator

you can either find the log entry and click the little magnifying glass to the far-left of the log entry to get more details, or run this command from CLI:

show session ID 127785

 

that will pop up more details about the session. you can look at the number of packets and bytes sent/received which will tell you what went on

if you see 0 packets/bytes received, the server side simply didn't answer, if there's 1 packet received, the server completed the handshake but then stopped nswering after that

in both cases, something is up on the server side

 

next you will want to check if there were other sessions that succeeded, and how long ago. if theres a mix of succeeded and failed sessions, the server may be overloaded/throttled, if there's no succeeded sessions for a while, the server may be down

 

see if anything changed: was routing changed, or NAT since the connection started failing

 

 

hope this helps

 

 

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374
L1 Bithead

Thanks a lot it does will look into this further... and keep you guys posted just incase any one else runs into this problem 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!