Command: clear session id 135269 not working

[TranceforLife]

Hi All,

Strange but cannot clear the session below. Did try from GUI first then from CLI. CLI says:  session 135269 cleared after still able to see it as active 

Any idea?

PAN-OS 6.1.7 PA-5050

Thx,

Myky

[BPry · Accepted solution]

@TranceforLife you can review this link that reaper put together but essentially the session id is going to keep showing the same information until it is overwritten. To verify you could run show session all filter source ip and replace IP with whatever the source IP address is to verify that the session itself isn't actually there anymore. You can replace source ip with destination ip depending on what direction this was actually going and what makes more sense on this session. 

[TranceforLife]

Hmm. Nice one. Didn't know that 🙂 Thank you

[TranceforLife]

@BPry Even more interesting. Still active

[BPry]

If it's a tunnel I would bet that it's reopening so fast that it must be taking the same session. The interseting thing is that it's keeping the same session number, one would suspect that if it's relaunching the session ID would change since you have cleared the session id from the table.

The only way that I could really see this happening is if 135269 is the last session that you have open, therefore when the tunnel brings itself back up it's just taking the session id since it's the next one available? 

[TranceforLife]

@BPryCould be. What l could see that the time when session is established still Nov 8 10:28:36 2016 and TTL is decrementing)))

timeout : 268435455 sec
time to live : 265828673 sec

timeout : 268435455 sec
time to live : 265828639 sec

[BPry]

Very interesting. I would say to try to create a deny rule in your policy list but since the session is already active that isn't going to work anyways. I'd be interested in hearing what TAC has to say about it and if they can find a way to clear it out successfully; this is a very weird issue to run into. 

[reaper]

i'm a bit late to the party:

you can't clear 'tunnel' sessions for vpn tunnels configured on the firewall, those are maintained by the system and depend on ikemgr releasing the session

[TranceforLife]

Hi reaper,

That actually answer the question. l also noticed that this tunnel session a bit different than traditional: 

no ingress/egress interface and TTL is very high.

Thanks All,

Myky