Default application timeout values

[smccall]

Is there a document that shows what the default application specific timeout values are?

[shasnain]

On the PA on the Gui if you go to Objects and then applications and then click on any of the application it will show the timeout values.

Thanks,

Syed R Hasnain

[Phoenix]

Hello,

In the below screenshot as explained by shasnain we can select any application in specific and look for the timeouts. If needed we can modify right there by Customizing it.

Hope this helps.

[mbutt]

The default session timeout values can be seen by running the command from CLI

show session info

Session timeout

  TCP default timeout:                           3600 secs

  TCP session timeout before SYN-ACK received:      5 secs

  TCP session timeout before 3-way handshaking:    10 secs

  TCP session timeout after FIN/RST:               30 secs

  UDP default timeout:                             30 secs

  ICMP default timeout:                             6 secs

  other IP default timeout:                        30 secs

  Captive Portal session timeout:                  30 secs

  Session timeout in discard state:

    TCP: 90 secs, UDP: 60 secs, other IP protocols: 60 secs

--------------------------------------------------------------------------------

Session accelerated aging:                       True

  Accelerated aging threshold:                   80% of utilization

  Scaling factor:                                2 X

--------------------------------------------------------------------------------

However there is no existing doc that i am aware of which will show the session timeout value for each application. As explained above you and look at each application to find their individual timeout values.

Thanks

Numan

[smccall]

I was aware on how to check the applications and the system timeouts, but thanks for the try.

I was just wondering if Palo or anyone has taken the time to create a spreadsheet with the default application timeouts.  I wanted to distribute to our application development teams so they could identify network settings as the build their applications.

Guess this isn't around quite yet, maybe if I get some time I will try to create it and post it.

[ukhapre]

You can check with SE if he is able to get default timeout information.

FYI - if you need application timeout changed only for certain traffic and not all the traffic then,

1. create a custom app with higher timeout value.

2. Setup application override policy

https://live.paloaltonetworks.com/docs/DOC-1071

3. Create a security rule to allow new custom application.

This way you have control timeout for interesting traffic only.

[zarina]

You can get this list using API. Generate an API key for the session:

https://<ip_address>/api/?type=keygen&user=<username>&password=<password>

and use it in the syntax below:

  https://<ip_address>/api/?type=config&key=<obtained_from_above>&action=get&xpath=/config/predefined/application