idle traffic sessions

[jdprovine]

I know that you set timeout for global protecte sessions that go idle but can you set other idle traffic to time out?

[kiwi]

Under Device tab > Setup > Session you will find all the configurable session timeouts :

Also configurable in CLI :

set session timeout-tcp <1-15999999>

set session timeout-udp <1-15999999>

set session timeout-icmp <1-15999999>

set session timeout-default <1-15999999>

set session timeout-tcpinit <1-60>

set session timeout-tcphandshake <1-60>

set session timeout-tcp-half-closed <1-604800>

set session timeout-tcp-unverified-rst <1-600>

set session timeout-tcp-time-wait <1-600>

set session timeout-captive-portal <1-15999999>

set session timeout-scan <5-30>

set session timeout-discard-tcp <1-15999999>

set session timeout-discard-udp <1-15999999>

set session timeout-discard-default <1-15999999>

Also, per application you can configure your timeout :

Objects tab > Applications > Select your application :

Hope this helps,

-Kim.

[jdprovine]

Interesting but that is all tcp traffic correct? 

[Raido_Rattameister]

What is TCP?

GlobalProtect can be UDP also (and it usually is).

[kiwi]

Hi jprovine,

Notice there are TCP, UDP, ICMP and default session timers in the first screenshot and CLI commands (so not only tcp).

Also, if you select an application from the list you can change the timeouts depening on the application options (f.e. application 'dns' has both TCP and UDP timeouts).

Hope this helps,

-Kim.

[jdprovine]

We actually want to be able to set time outs on specific traffic or security policies. Can that be done?

[reaper]

Hi

you can't set idle timers on specific session but you can for specific applications

if that is still too broad you could set an application override so a certain connection becomes a custom application, which you can then control from the custom app's settings

hope this helps

Tom

[jdprovine]

That's what I thought but I just wanted to make sure