idle traffic sessions

cancel
Showing results for 
Search instead for 
Did you mean: 

idle traffic sessions

L4 Transporter

I know that you set timeout for global protecte sessions that go idle but can you set other idle traffic to time out?

7 REPLIES 7

Community Team Member

Under Device tab > Setup > Session you will find all the configurable session timeouts :

 

Screen Shot 2015-11-18 at 09.18.46.png

 

Also configurable in CLI :

 

set session timeout-tcp <1-15999999>

set session timeout-udp <1-15999999>

set session timeout-icmp <1-15999999>

set session timeout-default <1-15999999>

set session timeout-tcpinit <1-60>

set session timeout-tcphandshake <1-60>

set session timeout-tcp-half-closed <1-604800>

set session timeout-tcp-unverified-rst <1-600>

set session timeout-tcp-time-wait <1-600>

set session timeout-captive-portal <1-15999999>

set session timeout-scan <5-30>

set session timeout-discard-tcp <1-15999999>

set session timeout-discard-udp <1-15999999>

set session timeout-discard-default <1-15999999>

 

Also, per application you can configure your timeout :

 

Objects tab > Applications > Select your application :

 

Screen Shot 2015-11-18 at 09.25.25.png

 

Hope this helps,

-Kim.

Interesting but that is all tcp traffic correct? 

What is TCP?

GlobalProtect can be UDP also (and it usually is).

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI

Community Team Member

Hi jprovine,

 

Notice there are TCP, UDP, ICMP and default session timers in the first screenshot and CLI commands (so not only tcp).

 

Also, if you select an application from the list you can change the timeouts depening on the application options (f.e. application 'dns' has both TCP and UDP timeouts).

 

Hope this helps,

-Kim.

We actually want to be able to set time outs on specific traffic or security policies. Can that be done?

Hi

 

you can't set idle timers on specific session but you can for specific applications

 

if that is still too broad you could set an application override so a certain connection becomes a custom application, which you can then control from the custom app's settings

 

hope this helps

 

Tom

Tom Piens
PANgurus

That's what I thought but I just wanted to make sure

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!