Override Application timeouts

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Override Application timeouts

L0 Member

Okay, so the basic gist of what is going.

We are moving from an ASA to a PA-3020 a vendor we work with needs to have these timeout settings:

arp timeout 14400
timeout xlate 3:00:00
timeout conn 12:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 12:30:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00

 

we set them globally on our ASA, but now we want to use an application specific timeout on the paloalto. I made a custom app, and then made an override for it so that as long as the traffic was going over the specified port and between specific clients and their server it was marked as the new custom appid I made with these timeouts:

Timeout: 3600

TCP Timeout:3600

UDP Timeout: blank

TCP half closed: 600

TCP Time Wait: 600

 

Even with these settings the application is still resetting it's tcp session and essentially logging them out of the app. Any suggestions, and I really don't want to set these settings globally.

 

2 REPLIES 2

L4 Transporter

Pretty high timeouts, is it possible they can configure a keep alive in the application?

I think that the equivalent to 12 hours would be 43200 seconds (TCP timeout to configure in PAN) try changing it, I recomend you to check the session end reason in the logs and see if you've "age-outs". 

https://live.paloaltonetworks.com/t5/Learning-Articles/Session-Tracker-Feature/ta-p/61790

 

Regards,

Gerardo.

L7 Applicator

I would recommend that you first look in your traffic logs, and ensure that the App Override is showing up with your Custom App name as you have configured.

If the custom app name is showing up, then you do not have the App override configured properly. 

If the custom app name is NOT showing up, then you have to go into the session information and look for the timeout values there.

 

Hopefully this helps, otherwise It is recommended that you contact support

LIVEcommunity team member
Stay Secure,
Joe
Don't forget to Like items if a post is helpful to you!
  • 3794 Views
  • 2 replies
  • 0 Likes
  • 101 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!