PAN and NetMotion

[cdpadmin]

We run our NetMotion connections through the PAN for our mobile clients.  The troubled moblle application receives dispatch information from our CAD application and since switching to the PAN from our previous firewall the delivery of this information has become unreliable.

We suspect that not seeing any traffic across the link, the PAN shuts down the connection until the client application is shut down and restarted.  The actual NetMotion connection remains open. Any pointers on this would be very helpful.

[sjamaluddin]

You could create a custom app for this traffic and change the default tcp timers there so as to allow the session to last longer. Also, then you'd have to consider an app override policy to account for the 'newly' defined app.

https://live.paloaltonetworks.com/docs/DOC-1071

[cdpadmin]

I created an app override policy shortly after this answer was posted.  It has not resolved the issue for us completely.  While we have been able to influence the time it takes for the connection to terminate, when it does terminate you netmotion is unable to reestablish it.  You have to terminate the client's connection to Palo Alto before any traffic resumes.

This is rather frustrating for us since we really need the client connection to remain open all the time.

Thanks,

Michael