Seeson end reason aged out
Showing results for 
Search instead for 
Did you mean: 

Seeson end reason aged out

L3 Networker

HI friends,


We have created interzone rule looks like below


<entry name="Rule1>
<member>VP Profile</member>
<member>A</member> <member>B</member> <member>c</member>




the rule is triggering perfectly but it's showing aged out and in application field it showing insufficient-data custumer saying he is not getting respone can anyboady help how to solve this??


and i have checked ping from FW CLI to detination in above rule it's successfull and getting response but still in firewall it's showing aged out????? is this someting PAN needs to worry about??


Kindly suggest 


L7 Applicator

To make the rule truly interzone you'd need to set the type to interzone also:



The rule itself looks ok, but the behavior you're reporting sounds like there might be a network issue. if you look into the details of the traffic logs, can you see packets reported in both directions ?

insufficient data is usually reported when there is asymmetric flow which ping will not report as request and reply are independent, but will impact TCP severely


You can set up packetcaptures to make sure packets are going out and being received as expected. Some more details like traffic log and a topology could be helpful too

Tom Piens
Like my answer? check out my book!

Hi thanks for the response,


yeah we have included that interzone rule but forgot to mention here.

we checked PCAP also but found that no response and traffic details also bytes received is showing 0.




if packets are leaving the firewall as expected but none are returning, the next step is to go check at the remote end if packets are being received properly and where the reply is going


is the source IP part of a NAT policy, does the host have a route for it, does the next hop router have proper routing for it etc

Tom Piens
Like my answer? check out my book!

How can we confirm it's leaving the firewall??


Community Team Member



You can perform PCAPs on the firewall in 4 different stages :







The transmit stage is what the firewall sends out.


Check the following article on how to configure PCAPs :




Hope it helps,


a good indication is if the traffic log contains a 'packet sent' count. you should be able to use thelog details to ascertain if NAT is being applied by looking at the 'NAT Source IP' column


for some more info regarding packetcaptures (these will also help identify 'sent' and 'received' packets), please check out this article: Getting Started: Packet Capture

Tom Piens
Like my answer? check out my book!

NAT IP is not applied for this and can packet sent count is 1 can be considered for succeful leaving of firewall?





the SYN packet goes out and then an ACK needs to come back, if the ACK is never returned the session will timeout waiting for reply

Tom Piens
Like my answer? check out my book!

But i can see IP protocol as UDP, i dont think in this case we receive ACK.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!