Web filtering only license/Idle time outs.

cancel
Showing results for 
Search instead for 
Did you mean: 

Web filtering only license/Idle time outs.

Not applicable

I have 2 PA-500 inline for web filtering only. We are having an idle timeout problem with none url traffic and have determined the issue is with the PA's. I have seen posts on this issue that relate to firewall functionality that I am not using. Does anyone know where/how to address this issue on the PA's? Thanks

1 ACCEPTED SOLUTION

Accepted Solutions

Thanks Rick.

You have two options to change the idle timeout. Before changing the value you can run "show session info" to understand the current value.

1. Change the global TCP and UDP timeout by CLI:

Configure

set deviceconfig setting session timeout-tcp/timeout-udp <value>

commit

2. Change the per-application value. You need to know what applications we have identified the traffic as through the traffic log before applying the change:

go to object -> application -> click on the application and change the timeout value

commit

Regards,

Jones

View solution in original post

3 REPLIES 3

L4 Transporter

Hi,

Would you tell us more your observation and your config?

Regards,

Jones

Sure,

We have dual PA-500's in HA mode, inline for all traffic destined to the Internet. The PA's are in front of our Firewalls which are Checkpoints. The only rule sets on the PA's are for url filtering, anti virus, anti spam. The PA's are not in full production as of yet. There are 3 active url rules effecting a select group for testing. The activity that is timeing out is none url traffic destined to a hosting service via VPN. We have eliminated the vpn device and the firewall by working backwards and testing on each segment. That leaves the PA's. From what I have read the timeouts can be addressed in the rule base by protocol or application. My question is how do I address the idle timeout in this scenario?

Rick

Thanks Rick.

You have two options to change the idle timeout. Before changing the value you can run "show session info" to understand the current value.

1. Change the global TCP and UDP timeout by CLI:

Configure

set deviceconfig setting session timeout-tcp/timeout-udp <value>

commit

2. Change the per-application value. You need to know what applications we have identified the traffic as through the traffic log before applying the change:

go to object -> application -> click on the application and change the timeout value

commit

Regards,

Jones

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!