Web filtering only license/Idle time outs.

[rthimble]

I have 2 PA-500 inline for web filtering only. We are having an idle timeout problem with none url traffic and have determined the issue is with the PA's. I have seen posts on this issue that relate to firewall functionality that I am not using. Does anyone know where/how to address this issue on the PA's? Thanks

[jleung]

Hi,

Would you tell us more your observation and your config?

Regards,

Jones

[rthimble]

Sure,

We have dual PA-500's in HA mode, inline for all traffic destined to the Internet. The PA's are in front of our Firewalls which are Checkpoints. The only rule sets on the PA's are for url filtering, anti virus, anti spam. The PA's are not in full production as of yet. There are 3 active url rules effecting a select group for testing. The activity that is timeing out is none url traffic destined to a hosting service via VPN. We have eliminated the vpn device and the firewall by working backwards and testing on each segment. That leaves the PA's. From what I have read the timeouts can be addressed in the rule base by protocol or application. My question is how do I address the idle timeout in this scenario?

Rick

[jleung · Accepted solution]

Thanks Rick.

You have two options to change the idle timeout. Before changing the value you can run "show session info" to understand the current value.

1. Change the global TCP and UDP timeout by CLI:

Configure

set deviceconfig setting session timeout-tcp/timeout-udp <value>

commit

2. Change the per-application value. You need to know what applications we have identified the traffic as through the traffic log before applying the change:

go to object -> application -> click on the application and change the timeout value

commit

Regards,

Jones