topic Re: Threat Defense Connection timeout in Network Security

Threat Defense Connection timeout

j.albos — Tue, 12 Mar 2019 11:21:42 GMT

Two Questions:

In previous ASA Version ( v8 ) there was a "Dead Connection Detection" ( DCD) - Function to Keep inactive but already existent Connections open.

Is DCD behavior also supportet in FTD ?

Background: Using a "foreign " Firewall Connections from Client to SAP Server becomes disconnected after a longer time of inactivity and people have to relogin into the server. Replacing this foreign Firewall with a asa5510 the Connection keeps established and people can continue working without a relogin.

How do the Timeout Settings in FTD in "Network Analysis Policy / TCP Stream Configuration" and the Timeout Setting in "Device Platform Settings" play togther ?

Re: Threat Defense Connection timeout

Francesco Molino — Thu, 14 Feb 2019 06:12:40 GMT

Hi

Have you tried configuring dcd using flexconfig?
You can put your asa config into a flexconfig object and deploy if.
I haven't tried yet myself for dcd (don't had the use case yet).
If commands are protected and not able to get pushed over flexconfig then you will get an error message right away at the deployment for fmc and at the config for fdm.

Re: Threat Defense Connection timeout

j.albos — Thu, 14 Feb 2019 09:25:05 GMT

Hi Francesco,

thank you for your answer.

I did not ever deal with flexconfig before. I searched how to do that and found a hint that the Connection timeout is now configurable using Service policies from Version 3.0 . So i will update fmc and sensor and hope to easyly solve my Problem .

Thank you again - this help me.

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/threat_defense_service_policies.html

Re: Threat Defense Connection timeout

Francesco Molino — Thu, 14 Feb 2019 21:09:15 GMT

Yeah a some configs are still not configurable over the normal and standard GUI but there are through Flexconfig.
Test and let me know if that worked.