decrement ttl and idle timeout on FTD

AveLor46429 — Tue, 14 Jul 2020 08:44:46 GMT

Hello!

I'm using FTD 2110 managed by FMC. So I want working traceroute and made a threat defence policy with decrement ttl option like it described here.

Traceroute starts working, but all connections (tcp, udp, icmp) after policy applying now has idle timeout 1 hour:

class class_map_ACL_Traceroute
set connection timeout idle 1:00:00
set connection decrement-ttl

policy with defalut options - I only turn on decrement ttl option:

How can I configure this policy without connection timeout modification? flexconfig with only decrement ttl option give an error, like here

Thank you.

PS I try to update ftd and fmc from 6.4 to 6.6 and in does not solve problem

Re: decrement ttl and idle timeout on FTD

Marius Gunnerud — Tue, 14 Jul 2020 20:04:03 GMT

Those are the default timeouts. They are present even when you do not have Threat Defence Policy configured.

FTD# show run | in timeout
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02

topic decrement ttl and idle timeout on FTD in Network Security

decrement ttl and idle timeout on FTD

Re: decrement ttl and idle timeout on FTD