topic Re: ASA vs PIX timeout in Network Security

ASA vs PIX timeout

david_opalenik — Mon, 11 Mar 2019 21:09:21 GMT

A few weeks ago, I replaced a PIX 515E with a pair of ASA 5520's. We have a few basic web applications behind the ASA's. Nothing complex; just port 80/443 traffic. During the swap, we basically just copied the config from the PIX to the ASA. So the config is virtually identical.

Since the swap, we have one small set of users who gets timed out when trying to get to the application. This small set of users are scattered across the state of Alaska, and they are all accessing the Internet via a satellite connection. All other users across North America can access the application just fine.

Since the satellite connections are relatively slow, but they worked fine when going through the PIX, I suspect the issue is a difference in the default TTL (or similar parameter) between the PIX and the ASA.

Does anyone know what this paramter would be. I've been scratching my head for days on this.

Thanks!

ASA vs PIX timeout

csaxena — Tue, 09 Aug 2011 15:28:01 GMT

Hello David,

Please share the outputs of "show run timeout" and "sho conn details" and what version of ASA are you using ?

- Chirag

ASA vs PIX timeout

david_opalenik — Tue, 09 Aug 2011 15:34:44 GMT

Cisco Adaptive Security Appliance Software Version 8.0(4)

SPRO-ASA# show runn timeout

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

The output of "sho conn detail" is many pages long. Should I filter output on

something to make it more helpful? What specifically should I look for in the

output of "show conn detail"?

Thanks!

Re: ASA vs PIX timeout

csaxena — Tue, 09 Aug 2011 15:40:08 GMT

Please upload the file using "advanced editor" on top right.

ASA vs PIX timeout

david_opalenik — Tue, 09 Aug 2011 15:50:46 GMT

Output of "show conn detail" was uploaded.

ASA vs PIX timeout

praprama — Tue, 23 Aug 2011 18:59:55 GMT

Hi David,

Do you have a set of IP addresses facing this issue? You could try increasing the idle timeout for TCP connections using the timeout conn command though i find it highly improbably that the connections fomr the Alaska users is idle for 1 hour.

How long does the connection work before they start timing out?

Regards,

Prapanch