topic Re: conn timeout value on FWSM/PIX in Network Security

conn timeout value on FWSM/PIX

srowles — Fri, 21 Feb 2020 08:19:04 GMT

I am trying to solve an issue where an inactive session times out after an hour. I am assuming that the inactive session is timing out due to the fact that the "conn" timer on the FWSM defaults to one hour.

I see in the documentation that you can set the "conn" timer to 0:0:0 to never time out a connection. Obviously this is a global command and would apply to all connections across the FWSM so I´m wondering if this is going to cause me problems such as high resource utilisation. I am assuming that as this timer only applies to idle connections and therefore connections that have been torn down with a FIN will be removed from the list of connections.

If anyone can offer any thoughts on this or recommendations, Id appreciate it.

Re: conn timeout value on FWSM/PIX

umedryk — Fri, 12 Aug 2005 18:51:55 GMT

There are two options in the timeout command, absolute and idle timeouts. if you configure the absolute to 0:0:0, then it will not have any effect on the relative and it will not get you timed out.

Re: conn timeout value on FWSM/PIX

rsmith — Fri, 12 Aug 2005 22:27:41 GMT

Since you are specifically looking at the idle (connection)timeout issue, the absolute timeout really does not matter. I had a similar issue with mainframe access, and ended up setting the idle timer to 12 hours.

"timout conn 12:00:00"

I also set the xlate timeout to the same value, so it would not affect the existing connections.

You may wish to experiment with different values, but usually, if it is set to longer than a normal person's work day, they should have no more problems.

Re: conn timeout value on FWSM/PIX

srowles — Sat, 13 Aug 2005 08:12:10 GMT

Thanks to you both (umedryk and rsmith) for your replies. We have discovered that the mainframe session does send keepalives but only once every 2 hours and as the default conn timeout was 1 hour we were loosing the connection. Raising the conn timeout to 3 hours (the same as the xlate default) seems to have solved the problem.