topic Re: PIX timeout conn recommendations in Network Security

PIX timeout conn recommendations

aemr — Fri, 21 Feb 2020 07:08:47 GMT

Hi,

What are the possible performance problems and security issues with increasing the timeout values (conn especially)?

Are there any recommendations as to the max values? I cannot find anything other than syntax on the web site.

Re: PIX timeout conn recommendations

scoclayton — Tue, 09 Dec 2003 20:04:49 GMT

Hi,

The defualt values are the recommended values under normal circumstances but we do realize that there are some situations where these values will not work. From a Security standpoint and performance standpoint, you probably will not see any change when bumping the conn timeout upa bit. The only real difference is that the PIX will wait longer before tearing down connections that have gone idle. You *could* see more conns stored which will eat more memory but in most cases, this will probably be negligable. Most PIX installations have very few conns that time out due to the idle timer being reached unless there is some application that passes across the PIX that is left open and un-used for long periods of time. Hope this helps.

Scott

Re: PIX timeout conn recommendations

aemr — Tue, 09 Dec 2003 20:47:10 GMT

Thank you Scott,

Last Q...

What is the relationship between the connection and idle timeouts?

Thanks again,

Art

Re: PIX timeout conn recommendations

scoclayton — Tue, 09 Dec 2003 21:04:20 GMT

Art,

Not a problem. I am not exactly sure what you mean by the question. The conn timer is the time that the PIX will allow the connection to sit idle before tearing it down. If we see traffic flow across this connection, the timer resets to 0. If we reach the configured time and the timer has not been reset, the connection gets torn down. Does this answer your question at all?

Scott

Re: PIX timeout conn recommendations

dlac455 — Tue, 09 Dec 2003 21:35:25 GMT

We bumped our xlate value up to 6 hours. Then I dump the xlate table every 6 hours using a TCL/expect script. Then I correlate my DHCP logs with the xlate entries. Purpose being to track a user down by the global IP address they were surfing with. Anybody have any comments about the accuracy of doing this? The concept to use this info for enforcement purposes.

Re: PIX timeout conn recommendations

aemr — Tue, 09 Dec 2003 21:41:47 GMT

Yes that does Scott. Sorry about the poor wording. I appreciate the help.

Art