topic IP Inspect - increase timeout on TCP Port in Network Security

IP Inspect - increase timeout on TCP Port

mdcarey15 — Mon, 11 Mar 2019 14:47:12 GMT

I have a 2811 router with IP Inspect enable for Ingress traffic but it is quite generic:

ip inspect name firewall tcp

ip inspect name firewall udp

ip inspect name firewall icmp

ip inspect name firewall dns

int Serial1/1

ip inspect firewall out

Inspection name firewall

tcp alert is on audit-trail is off timeout 3600

udp alert is on audit-trail is off timeout 30

icmp alert is on audit-trail is off timeout 10

dns alert is on audit-trail is off timeout 30

I have an application that connects outbound that keeps timing out. It uses a specific TCP port. I'd like to increase this TCP port's timeout period, but keep the other TCP ports at the default.

Is this possible?

Router(config)#ip inspect name firewall tcp ?

alert Turn on/off alert

audit-trail Turn on/off audit trail

router-traffic Enable inspection of sessions to/from the router

timeout Specify the inactivity timeout time

<cr>

Re: IP Inspect - increase timeout on TCP Port

owillins — Thu, 12 Feb 2009 14:38:40 GMT

This is the syntax for CBAC.

ip inspect name inspection-name protocol [timeoutseconds]

ip inspect one-minute high

ip inspect max-incomplete high

ip inspect tcp max-incomplete host

Re: IP Inspect - increase timeout on TCP Port

mdcarey15 — Thu, 12 Feb 2009 15:22:27 GMT

It looks like I can only do that command for specific protocols though, not for a TCP or UDP port not already defined (like H323), or the entire TCP or UDP port realm.