topic Re: connection timeout settings in Network Security

connection timeout settings

adamgibs7 — Fri, 21 Feb 2020 15:50:42 GMT

Dears,

Please find the attached , In the attached I can see the idle connection timeout the default timers are 1193:00:00 hence it seems to me very huge, is it recommended to change these setting ???? I tried to search in the running configuration these numbers ( 1193) but they are not available

I can see only these setting for the connection

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02

Re: connection timeout settings

Bogdan Nita — Mon, 04 Jun 2018 10:55:32 GMT

Should be an asdm bug, you could try a newer asdm or java version.

Based on the cli runn config the connection timeout is 1h (defaut value).

HTH

Bogdan

Re: connection timeout settings

adamgibs7 — Mon, 04 Jun 2018 23:27:07 GMT

what is the difference between the embryonic connection and half closed connections, do the default are best practice and no harm to the firewall or they have to be changed.

thanks

Re: connection timeout settings

adamgibs7 — Sat, 09 Jun 2018 20:36:11 GMT

Awaiting your reply experts

Re: connection timeout settings

Rob Ingram — Sat, 09 Jun 2018 21:52:47 GMT

Embryonic connection can be considered half open (a connection that has not completed the 3 way handshake). Half-closed would be when a peer does not acknowledge the closing of a connection. This post explains further.

Re: connection timeout settings

Abdullo Salikhov — Thu, 21 Jun 2018 14:49:17 GMT

take a look at this:

class-map BLABLA
match access-list BLABLA | with needed IP range or subnet

policy-map global_policy (or you can create a new one)

class BLABLA
set connection timeout idle 3:00:00 dcd 0:30:00 3