Hello Gents,
we have on our ASA huge number of connections which seems to be idle. Similar to below:
TCP INET_FW: XX.XXX.XXX.XXX/56535 INET_CORE: YY.YY.YY.YY/20406,
flags UfIB , idle 1h3m, uptime 1h9m, timeout 15m0s, bytes 444
For this specific connections (on destination host/port) we configured actions under specific class in global policy:
Class-map: YY.YY.YY.YY-20406
Inspect: http, packet 133154, lock fail 0, drop 0, reset-drop 0, 5-min-pkt-rate 37 pkts/sec, v6-fail-close 0
Set connection policy: drop 0
Set connection timeout policy:
embryonic 0:00:40 half-closed 0:02:00 idle 0:05:00
DCD: enabled, retry-interval 0:15:00, max-retries 5
DCD: client-probe 0, server-probe 0, conn-expiration 0
So it seems like idle timeouts dont work. Can anybody explain this behavior and give hint on how to fight?
Thanks for any valuable input,
