questions on pix timeout

[zhichao]

Hi

Understand there are some timeout settings on pix. Need to check :

1. TCP timeout 1:00:00. I believe this is idle time out. Will PIX send out TCP reset after timeout?

2. Xlate timeout 3:00:00. Is this idle time out?

Will PIX send out TCP reset after timeout?

[sachinraja]

Hi zhichao,

the xlate timeout is used to free up an existing nat entry on the pix, incase there is no activity on that perticular tcp session for a long time. the translation slot is freed after this timeout value exceeds... this is used to kill idle sessions on the nat table of the pix...

the first part - > are u talking about half-closed timeout ?? if so, yes, it sends a tcp reset if the idle timer expires.. the tcp connection is freed after this timer expires...

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/tz.htm#wp1026093

see if the above URL helps u.

Raj

[scoclayton]

The PIX should never send a RST packet in response to anything unless 'service resetinbound' is configured. When the timeouts expire, the PIX will drop the packets until the connection is re-established properly. The idea of a firewall is to not be detectable on the network. Once it starts sourcing packets, it is no longer hidden.

Scott

[zhichao]

Thanks! This is the info I need.

How about the question two? Is the NAT time out idle timeout?

[scoclayton · Accepted solution]

Yes, based on the info in the original post, the PIX should remove any xlates that have been idle for 3 hours. Once these are removed, the xlates need would have to re-established in order for a connection to occur.

Does this help?

Scott