Session timeout in crossbeam

[Davidg]

Even if I define the TCP Session Timeout of a protocol to be something like 2 hours, crossbeam always reports the maximum is 10 minutes (TTL). After these 10 min., the connections get dropped, although they are listed in the checkpoint's connection table (with the correct timeout).

CBS# sh flow active source-address 10.10.0.1 destination-address  10.10.0.194

This command may take a few minutes.  Do you want to continue? <Y or N> [Y]:

Module  Source                  Destination             Protocol    Domain  TTL
np1           10.10.0.1: 5886     10.10.0.194: 3927    6          1      0m 15s
   Rx Modules fw_2
   Ageout 4, Skip Ports, Skip Protocol

Is this the correct behavior? Is there any way to override this TTL (Time To Live?) to be the same as it is defined in Smart Dashboard?

Thanks

[cjbischoff]

Flow Rules Priority: Modifying default values for Flow Rules

When modifying default values, do not forget to do it for both directions. The Flow Rules are unidirectional, most of the time, depending on which criteria you are playing with (i.e. source add, source TCP port, …)

The example here shows that if you want to shorter the life of HTTP traffic in the X series Active Flow Table, (default TCP being 10mn, which is quite long for short HTTP transactions, which will result with a AFT table full of aged out HTTP connections), you need to do it on both ways.

Overriding default timeout

When overriding the default timeout value, ensure that the timeout is set properly for all return flows
Example:
HTTP tends to run short and can have quick timeouts
Useless HTTP flows (because already aged-out on the client/server transaction), can pollute the Active Flow Table
Create a higher priority rule with
dest. port = 80 and timeout = 3mn
The return flow, which is not bound for dest. port = 80, resets the timeout of the AFT entry from 3 minutes to the default (10 mn)
Original and return flow share the same AFT entry
You must now create a source flow rule using:
src. port = 80 and timeout = 3mn