[PaloAlto] Firewall Timeout 종류 및 설정 방법 - Session, Authentication, Web Server

PaloAlto firewalls offer various timeout settings for different aspects of their operation, including session timeouts, authentication timeouts, and application-specific timeouts.

 

These timeouts help manage firewall resources and ensure efficient network performance.

 

 

1. 세션 타임아웃

Session Timeouts:

• Global Session Timeouts:

  Palo Alto firewalls have global session timeouts for TCP, UDP, and ICMP.These timeouts define how long a session can remain open without activity before the firewall closes it.

   
• Application-Specific Timeouts:

  You can also configure timeouts for specific applications, overriding the global session timeouts for those applications.

   
• ARP Cache Timeout:

  The firewall also manages an ARP cache, and you can configure the timeout for ARP entries in the cache.

   

   

2. 인증 타임아웃

 

Authentication Timeouts:

• External Authentication Services:Firewall timeouts can be configured for connecting to external authentication servers (e.g., for administrator access or user authentication through Authentication Portal).
• Authentication Portal:You can set a session timeout for Authentication Portal, which defines how long a user has to respond to an authentication challenge in the web form.
• Kerberos Timeouts:Kerberos server connections also have specific timeouts.
   

 

3. 기타 타임아웃

 

 

Other Timeouts:

• Global PAN-OS Web Server Timeout:

  This timeout applies to the firewall's interactions with external servers for various purposes.

   
• Custom Service-Based Timeouts:

  You can define custom timeouts for specific services, which can be applied to application traffic.

   

 

4. 디폴트 값

 

 

Default Values and Configuration:

• Default TCP Timeout:The default TCP idle timeout is 15 minutes.
   
• Default UDP Timeout:The default UDP timeout is 30 seconds.
   
• Global Web Server Timeout:The default global web server timeout is 30 seconds.
   
• Configuring Timeouts:Timeouts can be configured through the firewall's web interface, CLI, or by creating custom service objects and applying them to security policy rules.
   

 

5. 트러블 슈팅

 

Troubleshooting:

• Session Timeout Issues:

  If sessions are unexpectedly closing, you may need to adjust the session timeouts or investigate application-specific issues.

   
• Authentication Timeouts:

  If authentication attempts fail due to timeouts, you should review the timeout settings for the relevant authentication servers.

   

   
• GlobalProtect Timeouts:

  In GlobalProtect environments, timeouts can occur related to tunnel activity or HIP checks, requiring adjustment of the GlobalProtect settings.

   

   

   

  https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-networking-admin/session-settings-and-timeouts/configure-session-timeouts

Configure Session Timeouts

 

---

 

[PaloAlto] Firewall CLI Command - show 명령어 (HA, NAT, IPsec) Cli sheet 참조

[PaloAlto] Firewall CLI Command - show 명령어 (HA, NAT, IPsec) Cli sheet 참조

 

[PaloAlto] Firewall CLI Command - set 명령어 (객체 생성, 객체 반영, Description, Schedule)

[PaloAlto] Firewall CLI Command - set 명령어 (객체 생성, 객체 반영, Description, Schedule)

 

[PaloAlto] Firewall Monitor Log 분석 - Traffic Session End Reason ( 방화벽 세션 로그 의미 )

[PaloAlto] Firewall Monitor Log 분석 - Traffic Session End Reason ( 방화벽 세션 로그 의미 )