Some session timeouts define the duration for which PAN-OS maintains a session on the firewall after inactivity in the session. By default, when the session timeout for the protocol expires, PAN-OS closes the session. The Discard session timeouts define the maximum time that a session remains open after PAN-OS denies the session based on Security policy rules.

On the firewall, you can define a number of timeouts for TCP, UDP, ICMP, and SCTP sessions in particular. The Default timeout applies to any other type of session. All of these timeouts are global, meaning they apply to all of the sessions of that type on the firewall.

In addition to the global settings, you have the flexibility to define timeouts for an individual application in the ObjectsApplications tab. The timeouts available for that application appear in the Options window. The firewall applies application timeouts to an application that is in Established state. When configured, timeouts for an application override the global TCP, UDP, or SCTP session timeouts.

Use the options in this section to configure global session timeout settings—specifically for TCP, UDP, ICMP, SCTP, and for all other types of sessions.

The defaults are optimal values and the best practice is to use the default values. However, you can modify these according to your network needs. Setting a value too low could cause sensitivity to minor network delays and could result in a failure to establish connections with the firewall. Setting a value too high could delay failure detection.