Configure Session Settings (SCM)

1. Log in to Strata Cloud Manager.
2. Select ManageConfigurationNGFW and Prisma AccessDevice SettingsDevice SetupSessionConfigurationNGFW and Prisma AccessDevice SettingsDevice SetupSession and select the Configuration Scope where you want to configure the session settings.

   You can select a folder or firewall from your Folders or select Snippets to configure the session settings in a snippet.
3. Click the cog wheel to edit the Session Settings and Customize.

   If you modified the Session Settings for a nested folder or individual device, you can Revert to Inherited to revert the Session Settings configuration from the Customized configuration to that inherited from the parent folder of the nester folder or that inherited from the folder the firewall is associated with.
4. Check (enable) Rematch all sessions on config policy change to apply newly configured Security policy rules to sessions that are already in progress.

   This capability is enabled by default. If you clear this check box, any policy rule changes you make apply only to sessions initiated after you commit the policy rule change.
5. Configure IPv6 settings.

   • ICMPv6 Token Bucket Size—Default: 100 tokens. See the section ICMPv6 Rate Limiting.
   • ICMPv6 Error Packet Rate (per sec)—Default: 100. See the section ICMPv6 Rate Limiting.
6. Enable IPv6 Firewalling—Enables firewall capabilities for IPv6. All IPv6-based configurations are ignored if IPv6 is not enabled. Even if IPv6 is enabled for an interface, the IPv6 Firewalling setting must also be enabled for IPv6 to function.
7. Enable ESPRAN support— Enable the firewall to terminate Generic Routing Encapsulation (GRE) tunnels and decapsulate Encapsulated Remote Switched Port Analyzer (ERSPAN) data. This is useful for Security services like IoT Security. Network switches mirror network traffic and use ERSPAN to send it to the firewall through GRE tunnels. After decapsulating the data, the firewall inspects it similar to how it inspects traffic received on a TAP port. It then creates enhanced application logs (EALs) and traffic, threat, WildFire, URL, data, GTP (when GTP is enabled), SCTP (when SCTP is enabled), tunnel, auth, and decryption logs. The firewall forwards these logs to the logging service where IoT Security accesses and analyzes the data.
8. Set the Global MTU depending on whether or not you enabled jumbo frames.

   • If you didn’t enable jumbo frames, the Global MTU defaults to 1,500 bytes; the range is 576 to 1,500 bytes.
   • If you enabled jumbo frames, the Global MTU defaults to 9,192 bytes; the range is 9,192 to 9,216 bytes.

   Jumbo frames must be enabled locally on the firewall. If you enable jumbo frames and you have interfaces where the MTU isn’t configured, those interfaces will automatically inherit the jumbo frame size. Therefore, before you enable jumbo frames, if you have any interface that you don’t want to have jumbo frames, you must set the MTU for that interface to 1,500 bytes or another value.
9. Check (enable) Enable DHCP Broadcast Session if your firewall acts as DHCP server to enable session logs for DHCP broadcast packets.

   This setting enables generation of Enhanced Application logs (EAL logs) for DHCP for use by IoT Security and other services. If you don’t enable this setting, the firewall forwards the packets without creating logs for the DHCP broadcast packets.
10. NAT64 IPv6 Minimum Network MTU—Sets the global MTU for IPv6 translated traffic. The default of 1,280 bytes is based on the standard minimum MTU for IPv6 traffic.
11. Set the NAT Oversubscription Rate to multiply the number of times that the same translated IP address and port pair can be used correctly when NAT is configured to be Dynamic IP and Port (DIPP) translation.

    The rate is 1, 2, 4, or 8. A rate of one (1) means no oversubscription; each translated IP address and port pair can be used only once at a time. Reducing the oversubscription rate decreases the number of source device translations, but provides higher NAT rule capacities.
12. Tune the Accelerated Aging settings to enable faster aging-out of idle sessions.

    This setting is enabled by default.

    • Accelerated Aging Threshold—Percentage of the session table that is full when accelerated aging begins. The default is 80%. When the session table reaches this threshold (% full), the firewall applies the Accelerated Aging Scaling Factor to the aging calculations for all sessions.
    • Accelerated Aging Scaling Factor—Scaling factor used in the accelerated aging calculations. The default scaling factor is 2, meaning that the accelerated aging occurs at a rate twice as fast as the configured idle time. The configured idle time divided by two (2) results in a faster timeout of one-half the time. To calculate the session’s accelerated aging, the firewall divides the configured idle time (for that type of session) by the scaling factor to determine a shorter timeout.
13. Tune the Packet Buffer Protection settings to enable the firewall to take action against sessions that can overwhelm its packet buffer and cause legitimate traffic to be dropped.

    This setting is enabled by default.

    • Alert %—When packet buffer utilization exceeds this threshold, the firewall creates a log event. The threshold is set to 50% by default and the range is 0% to 99%. If the value is set to 0%, the firewall doesn’t create a log event.
    • Activate %—When a packet buffer utilization exceeds this threshold, the firewall applies Random Early Detection (RED) to abusive sessions. The threshold is set to 80% by default and the range is 0% to 99%. If the value is set to 0%, the firewall doesn’t apply RED.
    • Block Hold Time (sec)—The amount of time a RED-mitigated session is allowed to continue before it’s discarded. By default, the block hold time is 60 seconds.
      Range is 0 to 65,535 seconds. If the value is set to 0, the firewall doesn’t discard sessions based on packet buffer protection
    • Block Duration (sec)—This setting defines how long a session is discarded or an IP address is blocked.
      Default is 3,600 seconds. Range of 0 seconds to 15,999,999 seconds. If this value is set to 0, the firewall doesn’t discard sessions or block IP addresses based on packet buffer protection.
14. Tune the Multicast Route Setup Buffering setting to enable the firewall to preserve the first packet in a multicast session when the multicast route or forwarding information base (FIB) entry doesn’t yet exist for the corresponding multicast group.

    By default, the firewall doesn’t buffer the first multicast packet in a new session; instead, it uses the first packet to set up the multicast route. This is expected behavior for multicast traffic. You only need to enable multicast route setup buffering if your content servers are directly connected to the firewall and your custom application can’t withstand the first packet in the session being dropped. This option is disabled by default.

    Tune the Buffer Size to specify the buffer size per flow. Maximum is 5,000 packets.
15. Save.
16. (Optional) Configure the remaining firewall session settings.

    • Configure Session Timeouts
    • Configure VPN Session Settings
17. Push Config to push your configuration changes.