Configure Session Timeouts (PAN-OS)

1. Access the session timeouts.

   Select DeviceSetupSession and edit the Session Timeouts.
2. (Optional) Change miscellaneous timeouts.

   • Default—Maximum length of time that a non-TCP/UDP or non-ICMP session can be open without a response (range is 1 to 15,999,999; default is 30).
   • Discard Default—Maximum length of time that a non-TCP/UDP session remains open after PAN-OS denies a session based on security policies configured on the firewall (range is 1 to 15,999,999; default is 60).
   • Scan—Maximum length of time that any session remains open after it is considered inactive; an application is regarded as inactive when it exceeds the application trickling threshold defined for the application (range is 5 to 30; default is 10).
   • Authentication Portal—Authentication session timeout for the Captive Portal web form. To access the requested content, the user must enter the authentication credentials in this form and be successfully authenticated (range is 1 to 15,999,999; default is 30).
   • To define other Authentication Portal timeouts, such as the idle timer and the expiration time before the user must be re-authenticated, select DeviceUser IdentificationAuthentication Portal Settings. See Configure Authentication Portal.
3. (Optional) Change TCP timeouts.

   • Discard TCP—Maximum length of time that a TCP session remains open after it is denied based on a security policy configured on the firewall. Range is 1 to 15,999,999; default is 90.
   • TCP—Maximum length of time that a TCP session remains open without a response, after a TCP session is in the Established state (after the handshake is complete and/or data is being transmitted). Range is 1 to 15,999,999; default is 3,600.
   • TCP Handshake—Maximum length of time permitted between receiving the SYN-ACK and the subsequent ACK to fully establish the session. Range is 1 to 60; default is 10.
   • TCP init—Maximum length of time permitted between receiving the SYN and SYN-ACK prior to starting the TCP handshake timer. Range is 1 to 60; default is 5.
   • TCP Half Closed—Maximum length of time between receiving the first FIN and receiving the second FIN or a RST. Range is 1 to 604,800; default is 120.
   • TCP Time Wait—Maximum length of time after receiving the second FIN or a RST. Range is 1 to 600; default is 15.
   • Unverified RST—Maximum length of time after receiving a RST that cannot be verified (the RST is within the TCP window but has an unexpected sequence number, or the RST is from an asymmetric path). Range is 1 to 600; default is 30.
   • See also the Scan timeout in the section (Optional) Change Miscellaneous Timeouts above.
4. (Optional) Change UDP timeouts.

   • Discard UDP—Maximum length of time that a UDP session remains open after it is denied based on a security policy configured on the firewall. Range is 1 to 15,999,999; default is 60.
   • UDP—Maximum length of time that a UDP session remains open without a UDP response. Range is 1 to 15,999,999; default is 30.
   • See also the Scan timeout in the section (Optional) Change Miscellaneous Timeouts above.
5. (Optional) Change ICMP timeouts.

   • ICMP—Maximum length of time that an ICMP session can be open without an ICMP response. Range is 1 to 15,999,999; default is 6.
   • See also the Discard Default and Scan timeout in the section (Optional) Change Miscellaneous Timeouts above.
6. Click OK and Commit.
7. (Optional) Change the ARP cache timeout.

   1. Access the CLI and specify how many seconds the firewall keeps ARP entries in its cache. Use the operational command set system setting arp-cache-timeout <value>, where the range is 60 to 65,535; default is 1,800.

      If you decrease the timeout and existing entries in the cache have a TTL greater than the new timeout, the firewall removes those entries and refreshes the ARP cache. If you increase the timeout and existing entries have a TTL less than the new timeout, they expire according to the TTL and the firewall caches new entires with the larger timeout value.
   2. View the ARP cache timeout setting with the operational CLI command show system setting arp-cache-timeout.