This topic describes various settings for sessions other than timeouts values. Perform these tasks if you need to change the default settings.
- Change the session settings.Selectand edit the Session Settings.DeviceSetupSession
- Specify whether to apply newly configured Security policy rules to sessions that are in progress.SelectRematch all sessions on config policy changeto apply newly configured Security policy rules to sessions that are already in progress. This capability is enabled by default. If you clear this check box, any policy rule changes you make apply only to sessions initiated after you commit the policy change.For example, if a Telnet session started while an associated policy rule was configured that allowed Telnet, and you subsequently committed a policy change to deny Telnet, the firewall applies the revised policy to the current session and blocks it.
- Configure IPv6 settings.
- ICMPv6 Token Bucket Size—Default: 100 tokens. See the section ICMPv6 Rate Limiting.
- ICMPv6 Error Packet Rate (per sec)—Default: 100. See the section ICMPv6 Rate Limiting.
- Enable IPv6 Firewalling—Enables firewall capabilities for IPv6. All IPv6-based configurations are ignored if IPv6 is not enabled. Even if IPv6 is enabled for an interface, theIPv6 Firewallingsetting must also be enabled for IPv6 to function.
- Enable jumbo frames and set the MTU.
- SelectEnable Jumbo Frameto enable jumbo frame support on Ethernet interfaces. Jumbo frames have a maximum transmission unit (MTU) of 9216 bytes and are available on certain platforms.
- Set theGlobal MTU, depending on whether or not you enabled jumbo frames:
If you enable jumbo frames and you have interfaces where the MTU is not specifically configured, those interfaces will automatically inherit the jumbo frame size. Therefore, before you enable jumbo frames, if you have any interface that you do not want to have jumbo frames, you must set the MTU for that interface to 1500 bytes or another value.
- If you did not enable jumbo frames, theGlobal MTUdefaults to 1,500 bytes; the range is 576 to 1,500 bytes.
- If you enabled jumbo frames, theGlobal MTUdefaults to 9192 bytes; the range is 9,192 to 9,216 bytes.
- Tune NAT session settings.
- NAT64 IPv6 Minimum Network MTU—Sets the global MTU for IPv6 translated traffic. The default of 1280 bytes is based on the standard minimum MTU for IPv6 traffic.
- NAT Oversubscription Rate—If NAT is configured to be Dynamic IP and Port (DIPP) translation, an oversubscription rate can be configured to multiply the number of times that the same translated IP address and port pair can be used concurrently. The rate is 1, 2, 4, or 8. The default setting is based on the firewall platform.
Reducing the oversubscription rate decreases the number of source device translations, but provides higher NAT rule capacities.
- A rate of 1 means no oversubscription; each translated IP address and port pair can be used only once at a time.
- If the setting isPlatform Default, user configuration of the rate is disabled and the default oversubscription rate for the platform applies.
- Tune accelerated aging settings.SelectAccelerated Agingto enable faster aging-out of idle sessions. You can also change the threshold (%) and scaling factor:
- Accelerated Aging Threshold—Percentage of the session table that is full when accelerated aging begins. The default is 80%. When the session table reaches this threshold (% full), PAN-OS applies the Accelerated Aging Scaling Factor to the aging calculations for all sessions.
- Accelerated Aging Scaling Factor—Scaling factor used in the accelerated aging calculations. The default scaling factor is 2, meaning that the accelerated aging occurs at a rate twice as fast as the configured idle time. The configured idle time divided by 2 results in a faster timeout of one-half the time. To calculate the session’s accelerated aging, PAN-OS divides the configured idle time (for that type of session) by the scaling factor to determine a shorter timeout.For example, if the scaling factor is 10, a session that would normally time out after 3600 seconds would time out 10 times faster (in 1/10 of the time), which is 360 seconds.
- Enable buffering of multicast route setup packets.
- SelectMulticast Route Setup Bufferingto enable the firewall to preserve the first packet in a multicast session when the multicast route or forwarding information base (FIB) entry does not yet exist for the corresponding multicast group. By default, the firewall does not buffer the first multicast packet in a new session; instead, it uses the first packet to set up the multicast route. This is expected behavior for multicast traffic. You only need to enable multicast route setup buffering if your content servers are directly connected to the firewall and your custom application cannot withstand the first packet in the session being dropped. This option is disabled by default.
- If you enable buffering, you can also tune theBuffer Size, which specifies the buffer size per flow. The firewall can buffer a maximum of 5,000 packets.You can also tune the duration, in seconds, for which a multicast route remains in the routing table on the firewall after the session ends by configuring the multicast settings on the virtual router that handles your virtual router (set theMulticast Route Age Out Time (sec)on thetab in the virtual router configuration.MulticastAdvanced
- Tune the Maximum Segment Size (MSS) adjustment size settings for a Layer 3 interface.
- Select, selectNetworkInterfacesEthernet,VLAN, orLoopback, and select a Layer 3 interface.
- SelectOther Info.
- SelectAdjust TCP MSSand enter a value for one or both of the following:
- IPv4 MSS Adjustment Size(range is 40-300 bytes; default is 40 bytes).
- IPv6 MSS Adjustment Size(range is 60-300 bytes; default is 60 bytes).
- Save the changes.ClickCommit.
- Reboot the firewall after changing the jumbo frame configuration.
- ClickReboot Device.
Recommended For You
Recommended videos not found.