Close Age Out Message

[faycal]

Hello All;

i want to ask you what mean Close Age out on the Log of Policy in  netscreen FW.

is there any relation with the Time Out of the Protocol used in this policy

please help me to resolve this issue.

Thanks

[rkim]

Yes, this is related to the timeout of the protocol as configured for each service or protocol defaults. However, I have seen instances where age out can be shown for certain FIN 4-way close with TCP proxy involved. Is there an issue you are seeing?

[faycal]

Thanks for your replay;

tell me please what mean exactly the Time Out of service? is it the time to close TCP connection when no data traffic done or the time to close connection just fot the first TCP negociation ?

it's important for me to know the exact definition of this Time out to trooblshoot some issue in my internal connection.

Thanks

[sfouant]

It depends on the protocol in use, but essentially yes it's when the underlying protocol times out (TCP, UDP, ICMP, etc.).  The session is closed when the duration of time for which no traffic has been received for a given session has elapsed.  It is not for the first TCP negotiation.  An entry is created in the session table once the session table is established and successive traffic which matches that session continually resets the timer.  See my response in the other thread for additional details.

http://forums.juniper.net/jnet/board/message?board.id=Firewalls&thread.id=43

[stkrzysiak]

Stefan,
For one reason or another I created the custom service Netbios for Netbios(NS). Wait, now I recall, although the firewall will detect and block 'Netscreen (NS)' packets, there doesn't seem to be a correlating predefined entry to allow for it when making a policy. Anyway, the service is setup as:

Netbios TCP src port: 0-65535, dst port: 137-137 30 Edit Remove

As you can see, the timeout is 30 minutes, yet in my firewall I constantly see:

2008-01-29 16:34:42 172.31.202.4:34113 10.200.1.2:137 172.31.202.4:34113 10.200.1.2:137 NETBIOS (NS) 60 sec. 96 102 Close - AGE OUT
2008-01-29 16:34:26 172.31.202.4:34112 10.200.1.2:137 172.31.202.4:34112 10.200.1.2:137 NETBIOS (NS) 59 sec. 96 102 Close - AGE OUT

So I went looking for a reason, since these sessions should not 'age out' at around the 60 second marker. Is there something behind the scenes that I am missing??

[kiteboy]

hi,

how do you explain that closeage out could be appear, before timer 30 min regarding a TCP session ?

it seems the case , for us on a cluster ISG2k.

regards.

[echidov]

Hi,

I would recommend to run debug and check if there are RPC mapping table hits as described in KB15038 "Sessions on Microsoft Active Directory Services Time Out Earlier Than Expected".