For single service entries, service timeout lookup proceeds as follows:
The specified timeout in the service entry database, if set.
The default timeout in the service entry database, if specified in the predefined service.
The protocol-based default timeout table.
Services with multiple rule entries share the same timeout value. If multiple services share the same protocol and destination port range, all services share the last timeout value configured.
The protocol-based defaults are as follows:
TCP - 30 minutes
UDP - 1 minute
ICMP - 1 minute
Other - 30 minutes
For service groups and for the predefined service “ANY” (if timeout is not set), the service timeout lookup proceeds as follows:
1. The vsys TCP and UDP port-based timeout table, if a timeout is set.
2. The protocol-based default timeout table.
There are quite a few caveats you should examine to ensure you get the appropriate behavior. Take a look at the Concepts and Examples Guide, Volume 2: Fundamentals, chapter 5 under the heading of 'Setting a Service Timeout'.
Stefan Fouant JNCIE-SEC, JNCIE-SP, JNCIE-ENT, JNCI Technical Trainer, Juniper Networks
Follow us on Twitter @JuniperEducate
-- If this post was helpful, please mark this post as an "Accepted Solution". Kudos are always appreciated!
