sysopt connection timewait

JayrodEF

Hello,
Came across this command in an ASA config today and was curious why one may turn it on? It is on in one environment that is having difficulty with a server having a lot of time_wait sessions shown in a netstat output and was curious if this may have an impact. It's an ASA 8.0.4.



Thanks,
Jared

Vask3n

Had to look this up too even though the sysopt keyword sounds familiar.

Apparently this is an older feature and this command changes the default behavior of terminating TCP sessions so that both the source and destination need to terminate the TCP connection at the same time, instead of sending Fin/Ack exchanges in the way it's normally done

It's documented here
Advanced Features of the PIX Firewall



Edit: Ah yes, now I remember sysopt from the FIREWALL days: sysopt connection permit-vpn to allow VPN users to bypass ACLs

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/s8.html#wp1517364