Options
sysopt connection timewait
JayrodEF
Member Posts: 111 ■□□□□□□□□□
Hello,
Came across this command in an ASA config today and was curious why one may turn it on? It is on in one environment that is having difficulty with a server having a lot of time_wait sessions shown in a netstat output and was curious if this may have an impact. It's an ASA 8.0.4.
Thanks,
Jared
Came across this command in an ASA config today and was curious why one may turn it on? It is on in one environment that is having difficulty with a server having a lot of time_wait sessions shown in a netstat output and was curious if this may have an impact. It's an ASA 8.0.4.
Thanks,
Jared
Comments
-
Options
Vask3n
Member Posts: 517
Had to look this up too even though the sysopt keyword sounds familiar.
Apparently this is an older feature and this command changes the default behavior of terminating TCP sessions so that both the source and destination need to terminate the TCP connection at the same time, instead of sending Fin/Ack exchanges in the way it's normally done
It's documented here
Advanced Features of the PIX Firewall
Edit: Ah yes, now I remember sysopt from the FIREWALL days: sysopt connection permit-vpn to allow VPN users to bypass ACLs
http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/s8.html#wp1517364Working on MS-ISA at Western Governor's University