Firewall connections Timeout ????

Unanswered Question
Mar 12th, 2008
User Badges:

Hi all,


Our firewall has the default timeout for idle connections and is set at 1 hour.


i know i can change this, but my question is this :


Is there a way that i can configure the firewall, to have different idle timeouts for for different groups based on their IP, or subnet or something similar i can use to differentiate the groups ?


thanks ,


George


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Jon Marshall Thu, 03/13/2008 - 02:29
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

George


Which firewall hardware and what version of code are you running. The short answer is yes you can do this if your are running v7.x code or later (v3.x code on an FWSM). If you are running v6.x code (v2.x on an FWSM) you cannot do this as the timeouts are global.


If you let me know hardware/software i can send you a link.


Jon

g-serghiou Fri, 03/14/2008 - 00:54
User Badges:

Hi,


its a PIX 515 with 7.2(2) version !


Thanks,


George

Jon Marshall Fri, 03/14/2008 - 02:15
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

How is this not helpful ???

g-serghiou Fri, 03/14/2008 - 04:32
User Badges:

Its very helpful actually...

i also left u 5 rating score !!! (ifi remember correctly !!)


i never said it was nto helpful,


and once again,


thanks for your help !!!


Georgte

Jon Marshall Fri, 03/14/2008 - 04:36
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

George


Apologies, it's the way the responses sometimes are presented. I wasn't referring to your rating or response, rather the fact that someone else rated my original response in this thread as not helpful.


My comment was not intended for you. Many thanks for your rating, hope that clears things up


Jon

g-serghiou Fri, 03/14/2008 - 04:56
User Badges:

no worries Jon !!!


im clear with things...ill see what they want to achieve and come up with a suitable solution !!!


Thanks again

George


Herbert Baerten Fri, 03/14/2008 - 04:21
User Badges:
  • Cisco Employee,

Yes, you can set the connection timeout in a policy-map, so you can specify different values per class.


see http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080624e19.shtml


The example here has a class-map matching destination IP and port, but you can just as well match on source IP address.


If you need more help let us know.


[edit] Sorry, hadn't noticed this had been answered already :)

g-serghiou Fri, 03/14/2008 - 04:58
User Badges:

hi hebaerte


thanks for your reply as well...


all replies were/are welcome and helpful...


Thanks all,


George

Actions

This Discussion