Description

This article provides information about the session timeout behavior with TCP 3-way and 4-way close.

Symptoms

The session timeout for a TCP session changes, as shown below, with TCP 3-way and 4-way close. 

[TCP - 3 Way Close]
   Client                  Server
(1) <----------FIN-------------
(2) ---------FIN/ACK----------> <==Timeout 150
(3) <----------ACK------------- <==Timeout 2 


[TCP - 4 Way Close]
   Client                  Server
(1) <--------FIN/ACK-----------
(2) ----------ACK------------->
(3) ---------FIN/ACK----------> <===Timeout 150
(4) <---------ACK-------------- <===Timeout 2

Solution


When the second FIN is received, the session will be in session timeout state and waiting for the final ACK to finish the TCP close. By default, the value of the time-wait-state is 150 seconds. 

[edit security flow tcp-session]
[email protected]# set ?
Possible completions:
> time-wait-state      Session timeout value in time-wait state, default 150 seconds

The timeout can be configured, as shown below: 
[edit security flow tcp-session]
[email protected]# set time-wait-state ?
  session-ageout       Allow session to ageout using service based timeout values
  session-timeout      Configure session timeout value for time-wait state (2..600 seconds)

When the final ACK is received, the session changes to Timeout 2; this means that it is now marked as a garbage session and will be removed by the ager ring in 2 seconds.