FTP control session cannot time out even after TCP FIN ACK is received in client and server side. This article explains how to use the command
set security flow tcp-session fin-invalidate-session
to release the session.
An FTP control session remains pending with timeout =2 for a long time, despite the TCP session having received a finish command ( receive TCP FIN/TCP FIN-ACK ). After disabling FTP ALG, the issue is fixed.
timeout
receive TCP FIN/TCP FIN-ACK
root@SRX3600-a> show security flow session node0: Flow Sessions on FPC7 PIC0: Session ID: 140000020, Policy name: 37050060/96, State: Active, Timeout: 2 ;, Valid Resource information : FTP ALG, 1, 0 In: 192.168.1.1/47986 --> 192.168.2.1/21;tcp, If: reth0.0, Pkts: 21, Bytes: 996 Out: 192.168.2.1/21 --> 192.168.1.1/47986;tcp, If: reth1.0, Pkts: 20, Bytes: 1426 Session ID: 140000021, Policy name: 37050060/96, State: Active, Timeout: 224, Valid Resource information : FTP ALG, 1, 1 In: 192.168.1.1/50752 --> 192.168.2.1/26485;tcp, If: reth0.0, Pkts: 5, Bytes: 204 Out: 192.168.2.1/26485 --> 192.168.1.1/50752;tcp, If: reth1.0, Pkts: 5, Bytes: 3951 Total sessions: 2
From the session information, it can be seen that both wings of FTP Control session are in FIN State 2, (Please refer to KB22738 [juniper.net] for details of FIN State) and this session is about to age out.
root@SRX3600-a> show security flow session session-identifier 140000020 Flow Sessions on FPC7 PIC0: Session ID: 140000020, Status: Normal, State: Active Flag: 0x88000042 Policy name: 37050060/96 Source NAT pool: Null, Application: junos-ftp/1 Maximum timeout: 2, Current timeout: 2 Session State: Valid Start time: 563, Duration: 463 Client: FTP ALG, Group: 1, Resource: 0 In: 192.168.1.1/47986 --> 192.168.2.1/21;tcp, Interface: reth0.0, Session token: 0x6, Flag: 0x0x2621 Route: 0x8d3bf28, Gateway: 192.168.1.1, Tunnel: 0 Port sequence: 0, FIN sequence: 0, FIN state: 2, Pkts: 21, Bytes: 996 Out: 192.168.2.1/21 --> 192.168.1.1/47986;tcp, Interface: reth1.0, Session token: 0x7, Flag: 0x0x2620 Route: 0x8d3c728, Gateway: 192.168.2.1, Tunnel: 0 Port sequence: 0, FIN sequence: 0, FIN state: 2 Pkts: 20, Bytes: 1426 Total sessions: 1
Based on FTP ALG Traceoptions, note that the FTP Control session fail to close due to close check:
root@SRX3600-a> show configuration security alg traceoptions { file alg_debug size 5m; level verbose; } ftp traceoptions flag all;
root@SRX3600-a> show log alg_debug Nov 25 13:02:05 13:02:04.800786:CID-01:FPC-07:PIC-00:THREAD_ID-14:RT:[ALG_FTP] INFO: ALG FTP TRACE jsf_ftp_alg_data_handler:3006 Nov 25 13:02:05 13:02:04.800801:CID-01:FPC-07:PIC-00:THREAD_ID-14:RT:[ALG_FTP] INFO: ALG FTP TRACE jsf_alg_ftp_sess_close_check_handler:2595 Nov 25 13:02:05 13:02:04.800820:CID-01:FPC-07:PIC-00:THREAD_ID-14:RT:[ALG_FTP] INFO: Control session close check, NO_CLOSE.
Note also from the junos-alg plugin counter below, the Close check not ok counter keeps increasing continuously, while the control session is pending:
junos-alg plugin
Close check not ok
[flowd]FPC7.PIC0(vty)# show usp jsf flow per-plugin stats 13 junos-alg plugin [13] Interest check 22 Interest accept 21 Interest discard 0 Interest ignore 1 Create notify 21 Create accept 21 Create discard 0 Create ignore 0 Close check notify 711 Close check ok 14 Close check not ok 697
The root cause is that the FTP data session does not close correctly. For some reason, the FTP client did not reply with Fin ack to the FTP server. This will cause the FTP data session remain pending until timeout. During this time, the FTP control session has received Fin ack from both sides and attempts to close the control session, however before closing, it finds there is still RM resource which does not release, so it remains pending and waiting ALG alg to release the RM resource.
Fin ack
This is not a bug; the program is working by design. A workaround is to use the command " set security flow tcp-session fin-invalidate-session ". After enabling this command, the SRX will release the two second session even if the data session still does not release.
2020-08-03: Archived.