Description

This article describes the steps for configuring client-idle-timeout for host inbound traffic, and therefore for the traffic that is terminating on the SRX, for example SSH, Telnet, etc.

Symptoms

By default the client-idle-timeout is 1800 secs for TCP traffic and 60 secs for UDP traffic. There might be network requirements which require a change in these default settings.

Solution


Starting with Junos OS 11.4, users can apply security services to self traffic by referring to the junos-host zone in the Security Policies.

Considering the following setup:

PC(1.1.1.2)----(1.1.1.1) SRX

When the PC initiates a TCP connection using the application ssh/telent, a session with the default timeout of 1800 secs is installed on the device.

root@100-1# run show security flow session
Jul 09 03:08:56
Session ID: 14433, Policy name: self-traffic-policy/1, Timeout: 1754 , Valid
In: 1.1.1.2/3457 --> 1.1.1.1/22;tcp, If: fe-0/0/0.0, Pkts: 115, Bytes: 7852
Out: 1.1.1.1/22 --> 1.1.1.2/3457;tcp, If: .local..0, Pkts: 156, Bytes: 16785

The traffic matches the Junos self traffic and permits it.

To modify this default behaviour and configure client-idle-timeout to be 600 secs, we need to make the following configuration changes:

1. Configure a custom application

      applications {
           application my-ssh {
                 protocol tcp;
                 source-port 0-65535;
                 destination-port 22;    <<<<<<<< <for ssh traffic<br />                  inactivity-timeout 600;
           }

2. Configure a security policy to the junos-host zone and call the application

     [edit security policies]
      from-zone trust to-zone junos-host {
            policy test {
                   match {
                        source-address any;
                        destination-address any;
                         application my-ssh ;
                   }
                   then {
                       permit;
                  }
           }
     }

3. Commit the changes and initiate the traffic. The new session is formed as follows:

root@100-1# run show security flow session
Jul 09 02:58:27
Session ID: 14015, Policy name: test/4, Timeout: 556 , Valid
In: 1.1.1.2/3327 --> 1.1.1.1/22;tcp, If: fe-0/0/0.0, Pkts: 204, Bytes: 13956
Out: 1.1.1.1/22 --> 1.1.1.2/3327;tcp, If: .local..0, Pkts: 222, Bytes: 23185