Description

FTPs control connection is down when one small value of "inactivity-timeout" is set in a custom security application.

Symptoms

Some users allow FTPs implicit pass through SRX, then set a custom security application to allow the related traffic as shown below: 

set applications application TCP-989 inactivity-timeout 7200
set applications application TCP-990 protocol tcp
set applications application TCP-990 destination-port 990
set applications application TCP-990 inactivity-timeout 20

set applications application TCP-45001-45100 protocol tcp
set applications application TCP-45001-45100 destination-port 3000-635535
set applications application TCP-45001-45100 inactivity-timeout 7200


After files transmission complete, the FTPs connection shows down and needs to be re-connected.

In SRX:

Both control and data sessions: 

root# run show security flow session    
Session ID: 16361, Policy name: Trust-to-Untrust_0001/4, Timeout: 2, Valid  <<
  In: 192.168.4.4/41611 --> 192.168.5.10/990;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 25, Bytes: 2445,
  Out: 192.168.5.10/990 --> 192.168.4.4/41611;tcp, Conn Tag: 0x0, If: ge-0/0/4.0, Pkts: 23, Bytes: 4538,

Session ID: 16363, Policy name: Trust-to-Untrust_0001/4, Timeout: 7200, Valid  <<
  In: 192.168.4.4/41614 --> 192.168.5.10/55525;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 32893, Bytes: 1389928,
  Out: 192.168.5.10/55525 --> 192.168.4.4/41614;tcp, Conn Tag: 0x0, If: ge-0/0/4.0, Pkts: 63235, Bytes: 93014779,
Total sessions: 2


Then only data session left: 

[edit]
root# run show security flow session    
Session ID: 16363, Policy name: Trust-to-Untrust_0001/4, Timeout: 7200, Valid
  In: 192.168.4.4/41614 --> 192.168.5.10/55525;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 45320, Bytes: 1888784,
  Out: 192.168.5.10/55525 --> 192.168.4.4/41614;tcp, Conn Tag: 0x0, If: ge-0/0/4.0, Pkts: 88086, Bytes: 128020227,
Total sessions: 1

Solution

Set the inactivity-timeout for control connection longer or never: 

set applications application TCP-990 protocol tcp
set applications application TCP-990 destination-port 990
set applications application TCP-990 inactivity-timeout never


Then: 

[edit]
root# run show security flow session    
Session ID: 16673, Policy name: Trust-to-Untrust_0001/4, Timeout: -1, Valid  <<
  In: 192.168.4.4/42847 --> 192.168.5.10/990;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 33, Bytes: 2984,
  Out: 192.168.5.10/990 --> 192.168.4.4/42847;tcp, Conn Tag: 0x0, If: ge-0/0/4.0, Pkts: 28, Bytes: 5432,

Session ID: 16677, Policy name: Trust-to-Untrust_0001/4, Timeout: 7200, Valid  <<
  In: 192.168.4.4/42866 --> 192.168.5.10/58906;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 12374, Bytes: 601804,
  Out: 192.168.5.10/58906 --> 192.168.4.4/42866;tcp, Conn Tag: 0x0, If: ge-0/0/4.0, Pkts: 21066, Bytes: 30356126,
Total sessions: