Description

Customers may experience application timeouts after migrating their network environment from Palo Alto firewalls to Juniper SRX devices. This occurs due to differences in default TCP session timeout values between the two platforms.

Symptoms

Applications intermittently fail or timeout after migration.
Long-running transactions (typically over 30 minutes) do not complete successfully.
Traffic is dropped when the server (e.g., database) responds after a delay.

Solution

Root Cause:

  • Palo Alto firewalls have a default TCP session timeout of 3600 seconds (1 hour).
  • Juniper SRX devices have a default TCP session timeout of 1800 seconds (30 minutes).
  • Applications with long-running requests exceeding 30 minutes may cause SRX sessions to age out.
  • When the server eventually responds, the session no longer exists on the SRX, resulting in dropped traffic.
To prevent session timeouts for long-running applications, configure a custom application with an increased inactivity timeout.
 
set applications application HTTPS protocol tcp
set applications application HTTPS destination-port https
set applications application HTTPS inactivity-timeout 3600
 
Note: Adjust the inactivity-timeout value based on application requirements and apply the custom application in the relevant security policies to ensure it takes effect.
 
 

Modification History

2024-05-10 : Article Created