The timeout for a session in a Juniper SRX device that has received just a SYN packet (indicating the initiation of a TCP connection) but has not yet completed the TCP handshake, is typically shorter than that of an established session.

This is to prevent incomplete or potentially malicious connections from consuming resources indefinitely.

By default, the timeout for such an embryonic (half-open) TCP session on an SRX device is 20 seconds. This means that if the TCP handshake does not complete within 20 seconds (i.e., the SYN-ACK and ACK packets are not received), the session will be automatically removed from the session table after 20 seconds)

To verify the current initial timeout value of the session, you can use the below steps:
 

Initiate telnet from any Linux machine so that traffic passes through SRX and check the session table session timeout values

As the timeout is set to default so session stayed in session table for 20s and as SYN-ACK and ACK packets are not received the session is removed from session table
 

[labroot@centos-7 ~]$ telnet 8.8.4.4
Trying 8.8.4.4...
^C

root@jtac-srx345-r2013> show security flow session destination-prefix 8.8.4.4 |refresh 2
---(refreshed at 2024-07-23 00:26:54 IST)---
Total sessions: 0
---(refreshed at 2024-07-23 00:26:56 IST)---
Total sessions: 0
---(refreshed at 2024-07-23 00:26:58 IST)---
Total sessions: 0
---(refreshed at 2024-07-23 00:27:00 IST)---
Session ID: 7539, Policy name: permit-all/4, Timeout: 20, Session State: Valid         >>>>Session having initial Timeout of 20s
  In: 172.30.179.121/35288 --> 8.8.4.4/23;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 1, Bytes: 60,
  Out: 8.8.4.4/23 --> 10.219.65.90/14414;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 0, Bytes: 0,
Total sessions: 1
---(refreshed at 2024-07-23 00:27:02 IST)---
Session ID: 7539, Policy name: permit-all/4, Timeout: 18, Session State: Valid
  In: 172.30.179.121/35288 --> 8.8.4.4/23;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 2, Bytes: 120,
  Out: 8.8.4.4/23 --> 10.219.65.90/14414;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 0, Bytes: 0,
Total sessions: 1
---(refreshed at 2024-07-23 00:27:04 IST)---
Session ID: 7539, Policy name: permit-all/4, Timeout: 16, Session State: Valid
  In: 172.30.179.121/35288 --> 8.8.4.4/23;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 3, Bytes: 180,
  Out: 8.8.4.4/23 --> 10.219.65.90/14414;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 0, Bytes: 0,
Total sessions: 1
---(refreshed at 2024-07-23 00:27:06 IST)---
Session ID: 7539, Policy name: permit-all/4, Timeout: 14, Session State: Valid
  In: 172.30.179.121/35288 --> 8.8.4.4/23;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 3, Bytes: 180,
  Out: 8.8.4.4/23 --> 10.219.65.90/14414;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 0, Bytes: 0,
Total sessions: 1
---(refreshed at 2024-07-23 00:27:16 IST)---
Session ID: 7539, Policy name: permit-all/4, Timeout: 4, Session State: Valid
  In: 172.30.179.121/35288 --> 8.8.4.4/23;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 5, Bytes: 300,
  Out: 8.8.4.4/23 --> 10.219.65.90/14414;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 0, Bytes: 0,
Total sessions: 1
---(refreshed at 2024-07-23 00:27:18 IST)---
Session ID: 7539, Policy name: permit-all/4, Timeout: 2, Session State: Valid
  In: 172.30.179.121/35288 --> 8.8.4.4/23;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 5, Bytes: 300,
  Out: 8.8.4.4/23 --> 10.219.65.90/14414;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 0, Bytes: 0,
Total sessions: 1
---(refreshed at 2024-07-23 00:27:20 IST)---
Total sessions: 0              >>>>>After 20s removed as the SYN-ACK and ACK packets are not received
---(refreshed at 2024-07-23 00:27:22 IST)---
Total sessions: 0
---(refreshed at 2024-07-23 00:27:24 IST)---
 

Same can be verified from traceoption
 

root@jtac-srx345-r2013> show log Trace |match curr
Jul 23 00:38:15 00:38:15.280632:CID-0:RT:  app 10, timeout 1800s, curr ageout 20s
 

To change the Timeout for TCP session when initialization fails to another value go to below hierarchy
 

[edit]
root@jtac-srx345-r2013# edit security flow tcp-session

[edit security flow tcp-session]
root@jtac-srx345-r2013# set tcp-initial-timeout ?
Possible completions:
<tcp-initial-timeout>  Timeout for TCP session when initialization fails (4..300 seconds)
[edit security flow tcp-session]
root@jtac-srx345-r2013# set tcp-initial-timeout ?
Possible completions:
<tcp-initial-timeout>  Timeout for TCP session when initialization fails (4..300 seconds)
[edit security flow tcp-session]
root@jtac-srx345-r2013# set tcp-initial-timeout 300               >>>>>We are setting it to 300s

 

Verification:
 

root@jtac-srx345-r2013> show security flow session destination-prefix 8.8.4.4 |refresh 1
---(refreshed at 2024-07-23 00:29:57 IST)---
Total sessions: 0
---(refreshed at 2024-07-23 00:29:59 IST)---
Total sessions: 0
---(refreshed at 2024-07-23 00:30:00 IST)---
Total sessions: 0
---(refreshed at 2024-07-23 00:30:02 IST)---
Session ID: 7547, Policy name: permit-all/4, Timeout: 300, Session State: Valid
  In: 172.30.179.121/35294 --> 8.8.4.4/23;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 1, Bytes: 60,
  Out: 8.8.4.4/23 --> 10.219.65.90/18743;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 0, Bytes: 0,
Total sessions: 1
---(refreshed at 2024-07-23 00:30:04 IST)---
Session ID: 7547, Policy name: permit-all/4, Timeout: 298, Session State: Valid
  In: 172.30.179.121/35294 --> 8.8.4.4/23;tcp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 2, Bytes: 120,
  Out: 8.8.4.4/23 --> 10.219.65.90/18743;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 0, Bytes: 0,
Total sessions: 1

root@jtac-srx345-r2013> show log Trace |match curr
Jul 23 00:38:15 00:38:15.280632:CID-0:RT:  app 10, timeout 1800s, curr ageout 300s
 

Reference URL: tcp-initial-timeout | Junos OS | Juniper Networks