Description

This article describes the default UDP timeout value in SRX

Symptoms

The default UDP session timeout value is 60 seconds. But at times insecurity flow session you can see a different value. 

 

Session ID: 1228363610865, Policy name: Test, Timeout: 6302, Session State: Valid
In: 10.10.10.2/6881 --> 20.20.20.2/2727;udp, Conn Tag: 0x0, If: ae0.16, Pkts: 0, Bytes: 0, CP Session ID: 10958669
Out: 20.20.20.2/2727 --> 10.10.10.2/49694;udp, Conn Tag: 0x0, If: ae1.17, Pkts: 0, Bytes: 0, CP Session ID: 12035885

Solution

The default UDP timeout value is 60 seconds, but we have different timeout values based on the port numbers. 

 

In the below example, we are using the UDP port 2727. The timeout value for port 2727 is 7200 seconds. 

 

Session ID: 1228363610865, Policy name: Test, Timeout: 6302, Session State: Valid
In: 10.10.10.2/6881 --> 20.20.20.2/2727;udp, Conn Tag: 0x0, If: ae0.16, Pkts: 0, Bytes: 0, CP Session ID: 10958669
Out: 20.20.20.2/2727 --> 10.10.10.2/49694;udp, Conn Tag: 0x0, If: ae1.17, Pkts: 0, Bytes: 0, CP Session ID: 12035885

 

udp port=2727, appl_name=junos-mgcp-ca, service type=73, alg id=73, timeout=7200

 

This can be obtained using the below command. It gives the port numbers and their timeout values in seconds. 

request pfe execute command "show usp app-def udp" target fwdd | no-more

 

Note: You can replace udp with other protocols like, tcp, icmp to get respective values. 

Modification History

2024-12-17 : Article Created