topic How to listing TCP services with non-default tcp idle timout (virtual session timeout) in General Topics

How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Norbert_Papirny — Mon, 06 Jan 2020 11:42:39 GMT

Hello everyone,

Is there a way listing TCP services with non-default tcp idle timout?

We must to put another non checkpoint firewall before the main cluster, and we need to know which tcp services has configured specific virtual session timout.

many thanks,

norbert

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

_Val_ — Mon, 06 Jan 2020 13:12:40 GMT

(Had to delete my original reply as it was erroneous)

Okay, so we have two different cases:

1. Timeouts are lower than global settings, .ie. aggressive aging. Should not be problematic and does not need extraction.

2. Timeouts are higher than global. That only happens if you modify the service manually. I did not find an option to query those parameter on per service basis, but there is a way:

find all services that were modified from default. Open object explorer and sort by "Modifier". Anything non-default will show with particular user names instead of "system"
Manually go over advanced to see which modifications were affecting

If I find a better way, I will let you know

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

_Val_ — Mon, 06 Jan 2020 13:38:08 GMT

You can also dump all TCP services into a file with dbedit command something like:

echo -e "query services, type='tcp' \n-q\n" | dbedit -local > tcp.txt

and then search there. Or event extend command to a script comparing default and actual timeout for each server.

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

_Val_ — Tue, 07 Jan 2020 09:10:08 GMT

The third and last option is to get TCP services though API:

mgmt_cli -r true show-services-tcp details-level full

and then run it through analysis, comparing default and actual timeout on all services.

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

masher — Mon, 06 Jan 2020 17:46:42 GMT

To follow-up on @_Val_'s responses, there are two different settings within a TCP service object that might be beneficial in your search. The "use-default-session-timeout" and"session-timeout" parameters can be used with with a select statement with jq in order to filter the service objects.

[admin@vMgmt01]# mgmt_cli -s session show services-tcp details-level full -f json limit 500 | jq -r '.objects[]| select(."use-default-session-timeout"==false)|.name'
http_test1
http_test2

[admin@vMgmt01]# mgmt_cli -s session show services-tcp details-level full -f json limit 500 | jq -r '.objects[]| select(."session-timeout"<3600)|.name'
http_test1
icap
IKE_NAT_TRAVERSAL_TCP
...
[admin@vMgmt01]# mgmt_cli -s session show services-tcp details-level full -f json limit 500 | jq -r '.objects[]| select(."session-timeout">3600)|.name'
http_test

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Norbert_Papirny — Tue, 07 Jan 2020 08:48:45 GMT

Hi,
thank for your your replies!
I used "details-level" instead of "default-level" and its worked! 🙂

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

_Val_ — Tue, 07 Jan 2020 09:10:34 GMT

uh, it was a typo. fixed

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Norbert_Papirny — Wed, 08 Jan 2020 09:27:16 GMT

I tried to run the command, but I always get this error:

[Expert@xxxxxx:0]# mgmt_cli show services-tcp details-level full -f json limit 5 | jq -r '.objects[]| select(."session-timeout">3600)|.name'

parse error: Invalid numeric literal at line 1, column 9

Do you have any idea what i am doing wrong?

Many thanks,

norbert

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

_Val_ — Wed, 08 Jan 2020 09:35:52 GMT

You need to add authentication. Either add user / password or "-r true" at the beginning of the command

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Norbert_Papirny — Wed, 08 Jan 2020 10:09:29 GMT

yes, that was my fault, i forgot to put login information to the session file...
"mgmt_cli login>session"

thanks a lot, everything is working now!
🙂