cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post
Highlighted

How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Jump to solution

Hello everyone,

Is there a way listing TCP services with non-default tcp idle timout?

We must to put another non checkpoint firewall before the main cluster, and we need to know which tcp services has configured specific virtual session timout.

many thanks,

norbert

0 Kudos
1 Solution

Accepted Solutions
Highlighted

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Jump to solution

The third and last option is to get TCP services though API:

mgmt_cli -r true show-services-tcp details-level full

and then run it through analysis, comparing default and actual timeout on all services.

View solution in original post

9 Replies
Highlighted

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Jump to solution

(Had to delete my original reply as it was erroneous)

Okay, so we have two different cases:

 

1. Timeouts are lower than global settings, .ie. aggressive aging. Should not be problematic and does not need extraction.

2. Timeouts are higher than global. That only happens if you modify the service manually. I did not find an option to query those parameter on per service basis, but there is a way:

  • find all services that were modified from default. Open object explorer and sort by "Modifier". Anything non-default will show with particular user names instead of "system"
  • Manually go over advanced to see which modifications were affecting Screenshot 2020-01-06 at 14.09.11.png

 

If I find a better way, I will let you know

 

 

 

 

0 Kudos
Highlighted

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Jump to solution

You can also dump all TCP services into a file with dbedit command something like:

echo -e "query services, type='tcp' \n-q\n" | dbedit -local > tcp.txt 

and then search there. Or event extend command to a script comparing default and actual timeout for each server.

0 Kudos
Highlighted

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Jump to solution

The third and last option is to get TCP services though API:

mgmt_cli -r true show-services-tcp details-level full

and then run it through analysis, comparing default and actual timeout on all services.

View solution in original post

Highlighted

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Jump to solution
Hi,
thank for your your replies!
I used "details-level" instead of "default-level" and its worked! 🙂

0 Kudos
Highlighted

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Jump to solution

uh, it was a typo. fixed

0 Kudos
Highlighted
Employee+
Employee+

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Jump to solution

To follow-up on @Val_Loukine's responses, there are two different settings within a TCP service object that might be beneficial in your search. The "use-default-session-timeout" and"session-timeout" parameters can be used with with a select statement with jq in order to filter the service objects. 

[admin@vMgmt01]# mgmt_cli -s session show services-tcp details-level full -f json limit 500 | jq -r '.objects[]| select(."use-default-session-timeout"==false)|.name'
http_test1
http_test2

[admin@vMgmt01]# mgmt_cli -s session show services-tcp details-level full -f json limit 500 | jq -r '.objects[]| select(."session-timeout"<3600)|.name'
http_test1
icap
IKE_NAT_TRAVERSAL_TCP
...
[admin@vMgmt01]# mgmt_cli -s session show services-tcp details-level full -f json limit 500 | jq -r '.objects[]| select(."session-timeout">3600)|.name'
http_test

 

 

Highlighted

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Jump to solution

I tried to run the command, but I always get this error:

[Expert@xxxxxx:0]# mgmt_cli show services-tcp details-level full -f json limit 5 | jq -r '.objects[]| select(."session-timeout">3600)|.name'

parse error: Invalid numeric literal at line 1, column 9

Do you have any idea what i am doing wrong?

Many thanks,

norbert

0 Kudos
Highlighted

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Jump to solution

You need to add authentication. Either add user / password or "-r true" at the beginning of the command

 

Highlighted

Re: How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Jump to solution
yes, that was my fault, i forgot to put login information to the session file...
"mgmt_cli login>session"

thanks a lot, everything is working now!
🙂