Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Norbert_Papirny
Participant
Jump to solution

How to listing TCP services with non-default tcp idle timout (virtual session timeout)

Hello everyone,

Is there a way listing TCP services with non-default tcp idle timout?

We must to put another non checkpoint firewall before the main cluster, and we need to know which tcp services has configured specific virtual session timout.

many thanks,

norbert

0 Kudos
1 Solution

Accepted Solutions
_Val_
Admin
Admin

The third and last option is to get TCP services though API:

mgmt_cli -r true show-services-tcp details-level full

and then run it through analysis, comparing default and actual timeout on all services.

View solution in original post

9 Replies
_Val_
Admin
Admin

(Had to delete my original reply as it was erroneous)

Okay, so we have two different cases:

 

1. Timeouts are lower than global settings, .ie. aggressive aging. Should not be problematic and does not need extraction.

2. Timeouts are higher than global. That only happens if you modify the service manually. I did not find an option to query those parameter on per service basis, but there is a way:

  • find all services that were modified from default. Open object explorer and sort by "Modifier". Anything non-default will show with particular user names instead of "system"
  • Manually go over advanced to see which modifications were affecting Screenshot 2020-01-06 at 14.09.11.png

 

If I find a better way, I will let you know

 

 

 

 

0 Kudos
_Val_
Admin
Admin

You can also dump all TCP services into a file with dbedit command something like:

echo -e "query services, type='tcp' \n-q\n" | dbedit -local > tcp.txt 

and then search there. Or event extend command to a script comparing default and actual timeout for each server.

0 Kudos
_Val_
Admin
Admin

The third and last option is to get TCP services though API:

mgmt_cli -r true show-services-tcp details-level full

and then run it through analysis, comparing default and actual timeout on all services.

Norbert_Papirny
Participant
Hi,
thank for your your replies!
I used "details-level" instead of "default-level" and its worked! 🙂

0 Kudos
_Val_
Admin
Admin

uh, it was a typo. fixed

0 Kudos
masher
Employee
Employee

To follow-up on @_Val_'s responses, there are two different settings within a TCP service object that might be beneficial in your search. The "use-default-session-timeout" and"session-timeout" parameters can be used with with a select statement with jq in order to filter the service objects. 

[admin@vMgmt01]# mgmt_cli -s session show services-tcp details-level full -f json limit 500 | jq -r '.objects[]| select(."use-default-session-timeout"==false)|.name'
http_test1
http_test2

[admin@vMgmt01]# mgmt_cli -s session show services-tcp details-level full -f json limit 500 | jq -r '.objects[]| select(."session-timeout"<3600)|.name'
http_test1
icap
IKE_NAT_TRAVERSAL_TCP
...
[admin@vMgmt01]# mgmt_cli -s session show services-tcp details-level full -f json limit 500 | jq -r '.objects[]| select(."session-timeout">3600)|.name'
http_test

 

 

Norbert_Papirny
Participant

I tried to run the command, but I always get this error:

[Expert@xxxxxx:0]# mgmt_cli show services-tcp details-level full -f json limit 5 | jq -r '.objects[]| select(."session-timeout">3600)|.name'

parse error: Invalid numeric literal at line 1, column 9

Do you have any idea what i am doing wrong?

Many thanks,

norbert

0 Kudos
_Val_
Admin
Admin

You need to add authentication. Either add user / password or "-r true" at the beginning of the command

 

Norbert_Papirny
Participant
yes, that was my fault, i forgot to put login information to the session file...
"mgmt_cli login>session"

thanks a lot, everything is working now!
🙂

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events