Re: [j-nsp] Security-flow TCP idle timeout at SRX

2013-02-06 Thread Misha Gzirishvili
As Anton mentioned, you should use custom defined application in security policy. Or you can alter default application, by creating custom application, by the same name. (for example: set applications application junos-http protocol tcp destination port 80 inactivity-timeout 84600) This method allo

Re: [j-nsp] Security-flow TCP idle timeout at SRX

2013-02-01 Thread Anton Yurchenko
The security policy you have does not use newly defined application myapp. If you use it in your policy then it will work, because of inactivity timeout you defined in the application myapp. On 2/1/13 12:28 AM, Robert Hass wrote: Hi I have issue with one of our applications. We have two sec

Re: [j-nsp] Security-flow TCP idle timeout at SRX

2013-02-01 Thread Michael Loftis
My understanding for SRX is that at the very least you need to be using the application in your firewall rules. So in your LAN to servers policy create a more specific match before the fallback "application any" wild card. Your current setup isn't necessarily using your application statement. I hav

[j-nsp] Security-flow TCP idle timeout at SRX

2013-02-01 Thread Robert Hass
Hi I have issue with one of our applications. We have two security zones: LAN and Servers. Computers from LAN are connecting to Servers to port TCP/2020 (it's CTI application). Users reported that they have to re-logon due to idle timeout - I checked security logs on SRX and sessions was disconn