Solved

Cisco ASA Timeout Conn setting, what are the risks of lowering?

Posted on 2015-01-19
1
432 Views
Last Modified: 2015-01-20
Have an ASA that is over utilized in general. Working on temporary measures to free up any resources/bandwidth on the box. Until new hardware arrives

What is the danger of setting the Timeout Conn to say, 5, or 2 minutes? This FW is mostly used for web browsing traffic. I believe I read an article on increasing ASA performance suggesting to lower it to 2 minutes, which is the default for the FWSM module.

Thoughts?
0
Comment
Question by:LIBBB
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 7

Accepted Solution

by:
tolinrome earned 500 total points
ID: 40557880
This command will show you what all your timeouts are set for on the ASA:

(config)# show running-config | include timeout

Default for TCP connections (web traffic) for timeout is 1 hour. As long as you dont have an application that needs or expects idle connections (for example an application to SQL database), it probably wouldn't have much impact at all on the firewall, depending on how many TCP connections, of course though it would free up resources. If you did have an application as mentioned that needed a timeout you could create a policy map for it that will only enforce the idle time for that only, nothing else.

Make sure that your policy map global policy already isnt inspecting necessary traffic and causing unnecessary strain on the firewall.
0

Featured Post

Building an interactive eFuture classroom

Watch and learn how ATEN provided a total control system solution including seamless switching matrix switch, HDBaseT extenders, PDU, lighting control to build an interactive eFuture classroom.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Network ports are the threads that hold network communication together. They are an essential part of networking that can be easily ignore or misunderstood, my goals is to show those who don't have a strong network foundation how network ports opera…
Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question