+ Reply to Thread
Results 1 to 2 of 2
  1. Senior Member
    Join Date
    Sep 2007
    Location
    Upstate NY
    Posts
    110

    Certifications
    A+, Network+, MCSA 2k3, CCNA, CCNP
    #1

    Default sysopt connection timewait

    Hello,
    Came across this command in an ASA config today and was curious why one may turn it on? It is on in one environment that is having difficulty with a server having a lot of time_wait sessions shown in a netstat output and was curious if this may have an impact. It's an ASA 8.0.4.



    Thanks,
    Jared
    Reply With Quote Quote  

  2. Senior Member Vask3n's Avatar
    Join Date
    Oct 2005
    Posts
    499

    Certifications
    ASA Specialist, CCNA Security, CCNA R/S , CCENT, JNCIA, A+, Security+, CST
    #2
    Had to look this up too even though the sysopt keyword sounds familiar.

    Apparently this is an older feature and this command changes the default behavior of terminating TCP sessions so that both the source and destination need to terminate the TCP connection at the same time, instead of sending Fin/Ack exchanges in the way it's normally done

    It's documented here
    Advanced Features of the PIX Firewall



    Edit: Ah yes, now I remember sysopt from the FIREWALL days: sysopt connection permit-vpn to allow VPN users to bypass ACLs

    http://www.cisco.com/c/en/us/td/docs...html#wp1517364
    Last edited by Vask3n; 08-11-2014 at 10:32 PM.
    Reply With Quote Quote  

+ Reply to Thread

Social Networking & Bookmarks