+ Reply to Thread
Results 1 to 2 of 2
  1. Senior Member
    Join Date
    Sep 2007
    Upstate NY

    A+, Network+, MCSA 2k3, CCNA, CCNP

    Default sysopt connection timewait

    Came across this command in an ASA config today and was curious why one may turn it on? It is on in one environment that is having difficulty with a server having a lot of time_wait sessions shown in a netstat output and was curious if this may have an impact. It's an ASA 8.0.4.

    Reply With Quote Quote  

  2. Senior Member Vask3n's Avatar
    Join Date
    Oct 2005

    ASA Specialist, CCNA Security, CCNA R/S , CCENT, JNCIA, A+, Security+, CST
    Had to look this up too even though the sysopt keyword sounds familiar.

    Apparently this is an older feature and this command changes the default behavior of terminating TCP sessions so that both the source and destination need to terminate the TCP connection at the same time, instead of sending Fin/Ack exchanges in the way it's normally done

    It's documented here
    Advanced Features of the PIX Firewall

    Edit: Ah yes, now I remember sysopt from the FIREWALL days: sysopt connection permit-vpn to allow VPN users to bypass ACLs

    Last edited by Vask3n; 08-11-2014 at 10:32 PM.
    Reply With Quote Quote  

+ Reply to Thread

Social Networking & Bookmarks