[FW-1] Connection table question

Subject: [FW-1] Connection table question

From: "Wilson, David" <[email protected]>

Date: Mon, 22 Apr 2002 16:28:40 -0400

Reply-to: Mailing list for discussion of Firewall-1 <[email protected]>

Sender: Mailing list for discussion of Firewall-1 <[email protected]>

I have a situation that occurs where a valid connection gets dropped due to no traffic after session setup. The client sends the SYN to the server. The server replies with SYN-ACK. The client sends back ACK. At this point I would expect FW-1 to insert the session in the connection table and set the timeout to 3600. However what I see is that the connection is set to 60 seconds. It will only get set to 3600 if the server sends the client data before the 60 seconds are up (which is not usually the case). So it looks like FW-1 requires SYN, SYN-ACK, ACK, DATA rather than SYN, SYN-ACK, ACK as indicated in just about every document that I have read. Has anyone else seen this? This is a major problem for our application. Any suggestions would be greatly appreciated.

David Wilson

Télécommunications et Téléphonie

Montréal Exchange

ext 355