The TCP Connection Timeout is a SonicWall firewall setting that often receives little attention during normal operation. However, timeout values that are unnecessarily high or no longer required can have unexpected effects on firewall operation.
A firewall must retain information about every active TCP connection in its connection table. The TCP Connection Timeout determines how long an inactive TCP connection is retained before the firewall removes it from the table.
A SonicWall firewall has a global TCP Connection Timeout. In addition, an individual timeout can be configured for specific firewall rules.
Such an adjustment can be useful. Certain applications or long-lived connections may require a higher timeout. However, problems can arise when timeout values are set unnecessarily high or when a temporary change made for troubleshooting is not reset afterward.
The longer inactive connections remain in the connection table, the longer the firewall must continue to manage these sessions. Particularly on heavily utilized systems, unnecessarily high timeout values can therefore increase the number of connections that must be managed simultaneously.
Changes to the global TCP Connection Timeout require particular attention because they affect more than just a single firewall rule.
A real-world example illustrates the potential consequences: At one customer with a SonicWall High Availability cluster, an HA failover took considerably longer than expected. Analysis revealed that the global TCP Connection Timeout had been increased previously, causing a large number of connections to be retained for longer.
A change originally made for one purpose subsequently affected a completely different area of firewall operation.
Firewall configurations that have evolved over many years often contain settings whose original purpose is no longer known.
A typical troubleshooting example is:
A timeout value is increased to investigate or resolve a particular connection problem. The problem is subsequently resolved and the application works again, but the modified setting remains in place.
Months or years later, it may no longer be possible to determine why the value was originally changed.
It is therefore advisable to review both the global TCP Connection Timeout and the individual timeout settings configured for specific firewall rules on a regular basis.
Firewall Toolbox analyzes the globally configured TCP Connection Timeout as well as the settings of individual firewall rules.
Rules with an individual TCP timeout are automatically identified and presented clearly in a report. This makes it easy to determine:
This allows unusual settings, or settings that may no longer be required, to be reviewed efficiently.
Firewall Toolbox is not limited to analysis.
When an API connection to the SonicWall firewall is available, the identified rules can be modified directly from within Firewall Toolbox.
You can select precisely which rules should be changed. Individual, multiple or all identified TCP timeout settings can be selected and reset to the default value through the SonicWall API.
In this way, Firewall Toolbox combines three tasks for TCP timeout management:
Identify – Document – Correct
This makes it easier to review older firewall configurations that have evolved over time and to remove individual TCP timeout settings that are no longer required.
