Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Juniper Netscreen SSG-140.

While experimenting with a VoIP service, I defined a custom policy that was to be used to permit the possible ports in use to be sent back to the VoIP server from systems connecting across the internet. Because I'd had problems in the past with VoIP systems getting broken when their UDP sessions were expired out faster than their keep-alives were generated, I set the timeout on this custom service to be 'never'.

After much experimentation, I happened to notice that my session count on the firewall has grown from a couple thousand to over 36000.

After discussion with the VoIP "expert", I set the timeout to be 30 minutes; however, all the sessions set up during the experimentation process are still there, more than 3 days later.

Is there a way I can force these old sessions to get expired and removed from the session table, or am I looking at resetting my firewall?

(Both firewalls, actually -- they are in a cluster.)

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

You can use the clear session command. The trick is which sessions to clear. The easy way out is clear session all, but that's almost as bad as resetting the entire firewall (except users will be able to reestablish their connections immediately rather than waiting for the firewall to come back up).

Look at the options to the clear session command. Depending on your situation, you can probably narrow down the sessions to clear based on src-ip, dst-port, etc.

You can use get session to see all of the sessions. Since it's a very large list, you can do get session > tftp x.x.x.x filename to TFTP a copy of the session table somewhere that you can sort through offline.

share|improve this answer
    
Actually a power incident solved the problem for me, but I was halfway down this road when it happened. Thanks! –  David Mackintosh Mar 18 '11 at 1:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.