【Typical Case】How to Troubleshoot Client Software Restarts Due to TCP Session Timeout

Fault Description

A customer uses Ruijie RG-WALL Z-S series firewalls to establish IPSec tunnels between the headquarters and branches. At the branch office, a client software named Omega is installed to access database services located at the headquarters. The customer reports intermittent issues with this client software：
1. If the customer continuously uses the software, it works without any issues.
2. If the customer opens the software but does not use it, or if the customer leaves their work station and returns later, they encounter an error when they try to use the software again. This error is fixed by closing and reopening the software.
3. The customer did not experience this problem with a previous third-party gateway.
Cause Analysis

Ask the customer to provide an internal PC and use Wireshark to capture network packets from the client software. You will find that traffic is generated only when the software is actively opened. If the software is not used, no additional traffic will be observed.

2. Considering the TCP session timeout mechanism of the firewall, the default timeout period for a TCP session is 1,800 seconds (30 minutes). If there is no traffic within this 30-minute period, the firewall will delete the session.

3. After the firewall deletes the session, any new traffic generated by the customer’s software will be blocked by the firewall.
4. Firewalls are more stringent than gateways invalidating packets. For TCP packets, the firewall establishes a new sessiononly if the first packet is a TCP SYN packet. Otherwise, it discards the packet as an attack or invalid packet without logging it.
Solution
Create a security policy for long-lived connections on the server that provides the service. Pay attention to the following points:
1. Enabling the Long-Lived Connection function will slow down connection releaseand occupy more session resources on the device. Therefore, you are advised toenable this function only for specific services.
2. When enabling this function, you must specify the destination address and service (for the designated port), instead of using an application to specify the port.
3. You need to assign the highest priority to this security policy, placing it above allother policies to prevent it from being hit by other policies.

Configuration Procedure
1. Create a security policy, specify the destination IP address and service (obtain the destination IP address and port number of the service from the customer in advance), and assign the highest priority to this security policy.

Click Advanced Option, enable Long-Lived Connection and set the timeout period.


Troubleshooting Suggestions

1. In this scenario, which involves both headquarters and branch offices and utilizes features such as IPSec and link detection, the customer initially reported that only the branch services were unavailable.This information initially led us to believe that the issue was related to IPSecor link quality, complicating the troubleshooting process. Therefore, you are advised to first check with the customer whether the issue affects all services or just specific services.
2. After confirming that only a specific service is affected, ask the customer for the IP addressand port number of that service. Then, check the device’s session status and verify if the session was deleted due to a timeout.


3. In the future, confirm with the customer if the issue is related to a database service. If so, the problem may be similar to this case.