Security

Reply
Frequent Contributor I
Posts: 83
Registered: ‎09-08-2015

ClearPass PostgreSQL TCP timeout

We've recently moved a ClearPass cluster deployment behind firewalls at two different sites.

 

I've noticed in the firewall logs that a whole lot of PostgreSQL traffic is being dropped as out-of-state.

 

I'm assuming this is because ClearPass is trying to use a long standing TCP connection that is older than 1 hour.

 

Can anyone confirm the maximum connection lifetime that ClearPass would use - if there is one?

Frequent Contributor I
Posts: 83
Registered: ‎09-08-2015

Re: ClearPass PostgreSQL TCP timeout

Firewall logs show the connection is dropped almost exactly after 2 hours (7200 seconds).

 

Under Server Configuration -> ClearPass system services there is a 'TCP Keep Alive Configuration', which by default is set to 7200.

 

I take it this means it will only send the first keepalive after 2 hours, which is no good for modern firewalls with default TCP connection state timeouts of 60 minutes.

 

Needless to say we'll be changing this to 1800 seconds :)

Search Airheads
Showing results for 
Search instead for 
Did you mean: