Router/Switch firewall tcp session port timeout policy causes connection failures in UNIFI & waters_connect - WKB47653
Article number: 47653
SYMPTOMS
- Problems logging in to clients first thing in the morning
- LND requires a reboot after period of inactivity to restore comms especially first thing in morning or after the weekend.
ENVIRONMENT
- UNIFI network 1.9.4 and older
- UNIFI / waters_connect networks
- Cisco
- Center Point
- Palo Alto
CAUSE
Cisco first introduced a firewall policy where unused ports are closed after a default time of 1 hour. After this time, UNIFI services must reopen these ports by a reboot of the LND or client.
Also, similar policy exists for Check Point Firewall software - folowing link has details of default 1 hour time and how to increase.
https://supportcenter.checkpoint.com...ionid=sk145452
And same for Palo Alto
- An enhancement was raised internally - CRI-96 - Fixed in 4.6.0
FIX or WORKAROUND
- Upgrade to waters_connect 4.6.0 where "tcp keep alives" has been introduced.
This is a regular heart beat signal which is sent to keep all the connections that waters_connect and core apps use to connect to the server.This will primarily resolve issues with switches or routers that have a port timeout policy. Cisco, Palo Alto etc
For other older releases
- The customer IT should increase the timeout or disable the policy. Most customers set to 12 or 72 hours. (if set 12 hours LNDs will need rebooting every Monday morning)
- An enhancement has been raised internally to see if UNIFI can provide a "heartbeat" to keep these connections alive. CRI-96
- CR ID: US1#218171
ADDITIONAL INFORMATION
- Fix is planned for a future version of waters_connect platform