What is the default timeout value for TCP sessions on an SRX Series device?

On Juniper SRX Series devices, the default inactivity timeout for TCP sessions is 1800 seconds, which is equivalent to 30 minutes. If a TCP session has no traffic for this duration, the SRX device will remove the session from its session table to free up resources. This default value is applied unless a more specific timeout is configured for a particular application within a security policy.

A. 30 seconds: This is an incorrect value; the default is significantly longer to prevent premature termination of legitimate, idle TCP connections.

B. 60 minutes: This is incorrect. While configurable, the default value is 30 minutes (1800 seconds), not 60 minutes (3600 seconds).

C. 60 seconds: This is the default timeout value for UDP sessions, not TCP sessions, on an SRX Series device.

1. Juniper Networks TechLibrary

Security Configuration Guide: "Understanding Session Timeouts". This document explicitly states

"For TCP sessions

the default timeout is 1800 seconds (30 minutes). For UDP sessions

the default timeout is 60 seconds."

URL: https://www.juniper.net/documentation/us/en/software/junos/security-policies/topics/concept/session-security-understanding.html

2. Juniper Networks TechLibrary

CLI Explorer: The session statement under the [edit security flow] hierarchy confirms the default inactivity timeout. The documentation for tcp-session notes the default is 1800 seconds.

URL: https://www.juniper.net/documentation/us/en/software/junos/security-policies/topics/ref/statement/security-flow-edit.html (See the tcp-session statement details).