diff options
| author | Viacheslav Hletenko <v.gletenko@vyos.io> | 2026-04-15 13:55:52 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-04-15 13:55:52 +0300 |
| commit | c21b38dbe24088eaca73dbc8030cfebc898d2186 (patch) | |
| tree | a390c8fddb08a163feef6710818c10ffdc553733 | |
| parent | f524160b3b390cda0ad4d36062eeaa68d7817c8b (diff) | |
| parent | 5de06cb64f289377373de050c82e04efb45c5738 (diff) | |
| download | vyos-documentation-c21b38dbe24088eaca73dbc8030cfebc898d2186.tar.gz vyos-documentation-c21b38dbe24088eaca73dbc8030cfebc898d2186.zip | |
Merge pull request #1840 from vyos/mergify/bp/sagitta/pr-1819
T8189: Add conntrackd FTFW PurgeTimeout setting (backport #1819)
| -rw-r--r-- | docs/configuration/service/conntrack-sync.rst | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/docs/configuration/service/conntrack-sync.rst b/docs/configuration/service/conntrack-sync.rst index db23c92f..de86450e 100644 --- a/docs/configuration/service/conntrack-sync.rst +++ b/docs/configuration/service/conntrack-sync.rst @@ -98,6 +98,20 @@ Configuration This diable the external cache and directly injects the flow-states into the in-kernel Connection Tracking System of the backup firewall. +.. cfgcmd:: set service conntrack-sync purge-timeout <timeout> + + Timeout (in seconds) for purging synchronized entries on handover events. + + On handover, ``conntrackd -t`` is invoked, which schedules a conntrack table + flush after ``<timeout>`` seconds to purge stale (“zombie”) entries and + reduce clashes when multiple handovers occur in a short period. + The default is 60 seconds. + +.. note:: In VRRP stateful firewall deployments, align VRRP timing with this + behavior: because synchronized conntrack state is purged after the purge + timeout, set **VRRP preempt-delay** to ≥ **purge-timeout** so mastership + can be restored before conntrack state is purged. + .. cfgcmd:: set service conntrack-sync disable-syslog Disable connection logging via Syslog. |