T8189: Add conntrackd FTFW PurgeTimeout setting (#1819)

1 files changed, 14 insertions, 0 deletions

diff --git a/docs/configuration/service/conntrack-sync.rst b/docs/configuration/service/conntrack-sync.rst
index 232db1a8..27bc977d 100644
--- a/docs/configuration/service/conntrack-sync.rst
+++ b/docs/configuration/service/conntrack-sync.rst
@@ -98,6 +98,20 @@ Configuration
    This diable the external cache and directly injects the flow-states into the
    in-kernel Connection Tracking System of the backup firewall.
 
+.. cfgcmd:: set service conntrack-sync purge-timeout <timeout>
+
+   Timeout (in seconds) for purging synchronized entries on handover events.
+
+   On handover, ``conntrackd -t`` is invoked, which schedules a conntrack table
+   flush after ``<timeout>`` seconds to purge stale (“zombie”) entries and
+   reduce clashes when multiple handovers occur in a short period.
+   The default is 60 seconds.
+
+.. note:: In VRRP stateful firewall deployments, align VRRP timing with this
+   behavior: because synchronized conntrack state is purged after the purge
+   timeout, set **VRRP preempt-delay** to ≥ **purge-timeout** so mastership
+   can be restored before conntrack state is purged.
+
 .. cfgcmd:: set service conntrack-sync disable-syslog
 
    Disable connection logging via Syslog.