From 9f334f3d5547735fa8c83fd6b6e7bbafa589f11a Mon Sep 17 00:00:00 2001 From: "Nataliia S." <81954790+natali-rs1985@users.noreply.github.com> Date: Fri, 10 Apr 2026 14:41:50 +0300 Subject: T8189: Add conntrackd FTFW PurgeTimeout setting (#1819) --- docs/configuration/service/conntrack-sync.rst | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'docs') diff --git a/docs/configuration/service/conntrack-sync.rst b/docs/configuration/service/conntrack-sync.rst index 232db1a8..27bc977d 100644 --- a/docs/configuration/service/conntrack-sync.rst +++ b/docs/configuration/service/conntrack-sync.rst @@ -98,6 +98,20 @@ Configuration This diable the external cache and directly injects the flow-states into the in-kernel Connection Tracking System of the backup firewall. +.. cfgcmd:: set service conntrack-sync purge-timeout + + Timeout (in seconds) for purging synchronized entries on handover events. + + On handover, ``conntrackd -t`` is invoked, which schedules a conntrack table + flush after ```` seconds to purge stale (“zombie”) entries and + reduce clashes when multiple handovers occur in a short period. + The default is 60 seconds. + +.. note:: In VRRP stateful firewall deployments, align VRRP timing with this + behavior: because synchronized conntrack state is purged after the purge + timeout, set **VRRP preempt-delay** to ≥ **purge-timeout** so mastership + can be restored before conntrack state is purged. + .. cfgcmd:: set service conntrack-sync disable-syslog Disable connection logging via Syslog. -- cgit v1.2.3