FTP Flow Information Is Still Displayed After the FTP Session Is Stopped

After abruptly stopping an FTP session, the FTP flow information for that session remains displayed in the Security Intelligence visualization UI page.

Problem

If you start an FTP session and in the middle of the session you press Ctrl+C or Ctrl+Z, the FTP session is stopped. However, the information about that FTP flow remains displayed for a long time under the Active Flows tab in the Flow Details table for the group.

Cause

Because the TCP session was not properly stopped, the TCP idle timeout is still in effect. The timeout is set to 12 or 24 hours by default.

Solution

To ensure the FTP traffic flows information does not continue to be displayed under the Active Flow tab after the FTP session is abruptly stopped, set a session timer profile with a shorter timeout value. Set the profile to the appropriate groups. See "Create a Session Timer" topic in the NSX Administration Guide for more information.