PA-VM in AWS with Decryption Rule - server side connection kept open

karthik.subramaniam — Tue, 29 Oct 2024 20:53:12 GMT

Hello, running 11.1.2-h3 on AWS with decryption rule. The setup is: Windows Client --> FW --> Web-Proxy --> Internet

Firewall decrypts the traffic (so firewall itself acts like proxy). After the client side connection is closed with TCP-FIN, the firewall keeps server side connection to Web-Proxy and both firewall and Web-Proxy exchanges millions of TCP ACK. They never close the connection. This is causing huge packets in the network and causes CPU spike on the firewall and Web-Proxy.

show session id 3098735 | match count
total byte count(c2s) : 96946
total byte count(s2c) : 603114645473
layer7 packet count(c2s) : 1592
layer7 packet count(s2c) : 2578574997

===================================
show session id 3098735 | match count
total byte count(c2s) : 96946
total byte count(s2c) : 603125152686
layer7 packet count(c2s) : 1592
layer7 packet count(s2c) : 2578769575

=================================
show session id 3098735 | match count
total byte count(c2s) : 96946
total byte count(s2c) : 603146147833
layer7 packet count(c2s) : 1592
layer7 packet count(s2c) : 2579158374

The session info doesn't reflect that there are packets leaving from the firewall to web-proxy. But packet capture does show.

topic PA-VM in AWS with Decryption Rule - server side connection kept open in VM-Series in the Public Cloud

PA-VM in AWS with Decryption Rule - server side connection kept open