topic Re: Firewall Seems to Be resetting SSH Connections in General Topics

Firewall Seems to Be resetting SSH Connections

pmutambudzi — Fri, 24 May 2013 20:39:26 GMT

HI,

I have a problem with my Palo Alto firewall deployment were the firewall seems to be resetting all connections using port TCP 22 (SSH, SCP, SFTP). I have done packet captures on the ingress interface of the firewall and it shows as if the connection is being reset on the server side. However, packet captures on the egress interface show as if the connection is reset on the client side.

Has anyone experienced this before, and can anyone help.

The set i have is roughly as shown below:

Client <--------> Palo Alto Firewall <---------> Server

Re: Firewall Seems to Be resetting SSH Connections

Retired Member — Sun, 26 May 2013 08:56:13 GMT

what is your panos version ?

Does This issue happen to only one client - server connection or every client-server connection ?

you may try to write an applicetion override for that traffic, defining a new app and make tcp session time-out more than default to see if problem occurs or not.

Re: Firewall Seems to Be resetting SSH Connections

pmutambudzi — Sun, 26 May 2013 17:43:34 GMT

Hi,

We are using version 4.1.8. SSH connections to internal private addresses are working fine. I see the problem when i try to SSH to any device with a public IP that is beyond this one particular firewall. Even sftp (port 22) to addresses on the Internet fails.

I have defined a custom app but the problem persists.

Partson.

Re: Firewall Seems to Be resetting SSH Connections

gil_arevalo — Tue, 04 Jun 2013 17:55:25 GMT

This behavior is exactly what happens when something is denied by a rule...are you ABSOLUTELY sure that you have a rule that permits this? Are you seeing anything in the traffic logs? Also, 4.1.8 had some bugs that affected us...if you want to stay in the 4.1 8 block, I recommend 4.1.8HF3 , especially if you're running an HA pair.

Re: Firewall Seems to Be resetting SSH Connections

pmutambudzi — Thu, 13 Jun 2013 13:09:15 GMT

Hi Gil,

I am currently running version 4.1.8 h3 and i have a rule that is explicitly allowing the traffic to go through. The traffic log shows the traffic is being allowed through.

Re: Firewall Seems to Be resetting SSH Connections

goku123 — Thu, 13 Jun 2013 13:26:37 GMT

Just curious, do you have any threat profiles assigned to the rule allowing this traffic? If yes, is there any threat log being generated for this traffic?

Re: Firewall Seems to Be resetting SSH Connections

pmutambudzi — Thu, 13 Jun 2013 13:35:54 GMT

I actually do not have any threat prevention licence on this particular firewall.