topic Re: Palo alto fitrewall that it does not take decision upon first packet while other firewalls take.. in General Topics

Palo alto fitrewall that it does not take decision upon first packet while other firewalls take..

vsingh — Mon, 23 Feb 2015 12:07:10 GMT

I came to know one thing about palo alto fitrewall that it does not take decision upon first packet, it takes decision after three way handshake.

While other firewalls take decision after first packet. What does it mean and how it is benefiical in terms of Palo alto firewalls?

Re: Palo alto fitrewall that it does not take decision upon first packet while other firewalls take..

santonic — Mon, 23 Feb 2015 12:32:11 GMT

Depends how you configure rules.

Let's say you want to allow web browsing.

Option A: rule allows web-browsing on any port.

PA has to allow enough traffic on any destination port to make sure if the session is web-browsing before it can make a decision. So for TCP you can do 3-way handshake on any destination port and traffic will go through until PA notices it's not web-browsing session.

Option B: rule allows web-browsing only on application-default ports.

PA has to allow enough traffic on destination port 80 to make sure if the session is web-browsing before it can make a decision. Traffic on any other destination port will be dropped before it finishes 3 way handshake (already SYN packet will be dropped).

Re: Palo alto fitrewall that it does not take decision upon first packet while other firewalls take..

MarcoLeckel — Wed, 25 Feb 2015 10:52:10 GMT

Or Option C (like any other Firewall): Allow any Application on Port 80

PAN make the decision at the first TCP SYN Packet when Traffic comes on Port 80 and allow any Traffic on Port 80

😉

..... yes i'm kidding sorry

Re: Palo alto fitrewall that it does not take decision upon first packet while other firewalls take..

BrianMangan — Wed, 25 Feb 2015 13:05:12 GMT

It makes it more of an art form than a science reading the logs, because now you have to weed out the entries that say the traffic was allowed, but the application is incomplete. Since the firewall has to allow the traffic through until it can identify the application you get these somewhat confusing entries in the logs.

The users tend to blame the firewall for things not working and you can't really tell them "the firewall allowed it" since that's not the definitive entry, for it may or may not have blocked it further along in the conversation.