topic Re: existing session behavior when routing table changes in General Topics

existing session behavior when routing table changes

alowther_chatham — Tue, 09 Feb 2016 19:02:15 GMT

Does anybody know if existing sessions can be updated when there is a routing table change, or if there is a way to clear sessions? I'm hoping for something analagous to the Session Rematch feature when policies change.

My problem is that I have an existing session that becomes hung when the routing table changes. The routing table updates when our primary link goes down so traffic will follow the backup link. New sessions work properly, but the existing sessions do not.

I believe part of my issue is that I have a particular session that is UDP, and always uses the same source and destination ports. This means any new traffic continues to match the existing session. Further compounding the problem is that this is SIP traffic, so the session timeout is 60 minutes.

Re: existing session behavior when routing table changes

pankaku — Tue, 09 Feb 2016 21:17:38 GMT

Some time issue happens with SIP traffic. Clearing session will help. We can use the folllowing command to clear the session

PA> clear session all filter source <ip> destination <ip>

Hope this helps!

Re: existing session behavior when routing table changes

vkalal — Tue, 09 Feb 2016 23:56:08 GMT

> Clearing session will clear out everything and the new session will use the other active gateway

> A feature called TCP midstream-connection-pickup would have helped your situation but I don't believe that on Paloalto we have that feature, Once I saw this feature on Cyberoam firewall (again a linux based OS)

> I think with root access this can be done, but again I am presuming

Re: existing session behavior when routing table changes

Raido_Rattameister — Wed, 10 Feb 2016 12:59:18 GMT

Have you verified that firewall stops passing traffic towards new route (take packet capture for example)?

Maybe application at destination does not map changed source IP to existing session.

You can't just suddenly change endpoint ip's without application level to be aware of that.

Re: existing session behavior when routing table changes

alowther_chatham — Wed, 10 Feb 2016 16:53:34 GMT

Thanks for the replies.

Clearing the session did fix the issue. I was hoping to find a way to make this automatic.

For confirmation, the PaloAlto at the other end of the backup link did not have a session for the traffic. This leads me to believe the traffic never reaches the destination after the route change. The source and destination IPs do not change.

From reviewing documentation, because the source IP, destination IP, source port, destination port, protocol, and ingress interface do not change the session stays in the Fastpath and forwarding lookup never reoccurs.

Re: existing session behavior when routing table changes

glastra1 — Wed, 17 Feb 2016 00:34:39 GMT

Have you configured the same zone on both outgoing interfaces? If not the firewall will drop the packets

The firewall session's table is based among other things on source and destination zones (not physical interfaces) if the destination zone changed the packets will be dropped (as it broke the ecisting session). There is a Global counter for it but I don't remember it at the top of my head (something lime pkt_flow_zone_change)

You can check the global counters and see if the packets are being dropped.

Before and after the issue,

> show counter global filter delta yes | match drop

Regards,

Gerardo.

Re: existing session behavior when routing table changes

Raul_Garcia — Tue, 03 Oct 2023 15:40:28 GMT

Hello,
Did you solve this? I have a similar behavior and I need to change the outgoing interface when route change because it is a UDP flow that use default route because is the first available before learn the BGP routes.

Thanks

Re: existing session behavior when routing table changes

kashifkhana — Wed, 18 Sep 2024 16:38:41 GMT

Hi, We fixed this in our environment by creating a black hole route with 50 weight. So as soon as bgp comes in the BGP routes take preference as it has 20 weight.

Thanks,

Re: existing session behavior when routing table changes

TusharS — Thu, 27 Feb 2025 09:42:22 GMT

After years of providing outputs and asking for a feature request, PaloAlto has finally given us an option to address this. Refer - UDP sessions stuck after failover - Knowledge Base - Palo Alto Networks