topic Re: Check TCP sequense number in General Topics

Check TCP sequense number

JeffJin — Fri, 14 Oct 2011 12:26:21 GMT

I am not sure if PA box could default check TCP sequense number ... have CLI cmd to tigger this checking

Jeff Jin

gswcowboy — Fri, 14 Oct 2011 13:54:45 GMT

Not sure if this is what you're looking for but here are some tcp settings options. This is through the configure mode to make it persistent.

#set deviceconfig setting tcp

bypass-exceed-oo-queue whether to skip inspection of session if out-of-order packets limit is exceeded

drop-out-of-wnd drop/allow out of window packets, also control enable/disable TCP sequence number check for FIN/RST

favor-new-seg whether to favor new segments when overlapping happens

out-of-sync actions for out of sync tcp sessions (ACK is out of sync with TCP sliding window tracking)

urgent-data clear urgent flag in TCP header

-Renato

mrajdev — Fri, 14 Oct 2011 15:08:27 GMT

Jeff,

TCP sequence number checking is enabled by default.You can turn it off if you wish using the command above.

Thanks

igor_mamuzic — Wed, 12 Dec 2012 15:19:03 GMT

I cannot find command for drop-out-of-wnd parametar in PAN-OS 4.1 and 5.0

Is this command changed?

gwesson — Wed, 12 Dec 2012 17:30:53 GMT

Yes, it has. The new command is:

# set deviceconfig setting tcp asymmetric-path bypass

You'll need to follow that with a commit for it to take effect.

-Greg