topic Re: session table in General Topics

session table

Retired Member — Fri, 12 Jul 2013 11:21:55 GMT

Hi,

is it possible to use a PAloalto firewall not to keep sessions and works like a non stateful Access Control device.

Thanks.

Re: session table

kprakash — Fri, 12 Jul 2013 13:33:57 GMT

We dont have the feature to turn of stateful inspection, and all traffic would always be subjected to stateful inspection.

BR,

Karthik RP

Re: session table

rmonvon — Fri, 12 Jul 2013 14:56:06 GMT

Although we cannot disable stateful inspection, we can instruct the PA to ignore state via disabling 'Reject Non-SYN TCP'. The PA can ignore session state per zone via configuration under Network tab ==> Zone Protection ==> Packet Based Attack Protection ==> TCP/IP Drop, and setting 'Reject Non-SYN TCP' to no.

To ignore session state globally for the entire PA, You can use the CLI and issue the commands as described here:

Thanks.

Re: session table

kprakash — Fri, 12 Jul 2013 15:55:52 GMT

Hi rmonvon,

This would work only for TCP sessions. The UDP and protocols without port numbers ( ICMP, OSPF, PIM, ESP,etc) however will still have sessions established for it.

BR,

Karthik RP

Re: session table

Retired Member — Fri, 12 Jul 2013 16:00:37 GMT

I was wondering what to do when session limit is reached.That is why asked that for.

Re: session table

rmonvon — Fri, 12 Jul 2013 16:05:22 GMT

When session limit is reached, the PA will not allow the excess sessions to pass through. Thanks.