topic Re: Ignoring control flags in General Topics

Ignoring control flags

SDorsey — Thu, 19 Dec 2013 14:38:46 GMT

Is it possible to ignore tcp control flags in the Palo Alto?

I have a client where several nodes talk back to a server through the PAN. The nodes will send a FIN packet so the PAN will drop the session.. however, the vendor requires the session to stay up. In the ASA world, there is an option to -ignore control flags-.

Re: Ignoring control flags

kadak — Thu, 19 Dec 2013 18:25:55 GMT

Hello mackwage,

As soon as the firewall sees one TCP packet with the FIN flag set, it will close the connection as soon as the number of seconds defined in timeout-tcpwait value expires. By default the timeout-tcpwait is set to 30 seconds.

Increase the timeout-tcpwait value. This can be done using the following command. Maximum value is 60 seconds.

In the configuration mode
#set deviceconfig setting session timeout-tcpwait <1-60>

#commit force

The above change can be cross checked with the following command. I changed the timeout-tcpwait value to 100 seconds

admin@94-PA-VM-300> show session info | match timeout

Session timeout

TCP default timeout: 3600 secs

TCP session timeout before SYN-ACK received: 5 secs

TCP session timeout before 3-way handshaking: 10 secs

TCP session timeout after FIN/RST: 100 secs <------------------

UDP default timeout: 30 secs

ICMP default timeout: 6 secs

other IP default timeout: 30 secs

Captive Portal session timeout: 30 secs

Session timeout in discard state:

admin@94-PA-VM-300>

The timeout value is a global setting and will affecting entire traffic.

Hope that helps!

Thanks and regards,

Kunal Adak

Re: Ignoring control flags

SDorsey — Fri, 20 Dec 2013 02:19:55 GMT

kadak

Thanks for the info but I am confused on one part..

Increase the timeout-tcpwait value. This can be done using the following command. Maximum value is 60 seconds.

In the configuration mode
#set deviceconfig setting session timeout-tcpwait <1-60>

#commit force

The above change can be cross checked with the following command. I changed the timeout-tcpwait value to 100 seconds

You said the max value is 60 seconds then set it to 100 seconds.. how does that work?

Re: Ignoring control flags

kadak — Fri, 20 Dec 2013 17:51:37 GMT

Hello mackwage,

Pardon me, that command was taken from an older PANOS version.

In 5.0.9, the maximum limit you can set is 600 seconds.

admin@94-PA-VM-300> set session timeout-tcpwait

<value> <1-600> set session tcp wait timeout value in seconds

Hope that helps!

Thanks and regards,

Kunal Adak