topic Re: Rudimentary TCP Session and Monitor Question in General Topics

Rudimentary TCP Session and Monitor Question

mrcs — Thu, 03 Dec 2015 15:27:54 GMT

I feel like I should already know this, but I just need a sanity check.

I have a rule that allows host A to B via tcp/900. So host A starts to communicate via host B via that port. The firewall allows it and a session is created. Now, assume A and B stop talking but don't formally close the session. After the default timer, the PAN closes that session. Now, A tries to communicate to B b/c it still thinks it has an active session. When that traffic hits the firewall, should it show up in the monitor log as a "deny"? Will it just silently drop the packet? Will it try to start a new session and I'd see a new "start" in the monitor?

Re: Rudimentary TCP Session and Monitor Question

Raido_Rattameister — Thu, 03 Dec 2015 15:48:31 GMT

B probably take this new session as new.

Firewall sees this as new if this has expired in firewa..

Source port is usually diferent for diferent sessions even if destination port is 900 in both cases.

Also new session starts with new SYN so B should take it as new.

Re: Rudimentary TCP Session and Monitor Question

BenjAudy.MTL — Thu, 03 Dec 2015 16:13:25 GMT

Hi,

The firewall will silently drop the packets, unless you entered the command "set session tcp-reject-non-syn no" in the CLI. Eventually, the OS of the client will notice that there are no ACKs and will close or reset the connection. Apparently, it can takes a couple minutes for that to happen. If it's a problem for you, you can change the timer for specific applications (or system-wide, but I wouldn't do that). You could also make sure the client application sends packets from time to time to keep the session alive.

Regards,

Benjamin

Re: Rudimentary TCP Session and Monitor Question

Raido_Rattameister — Thu, 03 Dec 2015 16:44:08 GMT

Right.

I missed the part that A still thinks that session is active.

In this case yes fw will drop those packets.

Re: Rudimentary TCP Session and Monitor Question

mrcs — Thu, 03 Dec 2015 17:59:08 GMT

Yep. This is it. It will not log it to the monitor but will acrrue counters against the global TCP counters.

Thanks all!