topic PA sends a reset(RST) when TCP session is timeout? in General Topics

PA sends a reset(RST) when TCP session is timeout?

Sho9240 — Fri, 02 Sep 2016 09:55:39 GMT

Could you tell me when TCP session is timeout, does PA firewall send a TCP reset(RST) packet to endpoint server/client or just close and delete the session from own session table without sending any packets ?

Re: PA sends a reset(RST) when TCP session is timeout?

reaper — Fri, 02 Sep 2016 12:32:21 GMT

if a tcp session times out (no packets received in X time) the session will simply close and no rst or fin is sent from the firewall

Re: PA sends a reset(RST) when TCP session is timeout?

Sho9240 — Sat, 03 Sep 2016 02:13:55 GMT

Hi Reaper,

Thanks. One more question.
Can I change PA's setting to send RST when the session is timed out.

Re: PA sends a reset(RST) when TCP session is timeout?

reaper — Mon, 05 Sep 2016 07:48:26 GMT

Hi @Sho9240

no, a RST can only be sent as a response to something. You'd either need to have a deny rule with the action set to reset, or a custom threat signature with action reset