topic Palo Alto deny All policy reason non-syn-tcp in General Topics

Palo Alto deny All policy reason non-syn-tcp

soporteseguridad — Sun, 18 Dec 2016 17:46:14 GMT

Hi,

We realised our PA in version 7.0.6 is having any issue with the traffic. We see many traffic being dropped by DENY all rule (the last rule in the rule set). Looking in application we see "non-syn-tcp" in all the connections.

These denies connections always ocurrs each 30 minutes. For example: 4.01pm, 4.31pm, 5.01pm, 5.31pm.

we have disabled tcp syn reject in global, but its configured in zones too. why is happening this???? its quite weird each 30 minutes we see these denies.

Re: Palo Alto deny All policy reason non-syn-tcp

reaper — Sun, 18 Dec 2016 21:24:33 GMT

A non-syn-tcp drop occurs when a packet is received that is not a syn and also does not match an existing session (since a syn would start a new session)

This is most commonly caused my asymmetric traffic where client-server packets follow a different route than the server-client packets

So you will want to find the reason for these flows and try to fix them as this is not a firewall issue
There may be a need for U-turn NAT https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Configure-U-Turn-NAT/ta-p/65081