topic Re: syn without window-scale option in General Topics

syn without window-scale option

Abdul_Razaq — Thu, 15 Nov 2018 14:20:43 GMT

Hi community,

i am trying to access a website from LAN side of palo alto, even though correct policy is configured, tcp handshake was not complete. after packet capture i am able to find below points

client sending syn packet
but i am not able to get syn-ack packet from server,
able to see one ack packets from server
server is using 3-way handshake only
server is sending syn-ack, but tcp window-scaling option is not available.

i have seen firewall will drop packet if window scaling information is not available in syn packet. can anybody tell whether i am hitting on same issue, if yes, how to solve it in palo alto

Re: syn without window-scale option

OtakarKlier — Thu, 15 Nov 2018 17:42:56 GMT

Hello,

Was the pcap performed from the PAN or from the client? I honestly suspect a routing issue since you are not getting any ack's.

Hope that helps.

Re: syn without window-scale option

Abdul_Razaq — Fri, 16 Nov 2018 05:58:26 GMT

Hi klier,

No routing issue is involved, i am able to acces other sites, only this particular site is is not accessible. when i bypass firewall, i was getting syn-ack packet in my PC. when i access through firewall, firewall is dropping that particular packet.

for other sites, bypassing firewall or accessing through doesn't make any difference.

Re: syn without window-scale option

Raido_Rattameister — Fri, 16 Nov 2018 19:18:26 GMT

Add filter.

Assuming that website IP is 1.1.1.1

Monitor > Packet Capture

Enable filter.

Go to cli and run command.

> show counter global filter delta yes packet-filter yes

Try to visit website and run command again.

> show counter global filter delta yes packet-filter yes

Do you see any where severity is drop?

Re: syn without window-scale option

Abdul_Razaq — Sat, 17 Nov 2018 07:15:42 GMT

Hi Radio,

Thanks for your input.

the counter was increasing in my case because of out-of-window packets. after putting 'set deviceconfig setting tcp asymmetric-path bypass' command, the website is accessible. it solved my issue. but it does look like an workaround only as the command is designed for assymetric routing. as of my understanding, in my case, definitly the issue is not assymetric but because of firewall doesnt have window information.

if i put this command, will i get any security risk as replay attack?