topic Re: Creation of new Session and 6 Tuples in General Topics

Creation of new Session and 6 Tuples

MP18 — Tue, 21 May 2019 16:56:07 GMT

Need to confirm below -

If PA has the active session and need create a same session but the old session is active?

What action will take depending on 6 tuples?

Re: Creation of new Session and 6 Tuples

reaper — Wed, 22 May 2019 12:04:36 GMT

a new session will start with a SYN packet, indicating this is a new session

once 2 (or more) identical sessions exist, packets will be identified by their tuples and sequence number

Re: Creation of new Session and 6 Tuples

MP18 — Wed, 22 May 2019 21:48:08 GMT

This sequence number is it visible in PA GUI or cli?

So far i do not see it in CLI.

Re: Creation of new Session and 6 Tuples

reaper — Thu, 23 May 2019 10:19:04 GMT

the sequence number is part of the TCP protocol, it increments with each packet or every window/frame. it is not visible anywhere as it continuously changes

there are more tcp parameters that are matched (like tcp session ID etc) but all these checks are happening at a very low level, invisble to the administrator

the admin's view is limited to the tuples and the PAN-OS session ID

I'm assuming you're troubleshooting 2 simultaneous sessions? if you enable packetcaptures on the source and destination, on the firewall and then also enable flow basic, you will be able to see the exact sessions as flow basic will collect all this info so you can match it to the packetcaptures

Re: Creation of new Session and 6 Tuples

MP18 — Thu, 23 May 2019 15:30:04 GMT

Many Thanks Reaper