topic Re: tcp_drop_out_of_wnd in General Topics

tcp_drop_out_of_wnd

franck.lichnowski — Tue, 24 Apr 2012 12:07:22 GMT

Hi,

on PanOS 4.0 I have to disable "tcp_drop_out_of_wnd" check with this command :

>configuration
>set deviceconfig setting tcp drop-out-of-wnd no
>commit

How to disable "tcp_drop_out_of_wnd" check on PanOS 4.1 (4.1.5) ??

Thanks,

Regards.

Re: tcp_drop_out_of_wnd

internal_it — Tue, 24 Apr 2012 12:25:36 GMT

set deviceconfig setting tcp asymmetric-path bypass

A question, are you disabling this because of RDP or SMB (nfs) performance problems? I havent read anything about others having that problem. But when i disabled tcp_drop_out_of_win this solved my issue. Just wondering if this is a bug with PANFW.

Re: tcp_drop_out_of_wnd

franck.lichnowski — Tue, 24 Apr 2012 12:32:38 GMT

Thanks for the reply.

No I disable tcp_drop_out_of_wnd because some http (only http, not in ftp) download break.

This is totally random, ticket is open on PaloAlto support since 1 month.

Maybe it's because (I think, Palo Alto don't give any solution or suggestion) I have a special network architecture :

Internet

Vsys 1

/ | \

Vsys2 Vsys3 Vsys4

I think intervsys routing don't like tcp_drop_out_of_wnd check.

Re: tcp_drop_out_of_wnd

chrisp — Tue, 24 Apr 2012 12:48:18 GMT

We had to use this same command to address some issues on our network with HTTP traffic as well. Still not a 100% clear on why, but it definitely made a difference. I was told the new command in 4.1 combines a couple tweaks that were separate commands in previous versions. I was told this turns off actions for TCP sliding window tracking errors as well as disables TCP sequence number check for FIN/RST. We also had problems with the tcp non-syn reject.

Re: tcp_drop_out_of_wnd

opiedrah — Thu, 03 May 2012 20:39:43 GMT

We had to run this command when having issues with rsh to systems that took longer then need be to respond.We also used it with bypass-exceed to prevent premature tcp timeout issues.

PAN>configure
PAN#set deviceconfig setting tcp drop-out-of-wnd no
PAN#set deviceconfig setting tcp bypass-exceed-oo-queue yes