RST First packet isn't a SYN flows (RST Both) + Deny action for NFS (?)

CarloTaddei — Sun, 11 Oct 2020 06:35:37 GMT

Hi Experts,

I'm right now dealing with a situation where occasionally I need to reset NFS sessions within an HA A/A PA 5220 cluster (see also https://live.paloaltonetworks.com/t5/general-topics/pan-os-session-table-clearing-gt-no-rst-fin-connection-sent-out/td-p/355556).

More generally, how can I configure the Palo Alto Firewall to RST (instead of dropping, as I figured out based on several packet capture analysis) PSH.ACK TCP segments for TCP sessions for given applications (like NFS - where apparently there's no configured / configurable deny action at application level - see next point) flowing across the firewall and "belonging" to former TCP sessions which are no longer existing within the Firewall Session Table (due to the fact that, for example, and admin manually cleared those sessions) ?

Do I need to perform this at Policy level ? Can this be configured at Platform wide level ?

And another question:

I recently read this post:

https://live.paloaltonetworks.com/t5/blogs/what-a-difference-a-deny-makes/ba-p/188811

which provided me with useful insights as to how the Palo Alto Firewall resets / drops application traffic - however for the NFS application case that I'm focusing on right now I do not see the possibility to configure any "deny action":

I've also checked the "depends on" and "implicitly uses" applications (portmapper and rpc for the nfs case) - none of them offers the possiblity to configure a "deny action".

Thanks for the clarification

Re: RST First packet isn't a SYN flows (RST Both) + Deny action for NFS (?)

reaper — Mon, 12 Oct 2020 09:07:13 GMT

the deny action is not configured in the application, but is set in the policy. some applications have a deny action which is the default action the firewall will take if you set the security policy to 'deny' instead of drop

if you want more control over the deny action, you need to set hte security rule to reset client/server/both, and/or enable 'send ICMP unreachable'

these actions, however, will only apply to 'new' sessions if they get discarded by security policy. any sessions that are interrupted halfway through by an admin clearing the session will see followup packets discarded as 'illegal' packets (non-syn tcp etc) which is part of TCP protection and no longer security policy decissions. these types of packets are discarded (instead of RST) to prevent reconnaissance/DDoS/packet based attacks

topic Re: RST First packet isn't a SYN flows (RST Both) + Deny action for NFS (?) in General Topics

RST First packet isn't a SYN flows (RST Both) + Deny action for NFS (?)

Re: RST First packet isn't a SYN flows (RST Both) + Deny action for NFS (?)