topic Re: Session timer getting reset for new syn packet in General Topics

Session timer getting reset for new syn packet

livewire — Wed, 30 Jun 2021 05:25:56 GMT

Hi,

I got the following scenario.

client -> Paloalto -> Server:1234

The client initiates a tcp session to server always using the same source port and same sequence number (verified in packet capture). The session time out is the default 60 minutes.

The client sometimes looses network coverage and initiates a new sync (with same source port and sequence number). But on the firewall the previous session exists and this syn packet is causing the session timer to reset. So the session is never timing out and the capture on firewall is showing that it is dropping all the new syn packets.

We ended up having to clear the sessions manually on firewall for the client to be able to connect.

We did open ticket with support and were told that client is not following RFC (they need to stop using same source port and sequence number). But as usual the client is saying that this application is working at other sites and it is firewall issue.

Looking for some pointers on this.

Re: Session timer getting reset for new syn packet

NikolayDimitrov — Wed, 30 Jun 2021 10:06:43 GMT

As the Palo Alto Tac did not help you may need to open a request for enhancement with you local palo alto contact.

Still you can on your own check what is the exact error with global counters or flow basic as described in:

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-palo-alto-checking-for-drops-rejects-discards/m-p/402102#M91777

You then can check if there is option to stop the palo alto protection that drops your tcp sync packets:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/device/device-setup-session/tcp-settings.html

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/network/network-network-profiles/network-network-profiles-zone-protection/packet-based-attack-protection/tcp-drop.html

Also a small workaround is to set a smaller TCP timeout :

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/app-id-features/service-based-session-timeouts.html

Re: Session timer getting reset for new syn packet

NikolayDimitrov — Wed, 30 Jun 2021 13:34:42 GMT

Edit:

You may also check if the zone protection porofile is not blocking your second sync packet:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClReCAK

Re: Session timer getting reset for new syn packet

juan9584 — Fri, 02 Jul 2021 09:43:44 GMT

To prevent SYN flood attacks, and to preserve mygiftcardsite memory, the BIG-IP system can prevent new connections by sending a TCP RST packet to the client with a TCP RST packet when the connection reaches the idle session timeout. The BIG-IP LTM system resets TCP connections after sending eight.

Re: Session timer getting reset for new syn packet

livewire — Thu, 01 Jul 2021 10:24:51 GMT

This setting is not enabled

Re: Session timer getting reset for new syn packet

NikolayDimitrov — Thu, 01 Jul 2021 10:32:10 GMT

See the other things I mentioned.

Re: Session timer getting reset for new syn packet

livewire — Thu, 01 Jul 2021 10:42:30 GMT

We will try for enchancement request. Also we are testing by lowering time out