About FIN/RST Packets

[Y.Kida]

Hi Experts,

I was unable to find detailed information in the manufacturer's documentation or knowledge base, so please advise.

・If a communication is permitted by the firewall's security policy, is it possible for the firewall to send FIN or RST packets to that communication (client or server)?
・Does the firewall ever send FIN or RST packets to clients or servers? If so, under what circumstances?

Thank you.

[PavelK · Accepted solution]

Hello @Y.Kida

thanks for posting!

Could you please refer to this KB: When Does Palo Alto Networks Firewall Send a TCP Reset (RST) to Terminate a Session?. There should be no scenario firewall sends RST except of response to threat.

Regarding FIN, it should come either from client or server, not from firewall itself.

Kind Regards

Pavel

[Y.Kida]

Hey, @PavelK

I've been digging around since then and managed to get some info on RST, but I was still stuck on FIN—so this really helped.

Thanks!