Check TCP sequense number

[JeffJin]

Hi

I am not sure if PA box could default check TCP sequense number ... have CLI cmd to tigger this checking

Jeff Jin

[gswcowboy]

Not sure if this is what you're looking for but here are some tcp settings options. This is through the configure mode to make it persistent.

#set deviceconfig setting tcp

bypass-exceed-oo-queue   whether to skip inspection of session if out-of-order packets limit is exceeded

drop-out-of-wnd          drop/allow out of window packets, also control enable/disable TCP sequence number check for FIN/RST

favor-new-seg            whether to favor new segments when overlapping happens

out-of-sync              actions for out of sync tcp sessions (ACK is out of sync with TCP sliding window tracking)

urgent-data              clear urgent flag in TCP header

-Renato

[mrajdev · Accepted solution]

Jeff,

TCP sequence number checking is enabled by default.You can turn it off if you wish using the command above.

Thanks

[igor_mamuzic]

I cannot find command for drop-out-of-wnd parametar in PAN-OS 4.1 and 5.0

Is this command changed?

[gwesson]

Yes, it has. The new command is:

# set deviceconfig setting tcp asymmetric-path bypass

You'll need to follow that with a commit for it to take effect.

-Greg