Firewall Seems to Be resetting SSH Connections

[pmutambudzi]

HI,

I have a problem with my Palo Alto firewall deployment were the firewall seems to be resetting all connections using port TCP 22 (SSH, SCP, SFTP). I have done packet captures on the ingress interface of the firewall and it shows as if the connection is being reset on the server side. However, packet captures on the egress interface show as if the connection is reset on the client side.

Has anyone experienced this before, and can anyone help.

The set i have is roughly as shown below:

Client <--------> Palo Alto Firewall <---------> Server

[panos]

what is your panos version ?

Does This issue happen to only one client - server connection or every client-server connection ?

you may try to write an applicetion override for that traffic, defining a new app and make tcp session time-out more than default to see if problem occurs or not.

[pmutambudzi]

Hi,

We are using version 4.1.8. SSH connections to internal private addresses are working fine. I see the problem when i try to SSH to any device with a public IP that is beyond this one particular firewall. Even sftp (port 22) to addresses on the Internet fails.

I have defined a custom app but the problem persists.

Partson.

[gil_arevalo]

This behavior is exactly what happens when something is denied by a rule...are you ABSOLUTELY sure that you have a rule that permits this? Are you seeing anything in the traffic logs? Also, 4.1.8 had some bugs that affected us...if you want to stay in the 4.1 8 block, I recommend 4.1.8HF3 , especially if you're running an HA pair.

[pmutambudzi]

Hi Gil,

I am currently running version 4.1.8 h3 and i have a rule that is explicitly allowing the traffic to go through. The traffic log shows the traffic is being allowed through.

[goku123]

Just curious, do you have any threat profiles assigned to the rule allowing this traffic? If yes, is there any threat log being generated for this traffic?

[pmutambudzi]

I actually do not have any threat prevention licence on this particular firewall.