PA blocking returned traffic!!!

[Besfort]

Hi,

I've deployed PA-500 recently, and I'm experiencing an interesting situation.

PA-500 is deployed in virtual-wire, and I'm filtering only my main ISP connection (ISP 1). The connection for ISP 2 goes directly to the router.

We have a web server, which accepts requests from users through ISP2, and replies back but the router sends the replies through ISP1 (as it is the default connection). This returned traffic is block from PA-500, even though I applied a policy rule to allow everything from inside to outside.

Please if you can provide a solution to this issue.

Below is a diagram visualizing the problem.

[ajbool · Accepted solution]

Hi,

Try creating a new Zone Protection profile (in Network -> Network Profiles).

In the new profile set the "Reject Non-SYN TCP" to no.

Apply this zone profile to your zone - sorry can't remember if it will be the internal or external zone!

[Besfort]

Thanks a lot ajbool, it is working . I had to apply it on the internal zone.

Regards,

-B