PAN OS Session Table Clearing -> no RST/FIN Connection sent out ?

[CarloTaddei]

Hi Experts,

I have the following situation. I'm running an A/A HA Cluster based on 2 5220 PA Appliances (PAN OS vers 9.0.x)

Occasionally (following a failover event) we noticed that some of our Long Lived sessions (NFS + Oracle DB Sessions) active across the cluster do not seem to be properly handled at session table level cluster wide any longer - meaning connectivity is broken and our NFS share, for example, get stuck hanging ...

I already have a case by Palo Alto for examining and debugging this issue.

One "workaround" that I had to implement so far when such session table inconsistency arise is to identify and manually clear the affected sessions in the firewall sesssion table on both sides of the cluster.

Nevertheless I noticed that, by doing this, the firewall do not send either a RST or a FIN to either the client or the server side.

Is there any way to have the firewall (I would assume the Session Owner, in the case of an HA Cluster) send a RST or a FIN to client and/or server side of the connection ? I have searched through this forum as well as through the PAN OS doc but haven't been able to identify until now such option .... which would greately help us recovering our NFS mounts ...

Thank you.

[Abdul-Fattah]

Hi,

Unfortunately, you can not make the firewall send a rst, the Firewall only send RST when a threat is detected.