Rudimentary TCP Session and Monitor Question

Reply
Highlighted
L0 Member

Rudimentary TCP Session and Monitor Question

I feel like I should already know this, but I just need a sanity check.

 

I have a rule that allows host A to B via tcp/900.  So host A starts to communicate via host B via that port.  The firewall allows it and a session is created.  Now, assume A and B stop talking but don't formally close the session.  After the default timer, the PAN closes that session.  Now, A tries to communicate to B b/c it still thinks it has an active session.  When that traffic hits the firewall, should it show up in the monitor log as a "deny"?  Will it just silently drop the packet?  Will it try to start a new session and I'd see a new "start" in the monitor?


Accepted Solutions
Highlighted
L4 Transporter

Hi,

 

The firewall will silently drop the packets, unless you entered the command "set session tcp-reject-non-syn no" in the CLI. Eventually, the OS of the client will notice that there are no ACKs and will close or reset the connection. Apparently, it can takes a couple minutes for that to happen. If it's a problem for you, you can change the timer for specific applications (or system-wide, but I wouldn't do that). You could also make sure the client application sends packets from time to time to keep the session alive.

 

Regards,

 

Benjamin

View solution in original post


All Replies
Highlighted
L7 Applicator

B probably take this new session as new.

Firewall sees this as new if this has expired in firewa..

Source port is usually diferent for diferent sessions even if destination port is 900 in both cases.

Also new session starts with new SYN so B should take it as new.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
L4 Transporter

Hi,

 

The firewall will silently drop the packets, unless you entered the command "set session tcp-reject-non-syn no" in the CLI. Eventually, the OS of the client will notice that there are no ACKs and will close or reset the connection. Apparently, it can takes a couple minutes for that to happen. If it's a problem for you, you can change the timer for specific applications (or system-wide, but I wouldn't do that). You could also make sure the client application sends packets from time to time to keep the session alive.

 

Regards,

 

Benjamin

View solution in original post

Highlighted
L7 Applicator

Right.

I missed the part that A still thinks that session is active.

In this case yes fw will drop those packets.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
L0 Member

Yep.  This is it.  It will not log it to the monitor but will acrrue counters against the global TCP counters.  

 

Thanks all!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!