Rudimentary TCP Session and Monitor Question

[mrcs]

I feel like I should already know this, but I just need a sanity check.

I have a rule that allows host A to B via tcp/900.  So host A starts to communicate via host B via that port.  The firewall allows it and a session is created.  Now, assume A and B stop talking but don't formally close the session.  After the default timer, the PAN closes that session.  Now, A tries to communicate to B b/c it still thinks it has an active session.  When that traffic hits the firewall, should it show up in the monitor log as a "deny"?  Will it just silently drop the packet?  Will it try to start a new session and I'd see a new "start" in the monitor?

[Raido_Rattameister]

B probably take this new session as new.

Firewall sees this as new if this has expired in firewa..

Source port is usually diferent for diferent sessions even if destination port is 900 in both cases.

Also new session starts with new SYN so B should take it as new.

[BenjAudy.MTL · Accepted solution]

Hi,

The firewall will silently drop the packets, unless you entered the command "set session tcp-reject-non-syn no" in the CLI. Eventually, the OS of the client will notice that there are no ACKs and will close or reset the connection. Apparently, it can takes a couple minutes for that to happen. If it's a problem for you, you can change the timer for specific applications (or system-wide, but I wouldn't do that). You could also make sure the client application sends packets from time to time to keep the session alive.

Regards,

Benjamin

[Raido_Rattameister]

Right.

I missed the part that A still thinks that session is active.

In this case yes fw will drop those packets.

[mrcs]

Yep.  This is it.  It will not log it to the monitor but will acrrue counters against the global TCP counters.  

Thanks all!