session table

[panos]

Hi,

is it possible to use a PAloalto firewall not to keep sessions and works like a non stateful Access Control device.

Thanks.

[kprakash · Accepted solution]

Hi

We dont have the feature to turn of stateful inspection, and all traffic would always be subjected to stateful inspection.

BR,

Karthik RP

[rmonvon]

Although we cannot disable stateful inspection, we can instruct the PA to ignore state via disabling 'Reject Non-SYN TCP'.  The PA can ignore session state per zone via configuration under Network tab ==> Zone Protection ==> Packet Based Attack Protection ==> TCP/IP Drop, and setting 'Reject Non-SYN TCP' to no.

To ignore session state globally for the entire PA, You can use the CLI and issue the commands as described here:

Thanks.

[kprakash]

Hi rmonvon,

This would work only for TCP sessions. The UDP and protocols without port numbers ( ICMP, OSPF, PIM, ESP,etc)  however will still have sessions established for it.

BR,

Karthik RP

[panos]

I was wondering what to do when session limit is reached.That is why asked that for.

[rmonvon]

When session limit is reached, the PA will not allow the excess sessions to pass through.  Thanks.