syn without window-scale option

[Abdul_Razaq]

Hi community, 

i am trying to access a website from LAN side of palo alto, even though correct policy is configured, tcp handshake was not complete. after packet capture i am able to find below points

•  client sending syn packet
• but i am not able to get syn-ack packet from server,
• able to see one ack packets from server
• server is using 3-way handshake only
• server is sending syn-ack, but tcp window-scaling option is not available.

i have seen firewall will drop packet if window scaling information is not available in syn packet. can anybody tell whether i am hitting on same issue, if yes, how to solve it in palo alto

[OtakarKlier]

Hello,

Was the pcap performed from the PAN or from the client? I honestly suspect a routing issue since you are not getting any ack's.

Hope that helps.

[Abdul_Razaq]

Hi klier,

No routing issue is involved, i am able to acces other sites, only this particular site is is not accessible. when i bypass firewall, i was getting syn-ack packet in my PC. when i access through firewall, firewall is dropping that particular packet.

for other sites, bypassing firewall or accessing through doesn't make any difference.

[Raido_Rattameister]

Add filter.

Assuming that website IP is 1.1.1.1

Monitor > Packet Capture

Enable filter.

Go to cli and run command.

> show counter global filter delta yes packet-filter yes

Try to visit website and run command again.

> show counter global filter delta yes packet-filter yes

Do you see any where severity is drop?

[Abdul_Razaq]

Hi Radio,

Thanks for your input.

the counter was increasing in my case because of out-of-window packets. after putting 'set deviceconfig setting tcp asymmetric-path bypass' command, the website is accessible. it solved my issue. but it does look like an workaround only as the command is designed for assymetric routing. as of my understanding, in my case, definitly the issue is not assymetric but because of firewall doesnt have window information.

if i put this command, will i get any security risk as replay attack?