syn without window-scale option

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

syn without window-scale option

L4 Transporter

Hi community, 

i am trying to access a website from LAN side of palo alto, even though correct policy is configured, tcp handshake was not complete. after packet capture i am able to find below points

  •  client sending syn packet
  • but i am not able to get syn-ack packet from server,
  • able to see one ack packets from server
  • server is using 3-way handshake only
  • server is sending syn-ack, but tcp window-scaling option is not available.

i have seen firewall will drop packet if window scaling information is not available in syn packet. can anybody tell whether i am hitting on same issue, if yes, how to solve it in palo alto


Cyber Elite
Cyber Elite


Was the pcap performed from the PAN or from the client? I honestly suspect a routing issue since you are not getting any ack's.


Hope that helps.

Hi klier,

No routing issue is involved, i am able to acces other sites, only this particular site is is not accessible. when i bypass firewall, i was getting syn-ack packet in my PC. when i access through firewall, firewall is dropping that particular packet.

for other sites, bypassing firewall or accessing through doesn't make any difference.

Add filter.

Assuming that website IP is

Monitor > Packet Capture


Enable filter.




Go to cli and run command.

> show counter global filter delta yes packet-filter yes


Try to visit website and run command again.

> show counter global filter delta yes packet-filter yes


Do you see any where severity is drop?

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Hi Radio,


Thanks for your input.

the counter was increasing in my case because of out-of-window packets. after putting 'set deviceconfig setting tcp asymmetric-path bypass' command, the website is accessible. it solved my issue. but it does look like an workaround only as the command is designed for assymetric routing. as of my understanding, in my case, definitly the issue is not assymetric but because of firewall doesnt have window information.


if i put this command, will i get any security risk as replay attack?

  • 4 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!