01-14-2019 03:16 AM
Hello,
I found below on manual:
The Palo Alto Networks Firewall creates a sliding sequence window starting with the original ACK (the window size is based on the type of traffic within the session). It is expected that the packet sequence numbers within the current session reside within this sliding window. This window adjusts with the type of traffic and whenever new ACK messages are received. The default behavior on the device is to drop packets when sequence numbers are outside this window.
I want to know how 'sliding sequence window' is made.
The manual said it starts with the original ACK, but when I test something in my lab following is happened:
1 : SYN packet
2 : ACK with out of sequence -> passed
3 : RST with out of sequence(for packet 2) -> dropped
Pan os is 8.1, and all session setting was default. When I change asymmetric path to bypass, all of three packet is passed.
In this case, how sliding seq window is made? I think there's no original ACK in that..
Can anyone tell me what was the process in my situation?
