Firewall creates seperate sessions for C2S and S2C

[FarkhanAliyev]

Hi folks,

I was troubleshooting SSH connection and want to know if I missed something.

The topology is following:

Client ---> PFSENSE <====ipsec tunnel ====> PA VM ==== ipsec tunnel ==== AZURE ---> Server

Client tries to establish SSH session with linux server. After some timeout the connection fails and we see app incomplete in traffic logs. So we captured traffic and see that firewall drops SYN-ACK sent from server. We also took counters and can see that Non-Syn packet with no session match drop counter has been generated. 

We decided to allow non-syn tcp packet on both zones by enabling it on the zone-protection profile. 

As soon as we enabled it, we could see that now firewall creates separate session sourced from Server to client.

Then we again checked with global counters and now the firewall don't show non-syn counter as drop, however we noticed new counter "Split TCP handshake":

Article below says that PA firewalls normally handles sessions with split handhske:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSzCAK

However, we receive syn-ack and that has to be normal behavior and we dont see split handshake. From the captures took on the server side we see that server receives SYN and sends back SYN-ACK. Source and destination ports seems to be ok.

What we also checked:

- Asymmetric routing. There is no asymmetry in our topology

- DoS policies, all good.

- Egress and Ingress interface, also all good.

I am wondering if I overlooked something and the issue might be very simple such as too high MTU due to IPSEC overhead, but I dont thing that MTU issue can cause firewall to create seperate session.

Any help would be appreciated!