Click the Zone, for example "Untust1," to add the Zone Protection Profile and select it from the drop down menu in the Zone Protection Profile as shown below.The example below shows No Zone Protection Profiles. Apply this Zone protection Profile to the Interface/Zone wanted by going to Network > Zones.bypass - Bypass scanning on packets that contain an asymmetric path.drop - Drop packets that contain an asymmetric path.global - Use system wide setting that is assigned through the CLI.Asymmetric Path - D etermines whether to drop or bypass packets that contain out of sync ACKs or out of window sequence numbers:.Note: Allowing non-SYN TCP traffic may prevent file blocking policies from working as expected in cases where the client and/or server connection is not set after the block occurs. Global - Use system-wide setting that is assigned through the CLI.Reject Non-SYN TCP - Determines whether to reject the packet, if the first packet for the TCP session setup is not a SYN packet:.Some important definitions are detailed below: To view definitions on Packet-Based Attack Protection, click on the help ('?') link at the top right corner of the window.Select Packet Based Attack Protection > TCP/IP Drop.Additionally, these settings can be changed in the GUI per zone, with Zone Protection as show below:.Note: This command is temporary and will turn back on after a commit or change that causes a commit or reboot. To temporarily allow non-SYN TCP packets, run the following CLI command (not in Configure mode):.# set deviceconfig setting session tcp-reject-non-syn yes Turn the feature back on by using the following CLI commands:.# set deviceconfig setting session tcp-reject-non-syn no To disable the option permanently, run the following CLI commands:.Asymmetric routing is usually why this feature needs to be disabled. In rare occasions, it can be necessary to allow packets through without doing this security check. Normal TCP connections start with a 3-way handshake, which means if the first packet seen by the firewall is not the SYN packet, it is likely not a valid packet and discards it. Palo Alto Networks firewall will, by default, reject the first packet that does not have the SYN flag turned on as a security measure.
0 kommentar(er)
