>
    Unverified RST Timer
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. Session Settings and Timeouts
    4. TCP
    5. Unverified RST Timer
    Download PDF

    Unverified RST Timer

    Table of Contents

    Unverified RST Timer

    If the firewall receives a Reset (RST) packet that cannot be verified (because it has an unexpected sequence number within the TCP window or it is from an asymmetric path), the Unverified RST timer controls the aging out of the session. It defaults to 30 seconds; the range is 1-600 seconds. The Unverified RST timer provides an additional security measure, explained in the second bullet below.
    A RST packet will have one of three possible outcomes:
    • A RST packet that falls outside the TCP window is dropped.
    • A RST packet that falls inside the TCP window but does not have the exact expected sequence number is unverified and subject to the Unverified RST timer setting. This behavior helps prevent denial of service (DoS) attacks where the attack tries to disrupt existing sessions by sending random RST packets to the firewall.
    • A RST packet that falls within the TCP window and has the exact expected sequence number is subject to the TCP Time Wait timer setting.

    Recommended For You

    © 2023 Palo Alto Networks, Inc. All rights reserved.