Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

What is required in order for TCP-RST packet to be returned by the NS firewall when using a vpn tunnel?

0

0

Article ID: KB6768 KB Last Updated: 18 Aug 2010Version: 4.0
Summary:
What is required in order for TCP-RST packet to be returned by the NS firewall when using a vpn tunnel?
Symptoms:
set flow tcp-syn-check-in-tunnel
Solution:

A TCP session entry will be cleared upon disconnection of the outgoing physical interface or the tunnel interface the session is using.

With the command "set flow tcp-syn-check-in-tunnel" configured, the firewall will check if the tcp packet is a syn packet, and if not then return a tcp-rst back to the originating host.

This command is configured by default on the firewall.

The commands checks the TCP SYN bit before creating a session for tunneled packets.

Example:

Firewall> get flow
flow action flag: 1051
flow GRE outbound tcp-mss is not set
flow GRE inbound tcp-mss is not set
Check TCP SYN bit before create session for tunneled packets: YES
flow firewall setting: 00fc
flow log info: 0.0.0.0/0->0.0.0.0/0,0
flow initial session timeout: 60 seconds
flow session cleanup time: 2 seconds

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search