The tracker stage firewall is a diagnostic field in Palo Alto Networks PAN-OS CLI or GUI output. It shows the exact reason or lifecycle state for why a network session was closed, dropped, or mitigated by the firewall.
At various phases during packet processing, a session may close due to causes such as:
- Session denied or time out
- Dropped packets due to threat various treat conditions
- Reset by any of end hosts
The purpose of the session tracker is to feature the precise reasons for mitigation actions taken on particular sessions. The information provided may be useful for retroactive analysis and most of the time reduce need for issue reproduction, which is often not successful.
There are multiple tracker stage statuses, such as:
- Aged out - Occurs when a session closes due to aging out
- TCP FIN - Occurs when a TCP FIN is used to close half or both sides of a connection
- TCP RST - client - Occurs when the client sends a TCP reset to the server
- TCP RST - server - Occurs when the server sends a TCP reset to the client
- appid policy lookup deny - Occurs when a session matches a security policy with a deny or drop action
- mitigation tdb - Occurs when a session ends due to a threat detection
- resource limit - Occurs when a session is set to drop due to a system resource limitation such as exceeding the number of out of order packets allowed per flow or the global out of order packet queue. Many other reasons will roll up to this reason.
- host service - Traffic destined for firewall but service not allowed or enable
Comments
Post a Comment