topic Re: What is the impact of passing "First Packet isn't sync" traffic at the firewall ? in General Topics

What is the impact of passing "First Packet isn't sync" traffic at the firewall ?

prasanga — Sat, 21 Aug 2021 09:12:46 GMT

What is the impact of passing "First Packet isn't sync" traffic at the firewall ?

When attending to application related issues, sometimes these dropped "First Packet isn't sync" traffic are misleading for troubleshooting.

Is there any impact of permanently passing "First Packet isn't sync" without blocking ?

regards,

Pasanga

Re: What is the impact of passing "First Packet isn't sync" traffic at the firewall ?

PhoneBoy — Sat, 21 Aug 2021 16:08:34 GMT

The very first packet of a TCP connection is a SYN with no other flags.
If we see the full TCP handshake, we can be sure the client actually initiated the connection with the server and the server acknowledged it:
Otherwise, it is possible some third party injected traffic.

Some reasons you might see these messages include:

Long term TCP connection expires due to lack of activity (2 hours is the default)
Asymmetric Routing

These checks are made for a reason and it is not generally recommended to disable these checks except in very specific circumstances for a limited period of time.

Re: What is the impact of passing "First Packet isn't sync" traffic at the firewall ?

prasanga — Sat, 21 Aug 2021 17:43:47 GMT

Thanks for the reply.

What is the exact place in Smart Console to enable or disable this.

regards,

Prasanga

Re: What is the impact of passing "First Packet isn't sync" traffic at the firewall ?

the_rock — Sat, 21 Aug 2021 18:27:23 GMT

Phoneboy can confirm for sure, but I believe that would be related to global properties -> stateful inspection

Re: What is the impact of passing "First Packet isn't sync" traffic at the firewall ?

PhoneBoy — Sat, 21 Aug 2021 20:45:23 GMT

That’s the global setting.
However it’s better to go through the troubleshooting steps here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk31382&partition=Advanced&product=Quantum
And it would be far better to disable it for a specific traffic flow versus globally: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk11088

Re: What is the impact of passing "First Packet isn't sync" traffic at the firewall ?

prasanga — Mon, 30 Aug 2021 06:01:43 GMT

Thanks a lot for the response.