PCNSE · Question #547
A network engineer has discovered that asymmetric routing is causing a Palo Alto Networks firewall to drop traffic. The network architecture cannot be changed to correct this. Which two actions can…
The correct answer is A. Navigate to Network > Zone Protection Click Add Select Packet Based Attack Protection > D. # set deviceconfig setting session tcp-reject-non-syn no. Options A and D address asymmetric routing from two angles: Palo Alto firewalls are stateful by default and drop TCP packets that don't begin with a SYN (since they missed the session start). Option A configures a Zone Protection profile with the Asymmetric Path setting set to…
Question
A network engineer has discovered that asymmetric routing is causing a Palo Alto Networks firewall to drop traffic. The network architecture cannot be changed to correct this. Which two actions can be taken on the firewall to allow the dropped traffic permanently? (Choose two.)
Options
- ANavigate to Network > Zone Protection Click Add Select Packet Based Attack Protection >
- B
set session tcp-reject-non-syn no
- CNavigate to Network > Zone Protection Click Add Select Packet Based Attack Protection >
- D
set deviceconfig setting session tcp-reject-non-syn no
How the community answered
(14 responses)- A71% (10)
- B21% (3)
- C7% (1)
Explanation
Options A and D address asymmetric routing from two angles: Palo Alto firewalls are stateful by default and drop TCP packets that don't begin with a SYN (since they missed the session start). Option A configures a Zone Protection profile with the Asymmetric Path setting set to "Bypass" under Packet Based Attack Protection > TCP, instructing the firewall to permit traffic it hasn't seen from the session's beginning. Option D runs set deviceconfig setting session tcp-reject-non-syn no in configuration mode (note the # prompt), which is the correct, persistent CLI change that globally disables the rejection of non-SYN TCP packets.
Why B is wrong: The > prompt indicates operational mode, not configuration mode - commands entered there are not saved to the candidate config and cannot make permanent changes. The command syntax is also incorrect for the intended setting.
Why C is wrong: Though it navigates to the same Zone Protection area as A, it selects the wrong sub-option or configures the wrong protection setting, so it doesn't actually resolve asymmetric path dropping.
Memory tip: Anchor on the prompt characters - # = configuration mode (permanent), > = operational mode (temporary). For asymmetric routing, think "bypass the state check": both the Zone Protection TCP bypass and disabling tcp-reject-non-syn tell the firewall to stop enforcing rules it can't fully apply when it only sees half the conversation.
Topics
Community Discussion
No community discussion yet for this question.