topic Re: Packets being denied intermittently. in VM-Series in the Public Cloud

Packets being denied intermittently.

RobertPratt — Wed, 22 Jul 2020 20:16:15 GMT

My company has had an issue for over a year and Palo Alto cant figure it out. We're using Azure's Palo Alto offering.

* We have a security rule that is sourced from our trusted paas and destined to Azures Paas storage. Port 1433 app id: mssql db encrypted.

* Multiple times a week traffic all of a sudden goes from being allowed under a specific rule to being denied without changes being made.(its being denied under interzone-default policy which of course is deny.

* The only way to fix the issue is to make any change and hit commit, then the packets start hitting the rule again.

* We put a fall back rule source any destination any port 1433 and any application and this still doesn't resolve the issue.

* Packets hitting other rules with different ports and app id's doesn't have this issue only packets.

Has anyone experienced this issue?

Re: Packets being denied intermittently.

jdelio — Wed, 22 Jul 2020 21:22:22 GMT

@RobertPratt

I am sorry that this is happening, and quite odd to have it behave like that. I have not heard of that happening before, must be some sort of anomaly that is causing that to happen. I would see if others have anything to say about it, but this sounds like Palo Alto Network support will need to be contacted so they can help research and find out why it is happening.

Re: Packets being denied intermittently.

jguffroy — Wed, 22 Dec 2021 10:16:43 GMT

Hello @RobertPratt,

Did you resolved this issue?

Re: Packets being denied intermittently.

RobertPratt — Wed, 22 Dec 2021 14:22:20 GMT

Hello the issue was with the fqdn. I put a catch all rule at the bottom and used ip address instead of fqdn and we havent had the issue since.

Thanks.

Re: Packets being denied intermittently.

rachedfetiti — Tue, 18 Oct 2022 20:00:24 GMT

Hello

I am experiencing the exact same issue but I do not use fqdn

the same packet is allow by one rule and right after deny by intrazone rule

any one else ?

Re: Packets being denied intermittently.

Rfetiti — Tue, 18 Oct 2022 21:27:58 GMT

I finally figured out a work around,

the rule we had issue with had msrdp ldap and ad application along with tcp 135

I had to separate it in two rule, one with application and the other with tcp 135 only

it is working

still need to figure out why we can't have application and service in the same rule