topic Re: Packet Deny even if there is an allow rule in Panorama Discussions

Packet Deny even if there is an allow rule

jguffroy — Wed, 22 Dec 2021 10:12:41 GMT

Hello,

we're encountred an issue with SAAS service, we created a security rule

but randomly we had issue during connection into the application, after packet capture, I saw a lot of tcp retransmission and client reset

When I checked the panorama logs I saw that the rule is not matched and flow is denied but I dont understand why because the security rule should be enough permissive.

Did you already encountred this issue ?

thank you for your feedback

Re: Packet Deny even if there is an allow rule

PavelK — Sat, 25 Dec 2021 22:36:49 GMT

Thank you for the post @jguffroy

Based on screen shot you supplied it is not clear what the root cause is. Would it be possible to navigate in the log to very left side and click on magnifying glass, get session ID from denied and allowed log, then navigate to Firewall's CLI and check/compare details of each session?

show session id <session id>

Kind Regards

Pavel

Re: Packet Deny even if there is an allow rule

MP18 — Sat, 25 Dec 2021 22:43:19 GMT

@jguffroy

If you have FQDN as destination address then that can be issue if IP changes on the url and PA it is not refreshed.

Default FQDN timer is 30 mins.

You can click on Destination address under address and then click on FQDN to see which IP it resolves and compare it with the

deny rule.

You can also refresh the fqdn so it learns the new ip of the fqdn

Regards

Re: Packet Deny even if there is an allow rule

MP18 — Sat, 25 Dec 2021 22:45:36 GMT

@jguffroy

Also check this url

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHJCA0

Regards