topic Re: Site can´t be reached - application incomplete in Prisma Access Discussions

Site can´t be reached - application incomplete

ThacitoPereira — Tue, 21 Jun 2022 13:54:22 GMT

I hope you can help me, through the Prisma Access network I can't reach the site "www.solicitator.org" when checking the log present "Application Incomplete". The site is accessible to the disconnected GlobalProtect.

What can be done so that the site is accessible through Prisma?

Re: Site can´t be reached - application incomplete

nikoolayy1 — Wed, 22 Jun 2022 20:37:30 GMT

As Prisma Access is based on Palo Alto Firewalls in the background and for me the server does not return a reply to the Prisma Access cloud and this is why data can't be returned. Better check after the prima access if there is something blocking traffic comming from the prisma access source IP addresses like router/firewall before the server or the server itself.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC

If you see that the server pcap it returns reply and that the routers/firewalls do not block anything then raise a case as with Prisma Access you can't do pcap captures or see global counters or flow debugs etc. as this is something the Palo Alto TAC can do in Prisma Access. This is the cloud it is easier but you have less control 🙂

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-palo-alto-checking-for-drops-rejects-discards/m-p/402102#M91777

You may test the Autonomous DEM, enable it just for group of users and proble the application as it will show you if the issue is in Prisma Access cloud or outside of it in most cases,

https://docs.paloaltonetworks.com/autonomous-dem/autonomous-dem-in-prisma-access/go-to-autonomous-dem-in-prisma-access

https://docs.paloaltonetworks.com/prisma/prisma-sd-wan/deployment-and-integrations/3-1-2/prisma-access-cloudblade-integration-guide/autonomous-dem-adem-for-prisma-sd-wan-remote-networks/enable-autonomous-dem-in-prisma-access-managed-by-panorama

https://docs.paloaltonetworks.com/autonomous-dem/autonomous-dem/set-up-an-autonomous-dem-application-test

https://www.youtube.com/watch?v=jYv8VhH4I4o

Re: Site can´t be reached - application incomplete

ThacitoPereira — Wed, 22 Jun 2022 15:47:39 GMT

Hi,

Thanks, I will do these tests and then inform you if I was successful or not.

Re: Site can´t be reached - application incomplete

nikoolayy1 — Fri, 14 Oct 2022 06:18:41 GMT

If you managed to get the needed answers, please flag the question as answered.

Re: Site can´t be reached - application incomplete

ThacitoPereira — Fri, 21 Oct 2022 13:51:50 GMT

In contact with Palo Alto were unable to get the package collected by accessing the site in question, a workaround suggested putting the split tunnel site to go through outside the VPN communication.