topic Re: Many government sites are not opening on paloalto networks. Same is opening on outside network in General Topics

Many government sites are not opening on paloalto networks. Same is opening on outside network

SankalpS — Thu, 01 Dec 2022 05:29:53 GMT

Many government sites are not opening on paloalto networks. Same is opening on outside network. Please suggest

Re: Many government sites are not opening on paloalto networks. Same is opening on outside network

kiwi — Thu, 01 Dec 2022 08:05:06 GMT

You're not giving us much to work with.

What do you see exactly ? Is there a time-out or other error message ? Is your policy allowing it ? Do you see the connection attempt in the traffic logs ? Are you using decryption ? If so, is it being decrypted properly ? Do you see any drops in global counters when trying to access the websites ? Which platform and PAN-OS version are you using ?

Kind regards,

-Kiwi.

Re: Many government sites are not opening on paloalto networks. Same is opening on outside network

SankalpS — Thu, 01 Dec 2022 08:13:53 GMT

Getting site cant reached message when we try to open indian government sites link morth.nic.in. Also we try to by removing ILL cable from firewall and directly connecting to laptop then sites works.

Our many customers are facing this issue for last two days.

Re: Many government sites are not opening on paloalto networks. Same is opening on outside network

RVLINFRASEC — Fri, 02 Dec 2022 15:50:33 GMT

We also faced same issues. Example of Govt Site

https://cea.nic.in/

https://cercind.gov.in/

https://powermin.gov.in/

https://npp.gov.in/

https://recindia.nic.in/

Software Version 10.1.5-h2

Deployment: Vwire Mode

Once we removed palo-alto firewall from network, start opening the site. Log saying "Aged-out"

Appliance Model 850.

Re: Many government sites are not opening on paloalto networks. Same is opening on outside network

OtakarKlier — Fri, 02 Dec 2022 20:58:13 GMT

Hello,

If you are using SSL decryption, set the government and military URL filter to bypass decryption. Many of these sites dont like to be decrypted since it looks like a man in the middle attack. While it is man in the middle, its not an attack.

Hope this makes sense.

Re: Many government sites are not opening on paloalto networks. Same is opening on outside network

RVLINFRASEC — Sat, 03 Dec 2022 04:27:20 GMT

Nop, We are not using any decryption functionality in our appliance. Without SSL encryption/Decryption its not working, Whereas same traffic through checkpoint firewall working perfectly.

Re: Many government sites are not opening on paloalto networks. Same is opening on outside network

aleksandar.astardzhiev — Sat, 03 Dec 2022 17:35:38 GMT

Hi @SankalpS , @RVLINFRASEC ,

Have you done any troubleshooting on the firewall? Can you provide some output:

- Are you using URL filtering?

- Does your URL and DNS security licenses are still active?

- Check one of the problematic sites how firewall is categorizing it. Connect with SSH to CLI and use the following command:

> test url <url> > test url-info-host <url>

Replace <url> with the address you want to test. What is the output? What action is set for the same category in your URL filtering profile?

- Search URL logs (Monitor -> URL) for one of the problematic URLs. Do you see any logs? What action is seen in the logs?

- Resolve one of the problematic sites (with nslookup for example), search this IP in the Unified logs (Monitor -> Unified). Do you see any deny/block? Check one of the traffic logs - what is the "session end reason"? Is the counter for bites received different than zero?