topic Re: Whatsapp traffic cannot recognize in PA for iPhone user. in General Topics

Whatsapp traffic cannot recognize in PA for iPhone user.

JANARTHANAN1392 — Tue, 01 Aug 2023 05:41:19 GMT

Recently iPhone users only facing in WhatsApp "connecting" message, User could not send a message and make a call

on corporate wireless network But, working in mobile network.
It was working before, day by day users facing this issue is increasing. Still WhatsApp working for some of the iPhone users on same wireless network.

Tried IOS software update and WhatsApp update as well but no luck.

Same is working for all andriod users even on old version of WhatsApp.

in firewall end, WhatsApp traffic is cannot recognized as whatsapp-base for iphone. it shows as unknown-tcp.

No recent changes in our firewall end.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

MarketMaker — Wed, 02 Aug 2023 07:38:19 GMT

Exactly the same problem on our side.

I opened a case.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

MichaelBredell — Wed, 02 Aug 2023 09:40:09 GMT

Yeah we are experiencing the exact same issue. Workaround allow unknown-tcp over 5222. Anyone opened a TAC case yet?

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

MarketMaker — Wed, 02 Aug 2023 09:46:08 GMT

Exactly the workaround we use. Just waiting for my local reseller to know what to do.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

BPry — Wed, 02 Aug 2023 14:16:36 GMT

@JANARTHANAN1392,

This issue is being heavily reported and will undoubtedly be corrected in an upcoming signature update. Unfortunately like any other application, PAN has to play catch-up on the signatures when the traffic is modified to no longer match existing signature patterns.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

JANARTHANAN1392 — Thu, 03 Aug 2023 03:33:03 GMT

Should this reported to PAN to get prompt signature update? What is their approach on this type of issue.@MarketMaker is already opened a case with PAN for same issue.

This issue was started 2weeks back or us. But why PAN still catch this issue.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

Thandiwe — Tue, 08 Aug 2023 07:23:35 GMT

Did you get any assistance from TAC?

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

MarketMaker — Tue, 08 Aug 2023 07:48:50 GMT

No answer at the moment.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

VirupakshaRajapur — Wed, 16 Aug 2023 13:41:49 GMT

Hi Is there any update on this ? I'm also facing same issue.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

JANARTHANAN1392 — Thu, 17 Aug 2023 02:25:24 GMT

WhatsApp new update 23.16.0 fixed this issue. people can text and call now.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

igor.shpak — Tue, 22 Aug 2023 08:29:44 GMT

We have updated to Whatsapp version 23.16.0 and still not working

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

miasmith500 — Tue, 22 Aug 2023 12:46:14 GMT

Hello,

When WhatsApp traffic on iPhone users is unrecognized by the Palo Alto (PA) firewall and displays as "unknown-tcp," despite no recent firewall changes, consider the following troubleshooting steps:

Update Application Definitions: Ensure the PA firewall's app definitions are current.
Traffic Analysis: Capture and analyze "unknown-tcp" samples to identify potential WhatsApp patterns.
Custom Application Signature: Create a signature in PA for the unrecognized WhatsApp traffic.
Review Security Profiles: Check for SSL decryption policies affecting iPhone or WhatsApp traffic.
Whitelisting: Temporarily allow 'unknown-tcp' traffic for iPhone users identified as WhatsApp.
Contact Palo Alto Support: Report the unrecognized traffic issue.
Inspect Network Devices: Ensure no devices like Load Balancers are altering traffic.
Reach Out to WhatsApp: Inform them of the issue affecting iPhone users.
Remember, setting up a controlled test environment can help isolate the issue without affecting all users.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

FarkhanAliyev — Thu, 24 Aug 2023 13:11:02 GMT

Hi friends,

Has anyone opened TAC case regarding this problem and got an answer? It seems to be a global issue.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

MarketMaker — Mon, 28 Aug 2023 08:20:07 GMT

I gonna have a call with Palo support for my open case. I'll keep you informed.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

CyberEye — Fri, 01 Sep 2023 10:54:06 GMT

We are also facing the same Issue.Please let us know if any progress or update for this.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

MarketMaker — Fri, 01 Sep 2023 10:57:11 GMT

An App-ID update fixing this issue should be delivered 3rd week of september. No other solution than the workaround explain in this thread.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

Raido_Rattameister — Fri, 01 Sep 2023 13:06:44 GMT

Workaround is to permit unknown-tcp traffic on port 443 and 5222 to WhatsApp IP ranges.

You can get WhatsApp IP ranges from https://developers.facebook.com/docs/whatsapp/guides/network-requirements/

Look for "WhatsApp server IP addresses and ranges (.zip file)" on the page.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

sebastian.rincon — Fri, 08 Sep 2023 20:56:03 GMT

hi , Did you get any response?

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

MarketMaker — Mon, 11 Sep 2023 07:45:17 GMT

Like I said, the only answer is : "wait for th App-ID update 3rd week of september". Before this you have the workaround described in this thread.

Re: Whatsapp traffic cannot recognize in PA for iPhone user.

Antonio-Siqueira — Fri, 22 Sep 2023 17:11:12 GMT

Hi guys! I saw that an App-ID update was released (Version 8756), but in my case the problem continues. Anyone else still having the same problem?

Applications Content Release Notes:
https://proditpdownloads.paloaltonetworks.com/content/app-8756-8298.html?__token__=exp=1695974588~acl=/content/app-8756-8298.html*~hmac=cd8298761fab66c616cfc77f8364847deaddf501bee597f2b2d8601f43ebc380