topic Re: Certain TCP traffic not showing at the Azure Palo firewalls. in General Topics

Certain TCP traffic not showing at the Azure Palo firewalls.

Vanessaxu — Tue, 27 Feb 2024 20:01:02 GMT

Certain TCP traffic not showing at the Azure Palo firewalls.

There are tcp traffic from on-prem to Azure test subnet vm.

The connection path is as below: on-prem user laptop -> onprem palo fw -> express route ->Azure Palo fw -> test vm.

There is no NSG on any of the interfaces at Azure side.

The RDP traffic from the on-prem user laptop can reach the test vm no problem (tcp 3389).

The smb (i.e. TCP 139) traffic from the on-prem user laptop can only shown at the on-prem fw log, showing it was allowed and went out the same path to the express route, but timeout status.

The smb traffic is not showing at the Azure palo fw. ( why the smb traffic disappeared after existing the on-prem fw?)

The only difference is the on-prem laptop (prd domain) and the azure vm (test domain) belong to different AD domain controllers, with the same domain name.

No drop packets on either palo fw.

Re: Certain TCP traffic not showing at the Azure Palo firewalls.

kiwi — Wed, 28 Feb 2024 12:17:53 GMT

Hi @Vanessaxu ,

Is the traffic actually reaching the Azure fw or is it going lost in transit ? Can you check with a PCAP ?

Have you checked the global counters ? There might be drops there that don't show up in traffic log.

How to check global counters for a specific source and destination IP address

Kind regards,

-Kim.

Re: Certain TCP traffic not showing at the Azure Palo firewalls.

Vanessaxu — Fri, 22 Mar 2024 17:41:21 GMT

not sure if reach Azure palo firewall since it's the Azure file sync service. Not to a VM.

Re: Certain TCP traffic not showing at the Azure Palo firewalls.

Vanessaxu — Fri, 22 Mar 2024 19:24:32 GMT

did a pcap, can't see the traffic incoming either.

Re: Certain TCP traffic not showing at the Azure Palo firewalls.

Vanessaxu — Wed, 27 Mar 2024 14:41:09 GMT

forced traffic to the test vm via VPN, the traffic shows on the Azure Palo firewall log. Seems the the express route blocks certain traffic.