topic Re: application showing as incomplete + ipsec tunnel issue in General Topics

application showing as incomplete + ipsec tunnel issue

AY_FASAR — Thu, 20 Mar 2025 13:58:05 GMT

Hi,

I have an IPSec tunnel to a 3rd party, which we have some intermittent issues with.

at the time that 3rd party lose its connection to us, under monitor> traffic I can still see traffic flowing but with application showing as incomplete. as I understand, incomplete could mean that source start a 3-way handshake but doesn't get a syn ack back. also understand that this could happen for different reasons main one being lack of routing. so can this suggest that as my tunnel was down at that time and there was no route in routing table to the destination, hence I see the 'incomplete application' in the logs? or palo lto would drop the traffic straight if it didnt have any route in its routing table?

Thanks

Re: application showing as incomplete + ipsec tunnel issue

JayGolf — Wed, 26 Mar 2025 01:54:22 GMT

Hi @AY_FASAR ,

An incomplete can mean mean one of two things:

TCP handshake did not complete
TCP handshake did complete but there was not enough data after the handshake for the App-ID to engine identify the application

In your case since the tunnel was down, its likely that the receiving client wasn't able to send an ACK packet or any data back to the sender. Also, I would definitely look into why your tunnel connection is intermittent. Take a look at your system logs for VPN related messages and run a packet capture if you need to.

Re: application showing as incomplete + ipsec tunnel issue

AY_FASAR — Wed, 26 Mar 2025 11:17:00 GMT

thanks for the reply, when setting packet capture, do I do it to gateway or just specific source/ or destination in the tunnel?

Re: application showing as incomplete + ipsec tunnel issue

OtakarKlier — Wed, 26 Mar 2025 16:53:30 GMT

Hello,

The pcap should be source IP to destination IP. Also with regards to the first question, the logs probably state allow, meaning the traffic was allowed, but never went anywhere due to the tunnel issue(s).

Regards,