topic Re: Have managed to break Google Play and Apple App store downloads in General Topics

Have managed to break Google Play and Apple App store downloads

BlackfenSchool — Tue, 21 May 2013 07:38:01 GMT

At some point in the last month or so, I've managed to break downloads from both the Google Play store and Apple App store. But I don't know how.

I have enabled decryption, but have disabled all my decryption rules and it is still broken - So I assume it's not that.

I can't find any associated denied traffic in the traffic log, or in the URL filtering log.

If anyone has any idea what I've done, it would be greatly appreciated.

Thanks

Shaun

Re: Have managed to break Google Play and Apple App store downloads

craymond — Tue, 21 May 2013 15:10:08 GMT

If you don't have an explicit deny rule at the end of your policies, you won't see anything that is implicitly denied. In other words, If you don't have something allowed that needs to be allowed, and you don't have a policy that alerts or blocks everything else, you won't see it in the log. There is also a document located here: https://live.paloaltonetworks.com/docs/DOC-4256 that may be of use to you.

Re: Have managed to break Google Play and Apple App store downloads

ericgearhart — Tue, 21 May 2013 15:32:32 GMT

Also instead of a "Deny any to any" rule you might want to break your explicit deny rule up by Zone... otherwise you break intra-zone traffic if you have any (this is from experience.. we broke our Palo Alto providing DHCP by having a 'deny any' at the bottom of our rule base)

Re: Have managed to break Google Play and Apple App store downloads

craymond — Tue, 21 May 2013 17:28:57 GMT

I should have been more explicit! - As egearhart said, you definitely should not use a deny any any rule.

Re: Have managed to break Google Play and Apple App store downloads

BlackfenSchool — Wed, 22 May 2013 07:37:09 GMT

Hi all

I do already have an explicit deny all rule covering this zone, with logging enabled.