topic Re: PA sending TCP RST in General Topics

PA sending TCP RST

Jakub_Kopka — Mon, 26 Jan 2015 11:18:13 GMT

Hey folks,

I've run into a following issue. We have a Juniper MAG box communicating with a web server and a rule in place allowing this communication (source Juniper, destination any production IP, on any port). I can also see in the traffic log that the communication is accepted. However when I did a packet capture on the FW I saw the following:

Receiving capture:

Transmitting capture:

Any idea why is this happening or what I am missing?

Thanks

Re: PA sending TCP RST

pulukas — Mon, 26 Jan 2015 11:50:35 GMT

On the monitor tab, filter the threat logs and the url logs for these ip addresses and see if there are any hits.

Re: PA sending TCP RST

Jakub_Kopka — Mon, 26 Jan 2015 11:53:34 GMT

Hi Steven,

not for this traffic.

Re: PA sending TCP RST

pulukas — Mon, 26 Jan 2015 11:56:35 GMT

Then I would open a support case. When the PA generates a reset we should have a log from the process that is creating the reset.

Here your policy, threat and url logs are clean so it would appear that this is a bug that needs to be investigated.

Re: PA sending TCP RST

SteveMc — Tue, 27 Jan 2015 02:55:58 GMT

Hi Jakub

Are you running AppID version 482-2533? Try rolling back to a previous version, we had a similar issue

Cheers

Re: PA sending TCP RST

Jakub_Kopka — Tue, 27 Jan 2015 05:38:14 GMT

Hi,

Thanks. This has helped.

edit:

It's a bug - should be fixed in PanOS 6.1.3 with the AppID 482.