Palo Alto blocking Wii game

CarthageCollege — Fri, 07 Jun 2013 02:39:39 GMT

Hi All -

Just got my Palo Alto installed last week! So far so good. Hope this is the right place to be posting...

I just got a message from a student that since the firewall install, a game on his Wii U, Monster Hunter, has stopped working. He claims this game works via P2P -- I haven't not looked in to this yet. We do not block P2P, but we use QoS to rate limit it. What's the best way to approach troubleshooting here? I'm assuming Palo Alto won't tell me which traffic is specifically for Monster Hunter.

Open to suggestions...

Thanks!

Max

Re: Palo Alto blocking Wii game

sraghunandan — Fri, 07 Jun 2013 02:45:03 GMT

Please navigate to Monitor tab and click on traffic. Now enter the following filter ( addr.src in userip )

Also if you could login into the cli using ssh, run the following command

>show session all filter source (ip in question) and then look at the session i.e >show session id (id)

for example:-

admin@92-PA-3050> show session all

--------------------------------------------------------------------------------

ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[P

ort])

Vsys Dst[Dport]/Zone (translated IP[Port])

--------------------------------------------------------------------------------

56478 telnet ACTIVE FLOW 192.168.192.217[35534]/trust-L3/6 (19

2.168.192.217[35534])

>show session id 56748

Session 56478

c2s flow:

source: 192.168.192.217 [trust-L3]

dst: 10.2.2.1

proto: 6

sport: 35534 dport: 23

state: ACTIVE type: FLOW

src user: unknown

dst user: unknown

s2c flow:

source: 10.2.2.1 [test]

dst: 192.168.192.217

proto: 6

sport: 23 dport: 35534

state: ACTIVE type: FLOW

src user: unknown

dst user: unknown

start time : Wed Jun 5 19:09:21 2013

timeout : 432000 sec

time to live : 344073 sec

total byte count(c2s) : 3028

total byte count(s2c) : 0

layer7 packet count(c2s) : 50

layer7 packet count(s2c) : 0

vsys : vsys1

application : telnet

rule : rule1

session to be logged at end : True

session in session ager : True

session synced from HA peer : False

layer7 processing : enabled

URL filtering enabled : False

session via syn-cookies : False

session terminated on host : False

session traverses tunnel : False

captive portal session : False

ingress interface : ethernet1/4

egress interface : ethernet1/7

session QoS rule : N/A (class 4)

Re: Palo Alto blocking Wii game

emr_1 — Fri, 07 Jun 2013 05:20:21 GMT

If Wii U has private IP address and PaloAlto applies NAT to this session, the reason he could not connect to P2P network might be this :

Re: Palo Alto blocking Wii game

CarthageCollege — Sat, 08 Jun 2013 03:07:56 GMT

Thanks for the reply! This is what I see when I do that. Nothing is coming up as blocked. Everything is being allowed. The unknown-udp entries look suspicious, different ports every time. The CLI commands aren't showing anything currently as he must have this device off -- I'll have to work with him on that. Anything else I can look at?

topic Palo Alto blocking Wii game in General Topics

Palo Alto blocking Wii game

Re: Palo Alto blocking Wii game

Re: Palo Alto blocking Wii game

Re: Palo Alto blocking Wii game