https://live.paloaltonetworks.com/t5/general-topics/deny-amp-allow/m-p/72258#M41029 <P>I figured it out one is denying udp but allowing tcp LOL</P> Fri, 05 Feb 2016 15:52:29 GMT jdprovine 2016-02-05T15:52:29Z https://live.paloaltonetworks.com/t5/general-topics/deny-amp-allow/m-p/72254#M41025 <P>I have a rule that allows the administrators remote desktop access to our physical domain controller. While reviewing the traffic logs I can see that the PA is show allows and denies for the exact same traffic from my PC to the domain controller using remote desk top through the exact same rule - how can that be?</P> Fri, 05 Feb 2016 15:13:37 GMT https://live.paloaltonetworks.com/t5/general-topics/deny-amp-allow/m-p/72254#M41025 jdprovine 2016-02-05T15:13:37Z https://live.paloaltonetworks.com/t5/general-topics/deny-amp-allow/m-p/72256#M41027 <P>Can you share screenshot of the session data (click on the mag class).</P> <P>Maybe it was permitted based on ip:port but was blocked based on AppID?</P> Fri, 05 Feb 2016 15:33:33 GMT https://live.paloaltonetworks.com/t5/general-topics/deny-amp-allow/m-p/72256#M41027 Raido_Rattameister 2016-02-05T15:33:33Z https://live.paloaltonetworks.com/t5/general-topics/deny-amp-allow/m-p/72258#M41029 <P>I figured it out one is denying udp but allowing tcp LOL</P> Fri, 05 Feb 2016 15:52:29 GMT https://live.paloaltonetworks.com/t5/general-topics/deny-amp-allow/m-p/72258#M41029 jdprovine 2016-02-05T15:52:29Z