topic Re: PA blocks outbound port 10443, doesn't show up in logs in General Topics

PA blocks outbound port 10443, doesn't show up in logs

dclark1 — Mon, 25 Apr 2016 14:41:51 GMT

I have and external website that I need to access on port 10443: https://<public IP>:10443. The connection never completes and times out.

If I pull the PA FW out and throw in an ASA, works just fine. The logs on PA don't even show port 10443 being accessed or logged.

No matter what log I check, I find nothing.

Any idea?

Thx

Re: PA blocks outbound port 10443, doesn't show up in logs

bmorris1 — Mon, 25 Apr 2016 14:54:46 GMT

Hello,

Have you tried running a packet capture & global counters to check for any drops/reasons for drops? Is there any asymmetric routing in your network?

How to run a capture -

https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Run-a-Packet-Capture/ta-p/62390

Global counters -

https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Troubleshoot-Using-Counters-via-the-CLI/ta-p/57496

hope this helps!

Ben

Re: PA blocks outbound port 10443, doesn't show up in logs

pankaku — Mon, 25 Apr 2016 20:06:27 GMT

What's PAN-OS version on firewall?

Check the application and service tab. Try to make application as ssl and keep service as any. Check if works or not.

Re: PA blocks outbound port 10443, doesn't show up in logs

santonic — Tue, 26 Apr 2016 06:54:53 GMT

Are you logging everything? Find a rule that should allow or drop the mentioned traffic and see if it's set to logging.

Re: PA blocks outbound port 10443, doesn't show up in logs

santonic — Tue, 26 Apr 2016 06:57:41 GMT

Also make sure that your only drop rule isn't the implicit one: interzone-default. That rule doesn't log. I always make a default drop rule which logs above implicit rules.

Re: PA blocks outbound port 10443, doesn't show up in logs

dclark1 — Tue, 26 Apr 2016 12:07:19 GMT

Good idea on the drop rule. It's a very basic setup, and all rules log start and end of session. Capture logs show retransmissions, and traffic is getting to device.

Additionally another app that uses SSL over a non stanard port also did not work. Swapped PA with an ASA and both apps worked.....definatley something on the PA.

INFO:

PA-VM-100

Pan-OS: 7.1.1

All other software up to date.

Thx

Re: PA blocks outbound port 10443, doesn't show up in logs

santonic — Tue, 26 Apr 2016 12:43:41 GMT

So did you find this traffic in logs? If all rules are set to logging then you must see it. If you still don't see it then it's dropped by implicit rule.

Re: PA blocks outbound port 10443, doesn't show up in logs

dclark1 — Tue, 26 Apr 2016 16:54:30 GMT

Good call santonic on the deny rule.....it was getting caught in the implict rule. Adjusted regular rule and all is good.

Thx guys....

Re: PA blocks outbound port 10443, doesn't show up in logs

santonic — Thu, 28 Apr 2016 06:04:44 GMT

No problem.