topic Re: application incomplete no internet access in General Topics

application incomplete no internet access

Transporter — Fri, 27 May 2016 11:18:40 GMT

Hi Guys,

We are seeing the traffic for the new subnet we added recently are coming as incomplete and need some help to troubleshoot this.

Cheers,

Mykhaylo

Re: application incomplete no internet access

santonic — Fri, 27 May 2016 11:29:50 GMT

Either response doesn't find the way back (routing) or something in front of PA drops these SYN packets.

Re: application incomplete no internet access

Transporter — Fri, 27 May 2016 11:31:28 GMT

Going to do PCAP. Let you know

Re: application incomplete no internet access

tsrivastav — Fri, 27 May 2016 12:32:55 GMT

By mistake clicked on me too.

Anyways :

------------------------

Have you tried assigning that IP address you are using for source NAT on any interface like a secondary ip just for troubleshooting purposes and then try pinging to the next hop using that natted ip address as a source.

Also try sending a G-arp packet after the same to see the resluts

The above step is just to see that Ip has a back and forth reachability from the internet or not

as if that ip itself is not rechable as a source to the next hop the host machines will never be able to reach to the internel using that as a natted source ip address

Also please let me know are you using single VR or 2 virtual routers.

Re: application incomplete no internet access

Transporter — Fri, 27 May 2016 15:59:54 GMT

Ok PCAP from the client affected subnet shows only syn packets. Palo Alto PCAP shows syn, syn-ack from the server and that is it.

Another subnet successfully using Internet . Below screen shot:

Subnet 10.94.156.0/24 UN-SUCCESSFUL

Subnet 10.94.159.0/24 SUCCESSFUL

Routing back to the host??

Re: application incomplete no internet access

Transporter — Fri, 27 May 2016 16:39:56 GMT

Just a quick update. Routing issue. Packet is not getting back to the affected subnet when Palo sends a syn-ack packet. Thank you all

Re: application incomplete no internet access

santonic — Mon, 30 May 2016 06:30:26 GMT

Cool. Thougth it might be.