Netflix iOS tcp-rst-from-client

stuart.l — Thu, 01 Sep 2016 08:09:35 GMT

I'm having an issue with Nexflix not running on an iOS device behind a new PA install. Basically no filtering should happen from the PA at all; Nexflix runs fine with no PA in line.

The configuration, which has most other applications and web access working:

PA-3020, V7.1.4-h2 with 610 definitions
Virtualwire mode, with allow any, no profiles or URL filtering
no QoS or Decryption

The log files show netflix-streaming or netflix-base as 'allow' but the session end reason is 'tcp-rst-from-client'. A packet capture reveals not a great for me to work on, a TLSv1.2 Encrypted Alert before the RST packets.

Any suggestions or simple gotchyas I have overlooked?

Re: Netflix iOS tcp-rst-from-client

DelvinC — Thu, 22 Sep 2016 00:23:52 GMT

You may be running into a problem with the port numbers for Netflix on IOS being different from the ones identified in the application by Palo Alto. A good way to troubleshoot would be to unblock all traffic to a specific host IP address and view the monitor logs for the port and application accessed by it when you try to stream Netflix.

topic Netflix iOS tcp-rst-from-client in General Topics

Netflix iOS tcp-rst-from-client

Re: Netflix iOS tcp-rst-from-client