topic Re: Telegram website is not accessible in General Topics

Telegram website is not accessible

MohamedSharief — Sun, 25 Dec 2016 14:03:54 GMT

Hi,

I've one client that cannot access https://telegram.org but he can access all other https website.

We tried to use a security rule with one source address and any any allow but still the same.

In the traffic monitor we can observe the session end reason is aged-out.

We are not using any ssl decryption rule.

Regards,

Sharief

Re: Telegram website is not accessible

pulukas — Sun, 25 Dec 2016 13:42:38 GMT

A session that is "incomplete" along with "aged-out" typically indicates a fundamental network routing problem between your client and the site in question.

https://live.paloaltonetworks.com/t5/Management-Articles/Not-Applicable-Incomplete-Insufficient-Data-in-the-Application/ta-p/65711

One of the most common issues with this would be asymmetrical routing for the path. But basically the 3 way handshake is not completing or there is no data transmited through the PA after the handshake at all.

Re: Telegram website is not accessible

TranceforLife — Sun, 25 Dec 2016 13:46:29 GMT

Hi,

You are not getting anything back from the website or even not reaching it as 0 bytes received. Are you able to ping a website from the firewall external (NAT IP 37....)?

Thx,

Myky

Re: Telegram website is not accessible

MohamedSharief — Sun, 25 Dec 2016 14:00:20 GMT

Hi pulukas,

If I bypassed the firewall I can connect normally to https://telegram.org

The question is why the firewall is not able to complete the 3 way handshake?

Hi MyKy,

Tried that also but no echo reply.

Regards,

Sharief

Re: Telegram website is not accessible

TranceforLife — Sun, 25 Dec 2016 15:51:03 GMT

Hi,

I don't think it is a firewall issue, as the firewall sends the packets but not receiving anything back. You could run a PCAP on the firewall to get more details and if you are actually getting SYN-ACK packets back:

https://live.paloaltonetworks.com/t5/Management-Articles/Using-Packet-Filtering-through-the-WebGUI/ta-p/56363

How do you get to that website from the firewall (your routing l mean). When you bypassing the firewall what is you default gateway, same as on the PA box. Funny that this happens only for one destination.

Re: Telegram website is not accessible

MohamedSharief — Tue, 27 Dec 2016 07:45:46 GMT

Hi TranceforLife,

You're correct! The firewall doesn't receive a SYN ACK packets when I checked the pcaps taken from firewall. Still its a weird issue cause its happening for only one website!

When I performed fib lookup I got the following:

btcuser@HO-PALOALTO-FW1(active)> test routing fib-lookup ip 149.154.167.99 virtual-router "Perimeter VR"

--------------------------------------------------------------------------------

runtime route lookup

--------------------------------------------------------------------------------

virtual-router: Perimeter VR

destination: 149.154.167.99 (Telegram website)

result:

via 37.216.237.xx1 interface ethernet1/1, source 37.216.237.xx2, metric 10

--------------------------------------------------------------------------------

And the internal gateway (Cisco router) IP address is 37.216.237.xx1

When we connect directly the gateway of the test PC will be Cisco router IP address.

Regards,

Sharief

Re: Telegram website is not accessible

santonic — Tue, 27 Dec 2016 07:56:44 GMT

When you bypass FW you have different source IP address? The telegraph.org server has your PA IP address on block list?

Sometimes a paranoid server or some other security device can block anIP if there are too many connections coming from it which would be the case with default NAT address.

Re: Telegram website is not accessible

MohamedSharief — Tue, 27 Dec 2016 09:10:55 GMT

Hi santonic,

Really interesting point you have here mate. Let me check on this also.

Regards,

Sharief

Re: Telegram website is not accessible

MohamedSharief — Tue, 27 Dec 2016 13:14:56 GMT

Hi,

The client updates me that Telegram website is working now, without any changes in the configurations and that indicates the issue is not from firewall, maybe the router or ISP.

Anyways, if the issue arises in the future we will do the following:

We will add an unused public IP address on outside interface and NAT the test machine with it and try accessing Telegram website to see if its working or not. This way we can find if it was really block by telegram or not.

Regards,

Sharief