topic Re: palo alto interrupting web server traffic in General Topics

palo alto interrupting web server traffic

sib2017 — Mon, 06 Mar 2017 19:09:26 GMT

Hi,

I have web server , in some computers website load properly and some not loading properly .

I suspect pa is interrupting

Please advise

Re: palo alto interrupting web server traffic

TranceforLife — Tue, 07 Mar 2017 15:35:49 GMT

Hi @sib2017

What is actually happening? How is your policy looks like (profiles) etc. Traffic logs for the affected users? What I am usually doing (not always possible in the production) is taking one of the affected users/PCs and creating a "clear" test policy without anything purely from source to the destination permit any any (no profiles) and see what is happening. Same issue? Removing test policy and checking the client-server side only :0 as this is not PA issue.

Re: palo alto interrupting web server traffic

bradk14 — Mon, 06 Mar 2017 22:41:25 GMT

your issue is very vague. if you are talking about the same website on multiple computers, the first thing to check is to see if each computer is hitting the same rule for the same website in the traffic log. if so, you should also look at the reason for the session end, if it's a tcp-fin or timed out or a reset of some sort. also consider the threat log if you have a threat prevention policy in place. you also need to consider if all computers are using the same browser/version.

there are many places something like this could go wrong, but unless your rules are applied subjectively/unevenly, the firewall is probably the least likely source of the issue.

Re: palo alto interrupting web server traffic

sib2017 — Tue, 07 Mar 2017 15:30:40 GMT

Hi,

The server is 192.168.10.100:2048

and the client is : 192.168.2.25

Here is the capture -rx from the pa

Sometimes can access the port 2048 .That is the syptom. sometimes cannot .

In my capture there are tcp port numbers resued ,multiple retransmsiion and tcp previous segment not captured .

These are indicating to any problems

Thank you

Re: palo alto interrupting web server traffic

TranceforLife — Tue, 07 Mar 2017 15:36:22 GMT

What can you see in the traffic logs when accessing this server? How the PA identifies this port TCP 2048 under which application? How is your security policy looks like?

Re: palo alto interrupting web server traffic

sib2017 — Tue, 07 Mar 2017 17:56:45 GMT

Hi,

As per the screenshot there is SYN-ACK and corresponding (5 and 6) and finally client sent an ACK (11 and 12)

so the server listening on port 2048 , is'nt it ?

Thanks

Re: palo alto interrupting web server traffic

gwesson — Tue, 07 Mar 2017 18:06:06 GMT

A couple things could help clear it up if you can repost the screenshot:

Remove or hide the SNR and Rate columns in Wireshark.
Reduce the sizes of the IP columns to expand the other columns that have "..." so we can see the full data.
I assume the "delta" column is delta time between displayed frames, but expanding that field could help (or change your time display format to "Seconds since previous displayed packet".
Grab a packet capture of a working client to compare the flow.

It looks like we see two sets of three-way handshakes here, both on destination port 2048. Both handshakes are complete, and there seems to be an exchange of data (client sends PSH flags on frames 11-12, 13-14, and 15-16; the server sends a reply in frames 17-18).

If the traffic is known to Wireshark, you can also decode it as the known traffic (if it's TLS for example, right-click on any frame and choose Decode As..., and specify port 2048 to be whatever the actual traffic is).

Re: palo alto interrupting web server traffic

sib2017 — Tue, 07 Mar 2017 19:28:03 GMT

Hi gwesson

Thank you for the reply .

I have adjusted the view as you said . And i did decode as 'ssl'

Sorry for the incenvenience

Thanks

Re: palo alto interrupting web server traffic

TranceforLife — Tue, 07 Mar 2017 21:07:15 GMT

Hi,

Yes, correct. The server is listening on TCP 2048 port (no doubt) but same time we can see SSL traffic to the same server. But what l am trying to understand is how is the PA seeing this traffic and how it is identifying? Under which application. This all info is under Monitoring tab on PA.

Re: palo alto interrupting web server traffic

BPry — Tue, 07 Mar 2017 21:02:26 GMT

@TranceforLife is bringing up a really good point. If the only information that your giving is a wireshark it doesn't actually tell us what the Palo Alto itself is seeing. Knowing what your security policy for the traffic looks like, how the Palo Alto is seeing the termination, all of that other good information.

Re: palo alto interrupting web server traffic

sib2017 — Wed, 08 Mar 2017 07:21:18 GMT

Hi,

Unfortunately i Changed this port from 2048 to 80 and all the logs were over written .

When i change the app to port 80 , its seems working fine .There is some few old logs (Rules are same )

And there are some records shows session end reason is unknown

Thanks