topic Re: PAN-OS 8.0 Upgrade Blocking Nexflix in General Topics

PAN-OS 8.0 Upgrade Blocking Nexflix

Sbarlock — Fri, 21 Apr 2017 04:39:51 GMT

I recently upgraded my home PA-200 to PAN-OS 8.0.1 from 7.1.7. All seems fine, except that from two Samsung smart TVs Netflix streaming is affected. A diagnostic test on one of the TVs shows that the app is able to connect to 1 of 4 Netflix servers only. Strangely, I can stream Netflix to a Chrome browser on a Windows 10 machine without issue.

Any suggestions as to what might be causing this, or how to fix it?

Re: PAN-OS 8.0 Upgrade Blocking Nexflix

Raido_Rattameister — Fri, 21 Apr 2017 05:00:34 GMT

First step is to check if you see any sessions if you go to Monitor > Traffic and use filter below?

( addr.src in 1.1.1.1 ) and ( action neq allow )

Replace 1.1.1.1 with ip of your TV.

Also run filter ( addr.src in 1.1.1.1 ) against threat and url log also.

Re: PAN-OS 8.0 Upgrade Blocking Nexflix

Sbarlock — Fri, 21 Apr 2017 06:34:22 GMT

I've pasted below certain fields from the traffic log of a pretty typical attempt to connect to Netflix from one of the smart TVs. Lots of TCP resets from client, though no idea why that would be happening.

The threat and URL logs are empty.

Receive Time

Type

Threat/Content Type

Source address

Destination address

Rule

Application

Source Port

Destination Port

Flags

IP Protocol

Action

Re: PAN-OS 8.0 Upgrade Blocking Nexflix

Raido_Rattameister — Fri, 21 Apr 2017 06:56:52 GMT

Are you decrypting traffic? Traffic and URL log don't show any blocked traffic?

What if you add Policies > Application Override rule temorarily to match if source is TV IP for traffic that goes to WAN.

Will it work then?

Be careful with app override. This will make Palo to stop at Layer 4 and will not do Layer 7 inspection and AppID.

https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-How-to-Create-an-Application-Override/ta-p/65513

Re: PAN-OS 8.0 Upgrade Blocking Nexflix

jvalentine — Fri, 21 Apr 2017 12:34:38 GMT

During the 8.0 beta, there were a couple of issues reported with Netflix, but I don't know if they were fully addressed. The two workarounds mentioned at the time were:

1.) disabling the DNS proxy (or pointing the two netflix devices @ an external DNS server such as 8.8.8.8 and 8.8.4.4)

2.) enabling "allow http header range option" under Device / Setup / Content-ID / Content-ID Settings

Would be curious to know if either of these apply to you and if modifying them changes the behavior.

Re: PAN-OS 8.0 Upgrade Blocking Nexflix

Sbarlock — Sat, 22 Apr 2017 01:46:08 GMT

Thanks both for your replies and suggestions.

@jvalentine, it seems to be a DNS Proxy problem. I use DHCP on my network to assign/provide both IP and DNS to clients. On the first smart TV client, I reverted to manual IP and DNS configuration, and streaming is back on Netflix. On the second device - really an Apple TV - I manually assigned the DNS server only (keeping DHCP for local IP address assignment) and its streaming is now working too.

FWIW, I tried the "allow http header range option" setting both on and off and it seemed to have no effect in my configuration.

Solved for now!

Re: PAN-OS 8.0 Upgrade Blocking Nexflix

borising — Sat, 22 Jul 2017 19:47:15 GMT

Hi,

I have had disabled the dnsproxy for my appletv for the last couple of months, which worked for me.

But then after upgrading my appletv to the latest releaes yesterday evening, Netflix suddenly stopped working.

I then enabled the "allow header range option", and Netflix worked again 🙂

So thank you for the tip!

PS.: Running 8.0.3-h4.

Re: PAN-OS 8.0 Upgrade Blocking Nexflix

KolbyDavis — Fri, 04 Aug 2017 04:19:53 GMT

Thanks for the tips that got it working for me.

Re: PAN-OS 8.0 Upgrade Blocking Nexflix

rodvand — Sat, 05 May 2018 12:58:55 GMT

Just experienced this today after having setup DNS proxy on 8.1.1 in my home network.

If you enable TCP queries on your DNS proxy setup Netflix works as normal (at least it did for me with my Apple TV).