topic Re: Incomplete Application in General Topics

Incomplete Application

infotech — Fri, 04 Apr 2014 19:14:48 GMT

What does it mean when it saw the application is incomplete or insufficient data? But the action is to allow it? I assume the traffic in and out for this unknow app and IP address has been allowed

Re: Incomplete Application

Retired Member — Fri, 04 Apr 2014 19:27:33 GMT

Incomplete, Insufficient data and Not-applicable in the application field

Re: Incomplete Application

infotech — Fri, 04 Apr 2014 19:29:48 GMT

But it isn't blocking anything right it just doesn't can't identify the application

Re: Incomplete Application

jburugupalli — Fri, 04 Apr 2014 19:29:49 GMT

Hello Infotech,

Please refer the following link for detailed explanation about incomplete in the application field:

Incomplete, Insufficient data and Not-applicable in the application field

Regards,

Jahnavi

Re: Incomplete Application

infotech — Fri, 04 Apr 2014 19:31:47 GMT

Yes I read the suggested link but I want to know it what that means n regard to being blocked or not blocked and where I need to go to determine if its blocked or if it is coming in and out

Re: Incomplete Application

bparker — Fri, 04 Apr 2014 20:01:07 GMT

In my experience, when you see incomplete application and you believe traffic should be allowed through you need to check out your NAT settings. For some reason the 3 way handshake isn't completing and correct configuration of NAT is often an issue.

Re: Incomplete Application

HULK — Fri, 04 Apr 2014 20:03:52 GMT

Do you have an appropriate rule or "any " "any" deny rule at the bottom of the policy table to log these packets.?

Thanks

Re: Incomplete Application

infotech — Fri, 04 Apr 2014 20:09:09 GMT

I have a cleanup rule in my security policies set up so would I search in the traffic monitor for that rule?

Re: Incomplete Application

infotech — Fri, 04 Apr 2014 20:09:55 GMT

So what do I check in the nat setting specifically

Re: Incomplete Application

HULK — Fri, 04 Apr 2014 20:12:28 GMT

Yes, please monitor traffic logs for that rule.

Thanks

Re: Incomplete Application

bparker — Fri, 04 Apr 2014 20:15:28 GMT

It depends what you are trying to accomplish. This picture might be able to help explain how it works, so you can set it correctly.

Re: Incomplete Application

infotech — Fri, 04 Apr 2014 20:21:37 GMT

I checked the traffic logs for that rule and I did not have any denies to or from the source or destination address or in or outside the network.

Re: Incomplete Application

infotech — Fri, 04 Apr 2014 20:25:22 GMT

I am trying to allow a user to copy data via a ftp connection,which he can do and also see the copied data on the remote location at a vendor site

Re: Incomplete Application

infotech — Fri, 04 Apr 2014 20:42:38 GMT

I emailed you back hulk but it bounced

Re: Incomplete Application

bparker — Fri, 04 Apr 2014 20:53:17 GMT

So the part that isn't working is he can't see the data has been copied even though he is able to successfully copy the data there?

Re: Incomplete Application

infotech — Fri, 04 Apr 2014 20:57:43 GMT

That is correct bparker. The remote location is not a part of our network but of a vendor

Re: Incomplete Application

bparker — Fri, 04 Apr 2014 21:03:00 GMT

I agree with Hulk at this point we probably could use a screenshoot of the logs from the monitor, or it may also be worth a call to support. Only other issue that might be coming to mind is if you are using application-default service and for some reason the vendor is not allowing viewing of ftp on the default port. Something like that could also cause the handshake not to complete giving you Incomplete application.

Re: Incomplete Application

infotech — Fri, 04 Apr 2014 21:12:40 GMT

Good point bparker I will do that

Re: Incomplete Application

infotech — Mon, 07 Apr 2014 15:02:30 GMT

Re: Incomplete Application

infotech — Mon, 07 Apr 2014 17:15:53 GMT

I called in and got my question answer thanks for the info