topic Why is this happening? in General Topics

Why is this happening?

MarkCadman — Tue, 12 Sep 2017 12:15:56 GMT

Hi,

Why is this happening? Policy recognises the request, but it doesn't work. User is trying to up stream audio over port 8305

Thanks.

Re: Why is this happening?

Kaje — Tue, 12 Sep 2017 12:36:13 GMT

Do you have Any AV or threat scanning enabled on this rule? Also are you doing Decryption? Have you checked for URL filtering as well?

Some traffic does not handling being scanned, or decrypted well, also I recomend checking the URL filtering logs, just to be sure.

Re: Why is this happening?

BPry — Tue, 12 Sep 2017 16:01:57 GMT

@MarkCadman,

Hitting the magnifying glass on the left of those logs will give you some additional insight; but check your logs as @Kaje mentioned and see if you can find anything that would be stopping the traffic. Without some additional information age_out responses aren't that informative.

Re: Why is this happening?

RichColeman — Wed, 13 Sep 2017 10:15:29 GMT

Agree with @BPryBPry, we need to more information from the logs. Biggest question from me is are you seeing returned traffic. Most of the time "aged-out" means you're not getting anything back.

Re: Why is this happening?

MarkCadman — Fri, 15 Sep 2017 08:45:01 GMT

Hi. No, we're not doing any of that.

Re: Why is this happening?

MarkCadman — Fri, 15 Sep 2017 10:13:19 GMT

Here is more detail. Not sure it helps though. I coulnd't upload the photo for some reason https://drive.google.com/file/d/0B3Jizok7n9kIWENkcjg3clExV2s/view?usp=sharing

Re: Why is this happening?

RichColeman — Fri, 15 Sep 2017 13:40:29 GMT

Can you run a capture either on the firewall or the end client, the fact you have 1 sent packet and 5 received is weird, if both the source and destination are fully accessible for the TCP stream.

As you have Wifi in the rule name I would possible believe that inside device has connectivity issues and the destination is doing retransmits, thats why we're seeing more packets on the recieved end.

Can you get a wireshark capture? or run one on the firewall?

Re: Why is this happening?

MarkCadman — Wed, 20 Sep 2017 11:15:37 GMT

Hi,

I have uploaded the packet captures from the PA to here https://drive.google.com/open?id=0B3Jizok7n9kIUmRfMzczY2JqcnM

Thanks.

Re: Why is this happening?

MarkCadman — Fri, 22 Sep 2017 10:48:19 GMT

Does anybody have any ideas?

Re: Why is this happening?

bmorris1 — Fri, 22 Sep 2017 11:04:56 GMT

Hi Mark,

I've looked at your PCAPs and detailed log view.

The traffic is being sourced from VLAN 403 but return traffic (the SYN ACK) is being sent down to VLAN 400 (so down a different sub interface) You can see this by checking the 802.1Q tag in the PCAP. I suspect that this is being dropped by a device between the firewall and the server or the server due to this.

Its worth checking your policy based forwarding rule if you have any and/or routing.

hope this helps,

Ben

Re: Why is this happening?

MarkCadman — Tue, 03 Oct 2017 11:04:29 GMT

Thanks for this. I am investigating a way round this.