topic Re: PA time out accessing web in General Topics

PA time out accessing web

soporteseguridad — Tue, 03 Oct 2017 08:07:46 GMT

Hi,

We have a PA in 8.0.4 version and we cant access to this web https://www.metromadrid.es. The only web is not working is this.

We tried to create a rule permitting all traffic, without any profile, but its not working. We see the session like allowed, packets sent and received, but browser stuck loading and web is not showed.

this is the session created:

This is the pcap

Do you see any strange behaviour in this web https://www.metromadrid.es ?

Re: PA time out accessing web

TranceforLife — Thu, 05 Oct 2017 14:29:11 GMT

Yes, it is not accessible here in UK. from the PCAP we can see the missing 3-way handshake and constant re-transmit of the SYN packets. Most likely web server is down.

EDIT:

hmm l think it is UP now:

Re: PA time out accessing web

soporteseguridad — Tue, 03 Oct 2017 08:23:42 GMT

Server is UP, we can access from another PA.

Yes, its seems like 3-way is not done but in session details we see packets sent and received.

I thought that could be a problem of our ISP with that web or in the server side but a colleague told me that if he accessed using his iphone worked with IOS 9 and 10. Quite strange.....

Re: PA time out accessing web

TranceforLife — Tue, 03 Oct 2017 08:30:41 GMT

Get another PCAP. l want to see SYN,ACK from the server arriving at the PA eth1/2

Re: PA time out accessing web

soporteseguridad — Tue, 03 Oct 2017 08:55:19 GMT

I add a pcap. i tried first with chrome (not working) and then with Firefox and now its working. If i use chrome after start session with firefox, its also working with chrome. Its like if the session is started with https is not working in both browsers, but if i start the session with http://metromadrid.es in Firefox the session is established. After being established the web is wowking in both browsers. What could be cause this problem???

This is the Firewall.pcap.

Re: PA time out accessing web

TranceforLife — Tue, 03 Oct 2017 09:38:51 GMT

Thi is a bit confusing now. New tab in the web browser = new session for Palo. It doesn't matter Chrome or Firefox first, for Palo it is a new session. Did you try to test from the different client/PC?

Re: PA time out accessing web

soporteseguridad — Tue, 03 Oct 2017 09:56:16 GMT

Yes, all devices going through this PA have the same behavior.

With firefox i try: https://www.metromadrid.es/ and it doesnt work, then i try http://metromadrid.es and it works.

I go to "session browser", i close all sessions to web server, i try with chrome or firefow and its working with both.

I dont find any pattern

Im trying to find any different between http request from our browsers. Maybe http get or connect are different.

Quite weird.

Re: PA time out accessing web

TranceforLife — Tue, 03 Oct 2017 13:41:40 GMT

Is your policy configure with "any application " "any services" and without the security profiles attached. If not then worth to test.

Re: PA time out accessing web

soporteseguridad — Tue, 03 Oct 2017 14:26:45 GMT

i did that. Even i created a custom app with "http-get=metromadrid.es" but it doesnt work because threeway is not done when its not working....

I disabled DSRI, deleted zone protection in untrust interface... i dont know what more i can do :S

Quite weird.....i dont have any idea whats happening

Re: PA time out accessing web

TranceforLife — Tue, 03 Oct 2017 14:29:55 GMT

Hmmmm.. Any intermediate devices before or after the FW that could potentially interfere with this session?

Can you post successful and failed https session output using the "magnifying glass" option (eg):

It is hard to prove but l doubt it is PA issue 😄 lets see

Re: PA time out accessing web

soporteseguridad — Tue, 03 Oct 2017 14:39:39 GMT

Yes, but if i try http://metromadrid.es in Firefox is working fine. After that i go to chrome, i go to metromadrid.es and its working too. Quite weird.....

Here screenshots and policy.

Re: PA time out accessing web

soporteseguridad — Tue, 03 Oct 2017 15:03:23 GMT

using http://metromadrid.es, there is a redirect to https and its working but only in firefox and explorer.

Re: PA time out accessing web

TranceforLife — Tue, 03 Oct 2017 15:15:43 GMT

This is very weird. Ok let's try something else. Lets see if PA itself can get 3-way handshake using its external (NAT IP) address;

> ssh port 443 source 188.x.x.x host 185.89.60.64

PCAP filter:

capture all stages: firewall, drop, receive and transmit.

Re: PA time out accessing web

soporteseguridad — Tue, 03 Oct 2017 15:45:13 GMT

I think

Log detailed:

Drop pcap:

Firewall pcap:

Transmit pcap:

receive pcap:

Re: PA time out accessing web

TranceforLife — Tue, 03 Oct 2017 16:01:53 GMT

This issue just breaks my mind 😄 l also have no ideas now. Just for test allow only application https (SSL) and on its default port 443 "application-default", otherwise l am giving up, sorry. It is more like a guess now. Cannot understand why we don't see SYN, ACK from PA PCAPs, when you were testing from the client PC with HTTPS requests.

Re: PA time out accessing web

soporteseguridad — Wed, 04 Oct 2017 06:55:49 GMT

Yes, its a x-files haha. I dont know whu we are getting this RST.....

We will downgrade to version 7.1.x or/and open a case with TAC.

Thanks a lot for your suppot

Re: PA time out accessing web

TranceforLife — Wed, 04 Oct 2017 06:57:01 GMT

Please post the outcome/TAC findings 😄