URL blocked - Application "incomplete" and Flag 0x400019 in traffig log

Bittereinder — Wed, 20 Feb 2019 10:58:06 GMT

Hello, everybody!

I have a problem with a URL that is being blocked despite being explicitly allowed in the white list.

I have seen the traffic logs and for that destination IP address (i.e. a website on the internet) I see that Application is "incomplete" and the Flag 0x400019. What does this flag mean? I only know the usual flags as listed in the PA website:

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields.html

Any suggestions?

Thanks a lot.

Re: URL blocked - Application "incomplete" and Flag 0x400019 in traffig log

reaper — Wed, 20 Feb 2019 14:08:48 GMT

"Incomplete" means the TCP handshake did not complete, so an application could not be determined

This means the url is not being blocked, but the remote server may not be responding (or there could be a routing issue or firewall in between)

topic URL blocked - Application "incomplete" and Flag 0x400019 in traffig log in General Topics

URL blocked - Application "incomplete" and Flag 0x400019 in traffig log

Re: URL blocked - Application "incomplete" and Flag 0x400019 in traffig log