topic Re: PA sending TCP RST for a NAT rule in General Topics

PA sending TCP RST for a NAT rule

rodjeur68 — Mon, 20 Apr 2020 10:26:41 GMT

Hi everybody,

Adding a bidirectionnal NAT rule for an ssl web server and the according security rule, connections from outside are dropped as "Incomplete". Traffic capture show that first SYN packet received is directly rejected by PA with a RST response. What does it mean ?

Regards.

Re: PA sending TCP RST for a NAT rule

SutareMayur — Mon, 20 Apr 2020 11:33:22 GMT

@rodjeur68,

As session is incomplete, there is no response/reply from destination end.

Please check few configurations like,

1. Routing for destination server

2. If service is up and running on the server.

Mayur

Re: PA sending TCP RST for a NAT rule

rodjeur68 — Mon, 20 Apr 2020 11:54:29 GMT

Thx for the response.

* There's no routing issue: server can access Internet via the PA using the NAT IP address

* service is up and running, accessible from internal networks

Re: PA sending TCP RST for a NAT rule

SutareMayur — Mon, 20 Apr 2020 12:27:07 GMT

@rodjeur68,

Are you seeing issues with inbound or outbound traffic?

Mayur

Re: PA sending TCP RST for a NAT rule

rodjeur68 — Mon, 20 Apr 2020 12:35:34 GMT

Globally ? Not at all.

Rodjeur68

Re: PA sending TCP RST for a NAT rule

SutareMayur — Mon, 20 Apr 2020 15:47:17 GMT

@rodjeur68,

Is it possible to share traffic logs for affected traffic? Also is it app-id based security policy ?

As you said in your post, you have bi-directional NAT and you are facing issues with connections from outside on one ssl web server. You are trying to externalize web-server probably on 443 port. As session is seems to be incomplete, just check if web-service is running on server that you want to externalize. Check if you are able to telnet internal server on web-service port from LAN. As you are seeing incomplete session, most of the time it happens when there is no response from the server. That's why i asked to check reverse routing for web server subnet on firewall and application running status on web server.

Mayur

Re: PA sending TCP RST for a NAT rule

Vikashh — Mon, 20 Apr 2020 17:51:06 GMT

Agreed with @SutareMayur .

Most of the time session shows incomplete when there is no reply back from server side. Routing issues mostly causes this.

Re: PA sending TCP RST for a NAT rule

rodjeur68 — Tue, 21 Apr 2020 08:23:19 GMT

Hi everybody,

Thanks for your time. As I mentionned in a previous post, I think we don't have any issue with routing and service is up and running:

* I can ping server from appliance

* show routing route gives a correct route for my internal subnet

* from server, I'm able to browse Internet using the external NAT IP choosen for service

* from internals subnets, I can access the https service on the server (nginx)

When I capture the traffic I can see RST tcp packet immediatly send by PA on external interface and nothing on the internal interface.

Re: PA sending TCP RST for a NAT rule

Raido_Rattameister — Wed, 22 Apr 2020 03:16:19 GMT

It is always safer to create 2 NAT policies for DNAT and SNAT than bi-direcitonal.

If you check bi-directional NAT rule in cli you can see that for DNAT source zone will be "any".

For your TCP RST problem. Most likely your security policy is incorrect.

Are you using pre-nat IP and post-nat zone in security policy?

Re: PA sending TCP RST for a NAT rule

rodjeur68 — Wed, 22 Apr 2020 10:37:50 GMT

Hi,

Thank you very much for your advice on NAT rules.

After another check of our configuration, it seems that another host in the same NML subnet not crossing the Palo appliance was using the same IP address ... Everything works as expected now, sorry for the time spent on this obvious problem.

Rodjeur68

Re: PA sending TCP RST for a NAT rule

BrianNg2020 — Sun, 13 Dec 2020 21:06:46 GMT

Hi, can you elaborate a little more about the "It is always safer to create 2 NAT policies for DNAT and SNAT than bi-direcitonal"

I do have most of mine NAT rule is currently provisioned bi-directional and we are seeing issue with client server session reset. So, I searched and see this thread but do not understand about the statement you metioned. Thanks much for your help and if you could help and give a sample practical NAT rule using two separates policies instead of one as you said.