topic Re: Getting intermittent unknown UDP traffic logs in General Topics

Getting intermittent unknown UDP traffic logs

deepak12 — Mon, 27 Jul 2020 19:02:14 GMT

Hi All ,

I am having policy having application group and set services as application default .

Sometime policy is working fine but sometime its dropping packet and in logs showing application unknown UDP.

Could you please suggest any troubleshooting steps here ? I did packet capture but not seeing any this specific which can indicate any issue on firewall end .

Thanks

Re: Getting intermittent unknown UDP traffic logs

BPry — Mon, 27 Jul 2020 20:47:16 GMT

@deepak12,

What type of traffic are you actually seeing this on? It wouldn't be uncommon to see something developed internally have an unknown-tcp/udp determination, but if it's traversing the untrust/internet interface that's different.

In any case, it usually means that the firewall either didn't pass enough traffic to identify the app-id, or an app-id simply doesn't exist for the traffic.

Re: Getting intermittent unknown UDP traffic logs

deepak12 — Mon, 27 Jul 2020 20:58:54 GMT

@BPry ,

It's syslog traffic . Moreover for same set of source and destination IP , its working fine , properly identifying the APP-id.

I am using default syslog app-id .

Re: Getting intermittent unknown UDP traffic logs

BPry — Tue, 28 Jul 2020 16:12:44 GMT

@deepak12,

Interesting. I've never actually had the firewall fail to identify syslog traffic across the default 514 port, but I have if I customize the port without creating a custom application or doing an application-override see it come across as unknown-udp.

Personally, I would take a packet capture of the traffic when it comes across as unknown-udp and see if you can notice any sort of difference with the traffic. If you aren't seeing anything I would try to capture the traffic and open up a TAC case for review.

Re: Getting intermittent unknown UDP traffic logs

deepak12 — Tue, 28 Jul 2020 21:10:31 GMT

@BPry

Thanks , I will check with Tac and update here with findings .