topic Re: application in General Topics

application

Lucaaslr — Mon, 10 May 2021 20:16:20 GMT

Guys, good afternoon.

I have a very confusing problem, I try to access a certain "HTTP" site and I get an error (It is not possible to access that site), we perform a test outside our network and the access is done normally.

Analyzing the LOGS, I found that we received the incomplete action.

Re: application

dmifsud — Mon, 10 May 2021 21:30:37 GMT

Incomplete means 3 way handshake didn't complete.

How many packets sent/received? Usually this is when a SYN is sent but the other side isn't listening or a reply isn't getting back.

Are you sure it's matching the right NAT rule?

What is the session end reason?

Re: application

iscott — Mon, 10 May 2021 21:33:57 GMT

Hello, @Lucaaslr

If you see an "Application" as "incomplete", it means that the 3-way handshake did not finish.

If you are using a rule-based on "app-id" verify the permission that it has. Above all, the "dns" and "web-browsing" apps.
If you have URL Filtering, I recommend checking the URL Filtering logs for the source IP. In order to know if the URL was blocked. Perhaps, this is not the issue, because is cleartext. If the traffic is cleartext you will see a warning from the firewall in the browser.

If you can give more details of the issue, it could help.

Hope it helps

Regards,

Re: application

aleksandar.astardzhiev — Tue, 11 May 2021 09:29:50 GMT

Hi @Lucaaslr ,

Expand log entry details by clicking on the magnifying glass on the very left.

- Check if you have NAT applied on the source address

- Check if you have bytes sent and bytes received (the incomplete indicates TCP hadnshake is not completed, so I assume received would be zero)

- If your nat is correct you should run basic network check to see if you have proper routing