topic A very weird issue in General Topics

A very weird issue

dtran — Fri, 17 Sep 2021 20:48:10 GMT

I have LinuxA (redhat 6.10) and LinuxB (CentOS 7.9) sitting in ZoneA accessing LinuxC (Ubuntu 20.x) sitting in ZoneB on http port without any NAT, jut routing and we have firewall rule to allow tcp port 80 (application ANY) for LinuxA and LinuB to communicate with LinuxC on tcp port 80. The PAN firewall is PA-5250 running PANOS 9.1.10

From LinuxA, I use "curl -v -k http://LinuxC/rancid, I see the PAN firewall accepting the three way handshake, but after that it drops on the "get" as seen below:

GET /rancid HTTP/1.1

User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.44 zlib/1.2.3 libidn/1.18 libssh2/1.4.2

Host: LinuxC

Accept: */*

Everything is working fine from LinuxB without any issues as seen below:

GET /rancid HTTP/1.1
User-Agent: curl/7.29.0
Host: LinuxC
Accept: */*

HTTP/1.1 301 Moved Permanently
Date: Fri, 17 Sep 2021 19:42:10 GMT
Server: Apache/2.4.41 (Ubuntu)
Location: http://LinuxC/rancid/
Content-Length: 319
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://LinuxC/rancid/">here</a>.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at LinuxC Port 80</address>
</body></html>

any ideas anyone?

Re: A very weird issue

bafergel — Fri, 17 Sep 2021 21:01:03 GMT

Hello @dtran, If you see the traffic being allowed in the firewall, I would recommend going through the steps of this article and see if Palo lists a reason as to why its dropping the connection. These steps have been helpful many times before in my troubleshooting. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloNCAS

Re: A very weird issue

ShaiW — Sun, 19 Sep 2021 09:34:05 GMT

I assume no Filtering profiles (TP,AV,URL,...) are attached to this traffic policy.

Check the traffic log for LinuxA->LinuxC:

1. Session end reason - is it incomplete, tcp-reset-from-xxxx, web-browsing?

2. Open this log's detailed log view and check the details pane. Note number of packets send and received. Zero (0) packets received will point you to a situation where packets are not returned from LinuxC towards LinuxA.

3. Perform a Packet capture as @bafergel pointed out in the article he attached. This will allow you to see what is received and transmitted and also (possibly) dropped by the firewall.

Shai