Weirdest thing I have seen

Reply
L1 Bithead

Weirdest thing I have seen

Having a weird issue. I installed an 820. I have internet traffic being NAT'ed. My gateway is set to the Palo. My hops to the internet look like this 

 

Windows Box ---> Palo 820 --> Cisco Pix --> Internet Provider

 

Pretty basic.. I have a rule in place to allow all internal to 0.0.0.0/0 443, 80.. 

 

I can get to anything google even your tube just fine. works fast no hesitation. If I go anywhere else ( MSN, Yahoo, CNN) I get nothing. Traffic drops.  I cant figure this out for the life of me. 

 

I got a pcap going to google and going to red.com (52.73.0.154)

 

I can get to google but not red. I cant find a difference. Any ideas would be appreciated.

L7 Applicator

Re: Weirdest thing I have seen

@scottoliver,

First thing that comes to mind would be an MTU mismatch between the Palo and the Pix? 

L5 Sessionator

Re: Weirdest thing I have seen

Hi @scottoliver,

 

If you're able to quantify a reliable source and destination IP address for a flow that isn't working, I would recommend taking a look at the global counters. This will show you what is being blocked, whether it be due to a policy deny or MTU issues like @BPry states.

 

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-check-global-counters-for-a-specific...

 

Thanks,

Luke.

 

L1 Bithead

Re: Weirdest thing I have seen

I did look at the counters and there were no drops. I cleared all sessions to the destination. I set up my filters to 52.73.0.154. I turned my filters on. 

 

I ran this command to clear the counters data out. ( show counter global filter delta yes packet-filter yes severity drop ) . I turned the capture on and ran (show counter global filter delta yes packet-filter yes severity drop) again to make sure I had 0 counters...

 

I then iniated the connection to the above address.. I ran a local wireshark to watch the connection so I knew when it was finished. When the connection was finished I ran ( show counter global filter delta yes packet-filter yes severity drop ) again and it came back with 0 counters hit...

 

Looking at the PCAPS packets do not appear to be getting dropped at all.. I can zip the pcaps and upload them to my server if anyone wants to take a look at them to see if they see something I do not. 

L1 Bithead

Re: Weirdest thing I have seen

Thinking it might be a TCP window sizing issue but not 100%

L1 Bithead

Re: Weirdest thing I have seen

Do you see the packet going to red.com hitting your PIX?

Is your DNS doing proper resolution for red.com?

Can you issue a show session all filter destination 52.73.0.154?

If you see the session please open it in the session browser and see the progress of the connectin.

 

Collecting this information will be a good start.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!