Hello,

I would say make sure you have logging enabled on the policy and check the logs to see why the PAN is denying the traffic.

Regards,

@OtakarKlier 

Yes , i have checked the same , once i applied policy-1 it will bypass all the policy and heat directly to deny any-any.

And i can see the traffic is dropped.

Hello,

This is definitely interesting. I would suggest opening a support case and see what they can find.

Regards,

@Jafar_Hussain 

I will say check the objects, addresses then look  for source and destination address.

Make sure under IP netmask it is 1.1.1.1

or 2.2.2.2

Regards

@MP18 

Thanks for your reply, my concern is why the firewall deny traffic once i configure the security policy-1 and given the IP address in destination, however, once i created the object for the same IP address and allow in destination all are working fine.

This issue is occurring only for one IP address rest are working fine.

I am not able to find out the reason.

@Jafar_Hussain 

You can do the PCAP on the firewall then you will have more info why PA is denying the traffic.

Regards

@MP18 

I took the packet capture and found the SYN packet is going towards the server but didn't get any ACK from the server side.

then TCP retransmission packet has been captured.

@Jafar_Hussain 

Just curious do you find solution for this?

Regards

@MP18 

Not yet.