application incomplete no internet access

[Transporter]

Hi Guys,

We are seeing the traffic for the new subnet we added recently are coming as incomplete and need some help to troubleshoot this.

 

Cheers,

Mykhaylo

[santonic]

Either response doesn't find the way back (routing) or something in front of PA drops these SYN packets.

[Transporter]

Going to do PCAP. Let you know 

[tsrivastav]

By  mistake clicked on me too. 

Anyways :

------------------------

Have you tried assigning that IP address you are using for source NAT on any interface like a secondary ip just for troubleshooting purposes and then try pinging to the next  hop using that natted ip  address as a source.

Also try sending a G-arp  packet after the same to see the resluts 

The above step is just to see that Ip has a back and forth reachability  from the internet or not 

as if that ip itself is not rechable as a source to the next hop the host machines will never be able to reach to the internel  using that as a natted source ip address

Also please let me know are you  using single VR or 2 virtual routers.

[Transporter · Accepted solution]

Ok PCAP from the client affected subnet shows only syn packets. Palo Alto PCAP shows syn, syn-ack from the server and that is it.

Another subnet successfully using Internet . Below screen shot:

Subnet 10.94.156.0/24 UN-SUCCESSFUL

Subnet 10.94.159.0/24 SUCCESSFUL

Routing back to the host??

[Transporter]

Just a  quick update. Routing issue. Packet is not getting back to the affected subnet when Palo sends a syn-ack packet. Thank you all

[santonic]

Cool. Thougth it might be.