application showing as incomplete + ipsec tunnel issue

[AY_FASAR]

Hi, 

I have an IPSec tunnel to a 3rd party, which we have some intermittent issues with.

at the time that 3rd party lose its connection to us, under monitor> traffic I can still see traffic flowing but with application showing as incomplete. as I understand, incomplete could mean that source start a 3-way handshake but doesn't get a syn ack back. also understand that this could happen for different reasons main one being lack of routing. so can this suggest that as my tunnel was down at that time and there was no route in routing table to the destination, hence I see the 'incomplete application' in the logs? or palo lto would drop the traffic straight if it didnt have any route in its routing table? 

Thanks 

[JayGolf]

Hi @AY_FASAR ,

An incomplete can mean mean one of two things:

• TCP handshake did not complete 
•  TCP handshake did complete but there was not enough data after the handshake for the App-ID to engine identify the application

In your case since the tunnel was down, its likely that the receiving client wasn't able to send an ACK packet or any data back to the sender. Also, I would definitely look into why your tunnel connection is intermittent. Take a look at your system logs for VPN related messages and run a packet capture if you need to.