cannot understand drop reason

[minow]

hey

i have a client that connects to a remote site using  GP, and that site have s2s vpn to my site,

we have problems connecting to a server in that site, we can i cannot see and drops in the traffic or threat logs,

i have put filter on the ips and used tha show global couters shows this drops:

Global counters:

Elapsed time since last sampling: 5.880 seconds

name                                   value     rate severity  category  aspect    description

--------------------------------------------------------------------------------

flow_fwd_zonechange                        1        0 drop      flow      forward   Packets dropped: forwarded to different zone

--------------------------------------------------------------------------------

Total counters shown: 1

--------------------------------------------------------------------------------

i dont understand this drop error, but i have checked routes and have only one route to each direction and the s2s vpn is steady and up

pings between the client and server works fine

please help

thanks

[minow]

i can see the SYN from the client to the server and then i can see the SYN-ACK from the server to the client on the stages: receive, firewall and drop on my paloalto

on the drop it is the same packets of the SYN-ACK (comparing the firewall and the drop pcaps

[HULK]

Hello Minow,

Could you please confirm whether outgoing SYN packet and incoming SYN-ACK packet is being received by the same physical interface and zone.It's looking like a assymetric routing situation. For testing perpose you can enable "assmetric-path-bypass= YES" "TCP non-syn reject=NO".

Thanks

[minow]

yes i will try

but how can i see on which interface every packet received from and sent to

[minow]

the weird thing is that there is only one route to the client and one route to the server

[cstancill · Accepted solution]

Minow,

      Check what Hulk said, and double check your routes (including any PBF rules). It could be that the return packet is being routed to a different interface than the SYN packet came in on, which will give you the zonechange drop counter.

Craig Stancill  |  Technical Support Engineer

Shift Time : 05:00 – 14:00 GMT

Support Contact: US: (866) 898-9087, Outside the US: +1-408-738-7799

Palo Alto Networks  |  3300 Olcott Street  |  Santa Clara, CA 95054-3005, USA

https://support.paloaltonetworks.com/

[kdd]

hi minow,

please try the command:

- test security-policy-match source xxx destination xxx protocol xxx show-all yes

- test security-policy-match source xxx destination xxx protocol xxx from xxx to xxx show-all yes (

protocol: for example 80 is the right number for http

from: source zone

to: destination zone

the result will show which rule is taken. I guess there is a mismatch between interface and zones.

Regards Klaus

[ericgearhart]

kdd this is awesome! I just added these commands to our internal wiki

[kdd]

ericgearhart i like it too because it keeps a lot short

[minow]

i will check and update by the way... protocol should be 6 for tcp, and add destination-port 80 for http

thanks

[minow]

It PBR policy routing ACK to a different zone.

thanks

[Phoenix]

Hello minow,

There is this doc where it explains taking packet level logs known as flow basic. This would give details results if there is a drop at what stage what is the reason and so on to understand.

Packet Based Troubleshooting - Configuring Packet Captures and Debug Logs

Thanks