check to check "deny" packages

[FlexyZ]

Hi

I have some rules that will allow IPSEC between two Windows Domain Controllers, but it only works when I allow "any" underapplication - unless I ping from both ends.

So how can I see what port I am missing in my custom application group?

Thanks

[gswcowboy]

Try to look at the session table via CLI to determine what's being discarded when utilizing your application group. Something along these lines. Use the information to modify your app group accordingly and continue to test until you've rectified the issue.

show session all filter source 10.10.10.10 destination 192.168.1.1

Thanks,

Renato