09-04-2020 03:01 PM
Hi Experts,
Users couldn't access the link "www.santander.com.ar" from global protect VPN, this is a normal bank related link so everyone can access though outside network, In our office structure Trust-VPN & Trust-Internal both sources zone are allowed to access "www.santander.com.ar" with general policies. As per policy Trust-Internal user have access the link through "PAN-INT2EXT URL FILTER" rule but Trust-VPN couldn't access the error is below
hit policy "PAN-INT2EXT URL FILTER update" and application - incomplete and session end reason - aged out
Can anyone please help to fix the issue
09-04-2020 06:33 PM
It's a bit difficult to picture this, will you be able to upload a picture with your security policies? Also, what does the Detail Log View report?
09-05-2020 10:33 AM
I tested on my PC behind the PA i see same behaviour.
Did the PCAP no drops.
Did this ever worked?
Only way to know the exact reason is to enable debugging on the PA.
If i get time today i will do that and keep you posted.
09-06-2020 12:03 PM - edited 09-06-2020 02:28 PM
Tested again today saw this Global counter incremented
tcp_drop_packet 2 1 warn tcp pktproc packets dropped because of failure in tcp reassembly
do you have uplink to more than one ISP?
In PCAP today i saw fw was dropping syn ack from the server i think might be because it was receiving syn ack more than 5 secs due to this config
----->Session timeout
TCP default timeout: 3600 secs
TCP session timeout before SYN-ACK received: 5 secs
In my case i have single link to ISP and i did below changes to make it work only for testing purposes:
In Prod I do not recommend to make those changes
set deviceconfig setting tcp asymmetric-path bypass
set deviceconfig setting session tcp-reject-non-syn no
It was working fine then then i undo my change via
going to config mode
set deviceconfig setting tcp asymmetric-path drop
set deviceconfig setting session tcp-reject-non-syn yes
Since then i am able to access website fine
Regards
09-07-2020 01:58 AM
@MP18 sorry for the late!
Thanks for your update, Actually that was in data center firewall and it's in production so i am not sure can i make the changes, we are using 7 gateways on that firewall for global protect VPN, and that issue is only for VPN users
So please confirm whether can i make the changes or not,
09-08-2020 02:29 PM
As PA is dropping the syn ack from the server as it is taking too long.
See below link.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boBJCAY
I had to make above change to make it work.
I will not recommend you above change as I do not know your environment.
For now their is no other way seems to access that website behind the PA firewall.
Regards
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!