Couldn't access link "www.santander.com.ar" from global protect VPN

Reply
Highlighted
L1 Bithead

Couldn't access link "www.santander.com.ar" from global protect VPN

Hi Experts,

 

Users couldn't access the  link "www.santander.com.ar" from global protect VPN, this is a normal bank related link so everyone can access though outside network, In our office structure Trust-VPN & Trust-Internal both sources zone are allowed to access "www.santander.com.ar" with general policies. As per policy Trust-Internal user have access the link through "PAN-INT2EXT URL FILTER" rule but Trust-VPN couldn't access the error is below

 

hit policy "PAN-INT2EXT URL FILTER update" and application - incomplete and session end reason - aged out

 

Can anyone please help to fix the issue

Highlighted
L1 Bithead

It's a bit difficult to picture this, will you be able to upload a picture with your security policies? Also, what does the Detail Log View report?

Highlighted
Cyber Elite

I tested on my PC behind the PA i see same behaviour.

Did the PCAP no drops.

 

Did this ever worked?

Only way to know the exact reason is to enable debugging on the PA.

If i get time today i will do that and keep you posted.

MP
Highlighted
Cyber Elite

@LEDV-TCSNetwork 

 

Tested again today saw this Global counter incremented

tcp_drop_packet 2 1 warn tcp pktproc packets dropped because of failure in tcp reassembly

 

do you have uplink to more than one ISP?

In PCAP today i saw fw was dropping syn ack from the server i think might be  because it was receiving syn ack more than 5 secs due to this config

 

----->Session timeout
TCP default timeout: 3600 secs
TCP session timeout before SYN-ACK received: 5 secs

 

In my case i have single link to ISP and i did below changes to make it work only for testing purposes:

In Prod I do not recommend to make those changes

 

set deviceconfig setting tcp asymmetric-path bypass

set deviceconfig setting session tcp-reject-non-syn no

 

It was working fine then then i undo my change  via

going to config mode 

set deviceconfig setting tcp asymmetric-path drop

set deviceconfig setting session tcp-reject-non-syn yes

 

Since then i am able to access website fine

 

Regards

 

 

MP
Highlighted
L1 Bithead

@MP18  sorry for the late!

 

Thanks for your update, Actually that was in data center firewall and it's in production so i am not sure can i make the changes, we are using 7 gateways on that firewall for global protect VPN, and that issue is only for VPN users

 

So please confirm whether can i make the changes or not, 

 

 

 

Highlighted
L1 Bithead

@Max.Segura sure , I have updated with internal and VPN users logs for your reference

LEDV-TCSNetwork_0-1599472568027.png

LEDV-TCSNetwork_1-1599472657001.png

 

Highlighted
Cyber Elite

As PA is dropping the syn ack from the server as it is taking too long.

See below link.

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boBJCAY

 

I had to make above change to make it work.

I will not recommend you above change as I do not know your environment.

For now their is no other way seems to access that website behind the PA firewall.

 

Regards

 

MP
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!