Discord voice chat no longer connecting after PA-440 install

[danthonyworks]

Hi all, I recently added a PA-440 to my home network, everything seems to be working fine with the rules I have set up (Just allowing all from the internal zone to the external zone at the moment) however Discord voice chats fail to connect. I took a look at the traffic logs and saw a lot of packets "aging-out" so I changed the timeout of what I think are the relevant applications (discord and quic) but that did not seem to do anything. I also changed the UDP timeout to 300s but again nothing. Apologies if this is a trivial question, I'm new to the palo-alto world and cant seem to wrap my head around why my allow all isn't really just allowing all. Does anyone know how to fix this?

[kiwi · Accepted solution]

Hi @danthonyworks ,

Did you set your rules to use application default ?

Just wondering because I believe discord voice uses a big range of UDP ports for its media gateways.  Check if the Service column is set to Any (or a custom service object covering UDP 50000-65535) or application-default.

I've also seen scenarios where we had to create an App Override rule for Discord to make it work.  While generally not recommended because of security you might want to try it out for testing (How to create an application override)

Are the apps being identified correctly in the traffic log ? You mentioned changing QUIC timeouts. I've seen QUIC breaking things because it encrypts the headers that the firewall needs to see to identify the app.  That said, when QUIC fails, apps like Discord (and Chrome/YouTube) should fall back to standard TLS/SSL and UDP, which the firewall can inspect and allow much more reliably.

Kind regards,

[OtakarKlier]

Hello,

There is an app/port that is getting blocked. Same thing happened at my house. But enable log at session end on your policies and check the Unified logs, you'll see the blocks.

Regards,

[danthonyworks]

Hi @kiwi, thanks for the reply!

My default allow rule is set to use application defaults. I created an application override as per the documentation you linked and added it as the first rule in my policies but it did not seem to fix the issue. Interestingly I am sporadically able to connect to a voice channel in discord. I took another look at the traffic logs and I'm not seeing any hits on this override rule when it fails to connect, I've attached a screenshot of the logs I'm seeing when it fails.

[danthonyworks]

Ah i should have read more carefully, setting the service on my allow rule from applictaion-default to any was the fix! Thank you for the help.