Google street view in maps.google.com not working

[tim.nightingale]

I am working with a school customer with a PA firewall in place.  The issue is Google street view images do not load on the device when connected to the student VLAN but the exact same device switched to the staff VLAN works fine. The actual symptom is the browser shows a message "No street view imagery available here" and a black screen where the images should be.  Everything else - including the pins on points of interest work. If I switch the device to the staff VLAN and hit refresh, the page loads fine.  I can see the relevant firewall rule is being fired and is supposedly allowing the traffic when the device tries to connect, so that's telling me the firewall is seeing the traffic, but then it logs an 'aged-out' session end reason (see attached screenshot).  We've excluded all the listed Google URLs for Maps etc. (https://developers.google.com/maps/domains) from SSL decryption with no effect.  It's such a specific issue that it should be easy to figure out, but I don't have the depth of experience with the PA to get to the bottom of this.  Firewall is running PAN-OS 10.1.6-h7.

Any pointers on where to look next would be great!

[BPry]

@tim.nightingale,

Do the students nat to a different public address than the staff? Have you enabled your interzone-default logging to verify that you aren't dropping any additional traffic unknowingly that could be causing issues with what you can actually see? That would be the two things I would start with.

If you are using different public addresses for students and staff, test assigning the same address that you would to staff on a student connected device with a targeted NAT entry.

[tim.nightingale]

All users inside the firewall use the same public IP address, regardless of student/staff/server etc.  I'll look at turning up the logging.

[Adrian_Jensen]

Are you using different URL Filtering profiles (either set individually or as a Group Profile) under the Action tab of your Security Policy allowing internet access for the student and staff networks? Is a URL filtering group possibly blocking the GoogleMaps data? You should also be able to see the blocks for the student network in the logs at Monitor -> Logs -> URL Filtering.

On an affected device, you can also start up Chrome and go to the menu -> More Tools -> Developer Tools, click on the Network tab, and then try navigating to GoogleMaps StreetView. If you see a bunch of red highlighted web requests, those are being blocked/failing to connect. The headers/response on individual requests may give you more information and the specific destination that is failing.

[tim.nightingale · Accepted solution]

OK, so we seem to have finally found the underlying cause.  Student devices are directed to a different DNS server than staff/servers, due to network segmentation (not atypical in a school environment).  The issue arises as the student network DNS server is not resolving *only* streetviewpixels-pa.googleapis.com - the reason why this URL is not resolved is unknown to us from the remote side.  Every other URL required for Google maps etc. works fine.  The DNS servers are the responsibility of the school, so we're waiting for them to come back from term break holidays to look further into this.  I have to say this is a very odd and unexpected outcome in terms of what the underlying cause was, but it does explain the issue perfectly - and without having the firewall implicated.  

[tim.nightingale]

Confirmed - DNS resolution issue resolved by school and Street View is now working.