Identifying unknown-tcp in Monitor tab

[ClintL]

Hello,

We have a PA-3020 running 6.0.3.  Basically we have iSCSI replication set up between two sites.  When I pull up the traffic in the Monitor tab I see the picture below.  Even though iSCSI traffic is defined in the Applications section I tried creating another app to identify it but still see the "unknown-tcp" traffic show up.  Is there something I am missing or is it not possible to change what it pulls up in Monitor?

[HULK]

A reference DOC for this : Incomplete, Insufficient data and Not-applicable in the application field

Thanks

[ClintL]

Hey Hulk,

Is there a way though to tell the Palo that any unknown-tcp traffic on port 3260 from specific zones will be classified as iSCSI?

[j.liu]

Custom app signature

Custom Application Signatures

[HULK]

Hello Clint,

As J.liu said, you need to configure a custom application signature to identify traffic on port 3260. Secondly, need a security policy in place  from specific zones to allow that traffic.

Hope this helps.

Thanks

[RichardThornton]

For iSCSI, I would be using an application override, essentially fast-pathing it which is what you would want to do with low-latency traffic.

The CNSE Study Guide page 34 gives the config steps.

[HULK]

Hello Clint,

As per my understanding, the default application iSCSI is using TCP 3260. Then, why you want to use a custom app for this..?  Better, you should use the previously mentioned DOC to get the exact reason.

Thanks

[ClintL]

Hey Hulk,

Honestly I don't know why it is not identifying the traffic as iSCSI.  It might be something proprietary with the vendor that is preventing the Palo from recognizing it even though it is coming across on 3260.  I just want to be able to see in the reports that it is iSCSI.  I will most likely end up programming both solutions.

Thanks for the answers, guys.  I'll give it a try today.

[HULK]

Hello  Clint,

According to the screenshot you have attached here, it looks like the amount of data transferred between the Server and client is very low ( few KB). PAN firewall need at least 2000 Bytes of application data or minimum 4 packets to identify an application signature correctly. So, could you please check how many packets has been exchanged through those sessions.

Insufficient data in the application field

Insufficient data means that there was not enough data to identify the application. So for example, if the 3-way TCP handshake completed and there was one data packet after the handshake but that one data packet was not enough to match any of our signatures, you would see insufficient data in the application field of the traffic log.

Thanks

[ClintL]

I think there is something proprietary going on.  I created a custom app signature with tcp/3260, created an allow rule and the traffic stopped transmitting altogether but I wasn't getting any deny entries.  I'm just guessing but maybe when it isn't let through as is the Palo possibly strips out whatever proprietary info the data has and makes it unreadable to the iSCSI equipment on the other side.  I haven't tried the application override rule yet though.

[HULK]

Hello Clint,

It's looks like the firewall passing a good amount of traffic, but still not able to identify the correct application-signature. Do you have a chance to take a packet capture. We can relay that PCAP through a  LINUX REPLAY server and let you know if you need to contact with PAN support to open an App-ID BUG.

In the mean time, you may also try app-override once.

Thanks

[jharlow]

Did you ever get this one resolved?  I have a newly configured PA-500 and noticed the same issue for our iSCSI traffic. It is a Dell EqualLogic. There is already a Application ID for iscsi for tcp/3260; however in our QoS reports it is shown as unknown-tcp

[pulukas]

For traffic like iSCSI your best bet is to get this into a segregated vlan that does not transit routers and firewalls if at all possible.

If it must transit the PA, create an application override to improve performance and insure there is a little latency as possible on this traffic.

[jharlow]

Hey Steven,

iSCSI traffic has been segregated into its own network (own switch); however, we do send bits over our firewall/routers for replication. The traffic is coming and going between our network here and our offsite location.  As one could imagine, this data is appearing in all of the reports and typically on the top5 due to the about of bits being sent offsite (for DR).