08-19-2013 10:28 AM
I have permitted apple-updates and users have confirmed that they are able to perform their updates. However, a user in is unable to perform updates as it appears that he is being blocked.
All our firewall and filtering is carried out by PAN and I am usually view traffic from a user's PC computer and figure out what is being blocked by the one of the Palo Altos. However, in this case I am unable to see traffic sourced or destined from his iMac. Yes he is connected to our network (connected concurrently to our wireless and wired networks) and to no other. When I go into Panorama and look at the traffic logs I do not see any traffic at all to or from his iMac. Yes, he is able to browse but I am not able to see his traffic. I am only filtering for his IP address.
Any ideas as to how or why the I am unable to see his traffic?
08-19-2013 10:45 AM
To be sure check for policies if logging is enabled for related rule(s) or not
also for deep investigation you may take packet capture to see if that ip traffic comes to firewall or not.
also look directly to device(or context) not panorama.
08-19-2013 11:01 AM
You can do the following inorder to verify if the traffic is coming to the firewall and is getting blocked
1. Need to setup the filters for the traffic you are interested in. To do this, execute the following steps:
Navigate to Monitor--Packet Capture
Click 'Manage Filters'
Set Filter ID 1 to be the source IP and destination IP of traffic you feel is affected ( leave all other fields blank )
Set Filter ID 2 to be the exact inverse of what you did in step 3 (destination IP in source field, Source IP in destination field)
2. Setup up the captures
Create and name the file stage for a packet capture on all the stages (receive, transmit, firewall and drop)
3. Enable filters and captures
debug dataplane packet-diag set filter on
debug dataplane packet-diag set capture on
4. open 2 CLI windows
on 1 run the following command to look at the counter ( make sure to run this command once before running the traffic)
show counter global filter packet-filter yes delta yes
on the 2nd window run the following command to look at he sessions
show session all filter source <ip address> destination <ip address>
if you dont have the destination that is fine just leave the above command till source
After your test has been done stop all the captures and filters and see if global counter show you anything why it is dropping the traffic or if you have getting pcap with drop stage.
This will help you narrow down the issue.
Let us know if this helps you resolve the issue.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!