Many government sites are not opening on paloalto networks. Same is opening on outside network

[SankalpS]

Many government sites are not opening on paloalto networks. Same is opening on outside network. Please suggest

[kiwi]

Hi @SankalpS ,

You're not giving us much to work with.

What do you see exactly ? Is there a time-out or other error message ? Is your policy allowing it ? Do you see the connection attempt in the traffic logs ? Are you using decryption ? If so, is it being decrypted properly ? Do you see any drops in global counters when trying to access the websites ? Which platform and PAN-OS version are you using ?

Kind regards,

-Kiwi.

[SankalpS]

Getting site cant reached message when we try to open indian government sites link morth.nic.in. Also we try to by removing ILL cable from firewall and directly connecting to laptop then sites works.

Our many customers are facing this issue for last two days. 

[RVLINFRASEC]

We also faced same issues. Example of Govt Site

https://cea.nic.in/

https://cercind.gov.in/

https://powermin.gov.in/

https://npp.gov.in/

https://recindia.nic.in/

Software Version 10.1.5-h2

Deployment: Vwire Mode

Once we removed palo-alto firewall from network, start opening the site. Log saying "Aged-out"

Appliance Model 850.

[OtakarKlier]

Hello,

If you are using SSL decryption, set the government and military URL filter to bypass decryption. Many of these sites dont like to be decrypted since it looks like a man in the middle attack. While it is man in the middle, its not an attack.

Hope this makes sense.

[RVLINFRASEC]

Nop, We are not using any decryption functionality in our appliance. Without SSL encryption/Decryption its not working, Whereas same traffic through checkpoint firewall working perfectly.

[aleksandar.astardzhiev]

Hi @SankalpS , @RVLINFRASEC ,

Have you done any troubleshooting on the firewall? Can you provide some output:

- Are you using URL filtering?

-  Does your URL and DNS security licenses are still active?

- Check one of the problematic sites how firewall is categorizing it. Connect with SSH to CLI and use the following command:

> test url <url>

> test url-info-host <url>

Replace <url> with the address you want to test. What is the output? What action is set for the same category in your URL filtering profile?

- Search URL logs (Monitor -> URL) for one of the problematic URLs. Do you see any logs? What action is seen in the logs?

- Resolve one of the problematic sites (with nslookup for example), search this IP in the Unified logs (Monitor -> Unified). Do you see any deny/block? Check one of the traffic logs - what is the "session end reason"? Is the counter for bites received different than zero?