Not-Applicable, Incomplete, Insufficient Data in the Application Field

[jaimegarcia714]

We're having issues with regards to VOIP on a Shoretel system.  We have a Site2Site connection back to our HQ office and our phone system is down.  When I take a look at the logs, I see Insufficient data and imcomplete in the application field.  Can someone point me in the correct direction and solution?

[OtakarKlier]

Hello,

In my experience this is due to a routing issue. What the firewall is saying is that there were not enough packets for it to determine what it actually was.

Regards,

[jaimegarcia714]

Thanks, 

where do I go from here?

[BPry]

@jaimegarcia714 ,

Verify that you can actually route to the system (ICMP, MGMT access, something) to see if you are even reaching the system and receiving return traffic. This could also be verified by looking at the detailed log view in the bytes sent, bytes received field. Also, might be a good idea to verify that your tunnel is actually up if it was working previously and just stopped. 

[sandor.alonso]

I'm also having Connectivity issues with Shoretel system.  I have a hybrid network some sites are IPSec site 2 site connection back to our Data Center (Hub and Spoke) and some are MPLS.  Is there a best practice or standard when setting up Palo Alto's with Shoretel systems?

Any help will be greatly appreciated.

Thank you!

[MP18]

As mentioned please check the routing both ways?

USe the test routing command from cli.

[jeremy.larsen]

What specific issues are you having?  Do you run into 1-way audio at all or will VOIP not pass period?

[sandor.alonso]

At times we would receive 116 error messages than see a bunch of red N squares in the Connectivity Map.  No problems with one way audio.  But want to see if there is a best practice I can reference from.