PA blocks outbound port 10443, doesn't show up in logs

[dclark1]

I have and external website that I need to access on port 10443: https://<public IP>:10443. The connection never completes and times out. 

If I pull the PA FW out and throw in an ASA, works just fine. The logs on PA don't even show port 10443 being accessed or logged.

No matter what log I check, I find nothing.

Any idea?

Thx

[bmorris1]

Hello,

Have you tried running a packet capture & global counters to check for any drops/reasons for drops? Is there any asymmetric routing in your network?

How to run a capture -

https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Run-a-Packet-Capture/ta-p/62390

Global counters -

https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Troubleshoot-Using-Counters-via-the-CL...

hope this helps!

Ben

[pankaku]

What's PAN-OS version on firewall?

Check the application and service tab. Try to make application as ssl and keep service as any. Check if works or not.

[santonic]

Are you logging everything? Find a rule that should allow or drop the mentioned traffic and see if it's set to logging.

[santonic]

Also make sure that your only drop rule isn't the implicit one: interzone-default. That rule doesn't log. I always make a default drop rule which logs above implicit rules.

[dclark1]

Good idea on the drop rule. It's a very basic setup, and all rules log start and end of session. Capture logs show retransmissions, and traffic is getting to device.

Additionally another app that uses SSL over a non stanard port also did not work. Swapped PA with an ASA and both apps worked.....definatley something on the PA.

INFO:

PA-VM-100

Pan-OS: 7.1.1

All other software up to date.

Thx

[santonic]

So did you find this traffic in logs? If all rules are set to logging then you must see it. If you still don't see it then it's dropped by implicit rule.

[dclark1]

Good call santonic on the deny rule.....it was getting caught in the implict rule. Adjusted regular rule and all is good.

Thx guys....

[santonic]

No problem.