PA sending TCP RST

[Jakub_Kopka]

Hey folks,

I've run into a following issue. We have a Juniper MAG box communicating with a web server and a rule in place allowing this communication (source Juniper, destination any production IP, on any port). I can also see in the traffic log that the communication is accepted. However when I did a packet capture on the FW I saw the following:

Receiving capture:

Transmitting capture:

Any idea why is this happening or what I am missing?

Thanks

[pulukas]

On the monitor tab, filter the threat logs and the url logs for these ip addresses and see if there are any hits.

[Jakub_Kopka]

Hi Steven,

not for this traffic.

[pulukas]

Then I would open a support case.  When the PA generates a reset we should have a log from the process that is creating the reset.

Here your policy, threat and url logs are clean so it would appear that this is a bug that needs to be investigated.

[SteveMc · Accepted solution]

Hi Jakub

Are you running AppID version 482-2533? Try rolling back to a previous version, we had a similar issue

Cheers

[Jakub_Kopka]

Hi,

Thanks. This has helped.

edit:

It's a bug - should be fixed in PanOS 6.1.3 with the AppID 482.