Packet drops with Unknown-TCP

[Sanjay_Ramaiah]

Hi Team,

Need your suggestion on below. We have created a policy to allow access to a site with URL filtering.

Created new category to the specific set of URL and then allowed the same in URL Filtering Profile and called the same in ACL. Source is set to LAN Range, Destination is set to Any, Application is set to Any, Service is set to Any, URL Category is set to the specific category, Action Allow.

So while users try to access the URL i can see Insufficient data(App) is hitting the correct rule though, and then Unknown-TCP(App) hitting the interzone-default rule and getting dropped.

As per my understanding the packets should hit the rule i created as i have allowed Any application but it is being denied by default rule. I run the packet capture i can see some of the packets are getting Reset.Not understanding what could be the reason. I went through the below KB

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC#:~:text=Unknown%2D....

Though it is relavent not giving enough info to solve this issue. Please suggest how i can proceed further.

[BPry]

@Sanjay_Ramaiah ,

Something isn't matching and the interzone-default policy is likely preventing you from identifying what it is. I would create a temporary rule at the bottom of your rulebase allowing all traffic from a test machine and attempt the same process again. Ensure that you have logging fully enabled on your temporary policy and that you have a URL profile that has every single category set to at least alert.

Once they run a test and it's functional, you'll want to review ever everything hitting the temporary rule and identify the traffic that is catching that policy. In the logs you'll be able to identify something that isn't matching your URL category you've created for some reason.

[Sanjay_Ramaiah]

@BPry Thanks for the response. 

But when we allow IP it is working fine 😞 Also i can see the URL filtering rule is being hit. And i allowed Any service Any application. I can see RST when i run the debug.

[Sanjay_Ramaiah]

Anyhow i wil try this suggested idea @BPry Will keep you posted.