Palo Alto blocks outbond cisco any connect traffic

[SachinA]

Hi , 

i a new to Palo alto world. one of my user is trying to connect a VPN connection using anyconnect, but it not working when traffic is passing from palo alto, but when i access it from open internet it is working fine.

Prompt response will be highly appreciated. 

[OtakarKlier]

Hello,

Its best to check the logs to see why its getting blocked. My guess would be the application is not allowed. Here is the application grouping I allow:

Regards,

[SachinA · Accepted solution]

Thanks for reply. i am able to get it fixed. 

for everybody information Palo has issue while working with Cisco anyconnect in decryption the traffic.

So i bypass the decryption and restrict the traffic based on decryption policy.

Thanks 

[Nehmaan]

You just have to "No-Decrypt" the following two categories. 

Within Anyconnect if you use:

IP: Unknown Category

DNS: Low-Risk Category

[gdu_palo]

Could you please write the solution with details?

[acsebav]

You need to allow CISCOVPN, SSL and DTLS traffic outbound from IP-devices (not from private IP CiscoVPN).

[gdu_palo]

I did it. Also, I added all VPNs to the application list in the rule to grant access. But nothing changed, and they could not connect.