the destination port is 5671, the session id is 0 and the associated log is interzone-default (at the bottom of the log screenshot): this session is being dropped because there is no application rule that allows this traffic, but the tcp handshake is being allowed because the service in the TOR policy is set to any instead of application-default, that is also why the log is showing up because that rule has logging enabled
Yes, I know this session was port 5671. But he said all traffic to internet stops. So i was asking about a port 80 which is more likely to be allowed somewhere than port 5671.
TCP handshake didn't go through in this case as only 1 packet was seen, most likely SYN.
Application default port for TOR is TCP/dynamic. So no matter what the service setting is in the rule, PA will have to allow all TCP ports.
Ok, i didn't notice "interzone-default" in related logs so far. But even if this is a connection related to one of the sessions correctly recognised as TOR and dropped, it still doesn't explain why all traffic to internet stops.
if the session was identified as Tor, the log should also indicate that... a show counter global could be useful to see if there is a system level drop reason, maybe a LAND attack due to some NAT rule we're not aware of... I tried replicating the config in my lab but can't get it to break
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!