Strange behaviour web-server through PA

Reply
Highlighted
L4 Transporter

Strange behaviour web-server through PA

Hi,

 

We are having strange behaviour going to a web server behind PA. Several clients report that they can not access to this web server. In the pcap we can see that the tcp-rst is sent from client. We suspect that the issue could be in PA or any ISP issue.

Issue happened after upgrading to 8.0 version. any change behaviour?

 

If those clients use the TOR network the web is opening properly.

 

The infrastucture is RouterInternet -> switch -> Palo Alto -> switch -> F5.

 

Router_ISP pcap. We can see the how the connection is established and the get for the web server.

 

Router.JPG

Palo Alto Pcap. We can see the conection but not the GET web.

 

PaloAlto.JPG

 

We tried to create app override and try to avoid Layer 7 filtering with no success.

 

Why could it be happen?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!