Telegram website is not accessible

[MohamedSharief]

Hi,

I've one client that cannot access https://telegram.org but he can access all other https website.

We tried to use a security rule with one source address and any any allow but still the same.

In the traffic monitor we can observe the session end reason is aged-out.

We are not using any ssl decryption rule.

Regards,

Sharief

[pulukas]

A session that is "incomplete" along with "aged-out" typically indicates a fundamental network routing problem between your client and the site in question.

https://live.paloaltonetworks.com/t5/Management-Articles/Not-Applicable-Incomplete-Insufficient-Data...

One of the most common issues with this would be asymmetrical routing for the path.  But basically the 3 way handshake is not completing or there is no data transmited through the PA after the handshake at all.

[TranceforLife]

Hi,

You are not getting anything back from the website or even not reaching it as 0 bytes received. Are you able to ping a website from the firewall external (NAT IP 37....)?

Thx,

Myky

[MohamedSharief]

Hi pulukas,

If I bypassed the firewall I can connect normally to https://telegram.org

The question is why the firewall is not able to complete the 3 way handshake?

Hi MyKy,

Tried that also but no echo reply.

Regards,

Sharief

[TranceforLife]

Hi,

I don't think it is a firewall issue, as the firewall sends the packets but not receiving anything back. You could run a PCAP on the firewall to get more details and if you are actually getting SYN-ACK packets back:

https://live.paloaltonetworks.com/t5/Management-Articles/Using-Packet-Filtering-through-the-WebGUI/t...

How do you get to that website from the firewall (your routing l mean). When you bypassing the firewall what is you default gateway, same as on the PA box. Funny that this happens only for one destination.

[MohamedSharief]

Hi TranceforLife,

You're correct! The firewall doesn't receive a SYN ACK packets when I checked the pcaps taken from firewall. Still its a weird issue cause its happening for only one website!

When I performed fib lookup I got the following:

btcuser@HO-PALOALTO-FW1(active)> test routing fib-lookup ip 149.154.167.99 virtual-router "Perimeter VR"

--------------------------------------------------------------------------------

runtime route lookup

--------------------------------------------------------------------------------

virtual-router:   Perimeter VR

destination:      149.154.167.99 (Telegram website)

result:          

  via 37.216.237.xx1 interface ethernet1/1, source 37.216.237.xx2, metric 10

--------------------------------------------------------------------------------

And the internal gateway (Cisco router) IP address is 37.216.237.xx1

When we connect directly the gateway of the test PC will be Cisco router IP address.

Regards,

Sharief

[santonic]

When you bypass FW you have different source IP address? The telegraph.org server has your PA IP address on block list?

Sometimes a paranoid server or some other security device can block anIP if there are too many connections coming from it which would be the case with default NAT address.

[MohamedSharief]

Hi santonic,

Really interesting point you have here mate. Let me check on this also.

Regards,

Sharief

[MohamedSharief]

Hi,

The client updates me that Telegram website is working now, without any changes in the configurations and that indicates the issue is not from firewall, maybe the router or ISP.

Anyways, if the issue arises in the future we will do the following:

We will add an unused public IP address on outside interface and NAT the test machine with it and try accessing Telegram website to see if its working or not. This way we can find if it was really block by telegram or not.

Regards,

Sharief