Telegram website is not accessible

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Telegram website is not accessible

L4 Transporter

Hi,

 

I've one client that cannot access https://telegram.org but he can access all other https website.

 

We tried to use a security rule with one source address and any any allow but still the same.

 

In the traffic monitor we can observe the session end reason is aged-out.

 

We are not using any ssl decryption rule.

 

PA telegramTraffic log.pngPA telegramTraffic log2.png

 

Regards,

Sharief

Regards,
Sharief
8 REPLIES 8

L7 Applicator

A session that is "incomplete" along with "aged-out" typically indicates a fundamental network routing problem between your client and the site in question.

 

https://live.paloaltonetworks.com/t5/Management-Articles/Not-Applicable-Incomplete-Insufficient-Data...

 

One of the most common issues with this would be asymmetrical routing for the path.  But basically the 3 way handshake is not completing or there is no data transmited through the PA after the handshake at all.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center

L6 Presenter

Hi,

 

You are not getting anything back from the website or even not reaching it as 0 bytes received. Are you able to ping a website from the firewall external (NAT IP 37....)?

 

Thx,

Myky

Hi pulukas,

If I bypassed the firewall I can connect normally to https://telegram.org

The question is why the firewall is not able to complete the 3 way handshake?

 

Hi MyKy,

Tried that also but no echo reply.

 

Regards,

Sharief

Regards,
Sharief

Hi,

 

I don't think it is a firewall issue, as the firewall sends the packets but not receiving anything back. You could run a PCAP on the firewall to get more details and if you are actually getting SYN-ACK packets back:

 

https://live.paloaltonetworks.com/t5/Management-Articles/Using-Packet-Filtering-through-the-WebGUI/t...

 

How do you get to that website from the firewall (your routing l mean). When you bypassing the firewall what is you default gateway, same as on the PA box. Funny that this happens only for one destination.

Hi TranceforLife,

 

You're correct! The firewall doesn't receive a SYN ACK packets when I checked the pcaps taken from firewall. Still its a weird issue cause its happening for only one website!

 

telegram diagram.jpg

 

When I performed fib lookup I got the following:

 

btcuser@HO-PALOALTO-FW1(active)> test routing fib-lookup ip 149.154.167.99 virtual-router "Perimeter VR"

 

--------------------------------------------------------------------------------

runtime route lookup

--------------------------------------------------------------------------------

virtual-router:   Perimeter VR

destination:      149.154.167.99 (Telegram website)

result:          

  via 37.216.237.xx1 interface ethernet1/1, source 37.216.237.xx2, metric 10

--------------------------------------------------------------------------------

 

And the internal gateway (Cisco router) IP address is 37.216.237.xx1

When we connect directly the gateway of the test PC will be Cisco router IP address.

 

Regards,

Sharief

Regards,
Sharief

When you bypass FW you have different source IP address? The telegraph.org server has your PA IP address on block list?

Sometimes a paranoid server or some other security device can block anIP if there are too many connections coming from it which would be the case with default NAT address.

Hi santonic,

 

Really interesting point you have here mate. Let me check on this also.

 

Regards,

Sharief

Regards,
Sharief

Hi,

The client updates me that Telegram website is working now, without any changes in the configurations and that indicates the issue is not from firewall, maybe the router or ISP.

 

Anyways, if the issue arises in the future we will do the following:

We will add an unused public IP address on outside interface and NAT the test machine with it and try accessing Telegram website to see if its working or not. This way we can find if it was really block by telegram or not.

 

Regards,

Sharief

 

Regards,
Sharief
  • 5674 Views
  • 8 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!