Traffic not in logs but in Packet Capture

[jeff6strings]

I'm having issues with my garage door opener thru my PA 220 FW, v9.1.6, with the latest dynamic updates.

It uses DNS and TCP 8883 to communicate to the MyQ servers. In Monitor>Logs>Traffic, I can see DNS traffic from the opener to 8.8.8.8 with return bytes, but no other traffic. In Session Browser, I see the 8883 traffic but hitting the Interzone Default policy. This is strange as other devices are on the same network/zone and working fine. In a packet capture of traffic from the opener, I see the 8883 traffic in the receive, transmit and drop stages.

At the time of this post, I'm still troubleshooting connectivity but maybe Security Policies just for the opener and specifying DNS and 8883 in their own policies may have helped.

I'm curious why I can see traffic in the Logs>Traffic for all other devices and only DNS for the opener but not the 8883 traffic?

Thanks for any input.

Jeff

[BPry]

@jeff6strings,

By default the firewall will not log traffic hitting the intrazone-default policy, so you'll want to override that to actually enable logging if you want to log traffic hitting it. The reason the traffic is getting denied is likely because you don't have a matching security entry for this traffic. 

Create a service object for 8883/tcp and use it to allow the traffic explicitly on your PA-220. See what app-id is identified (likely ssl) and then add said app-id to the entry you just created to allow the identified application over what will likely not be a default port. 

[jeff6strings]

@BPry 

The Interzone Default makes sense.

There is only one Security Policy allowing all from trust to untrust, so not sure why it was hitting the Interzone Default policy.

I created a service TCP/8883 and applied it to a Security Policy with the garage opener IP and zone as the source, untrust as the dest zone, and this service. I cloned that for DNS, though I didn't need to. No changes to NAT policies.

After creating the Security Policy with the 8883 service, the MyQ management worked.

Thanks.

Jeff

[mhannan313]

Facing a similar issue here: https://live.paloaltonetworks.com/t5/next-generation-firewall/packets-retransmission-captured-in-pac...

Any recommendations?