Traffic with no data (???) is denied

[ldormond]

Hello,

I have a PA 2050 device that is configured to allow specified traffic (multiple rules) and one rule that deny all other traffic (at the bottom).

When looking at the "Deny all" rule, I can see a lot of packets that should be allowed by specific rules above that are denied with no data (see screenshot bellow). Is it normal ? And what does it mean that some packets have no bytes received and no bytes sent ?

Regards,

Laurent

[rmonvon]

Yes, that is normal behavior.  Your PA2050 will drop all packets that do not meet your explicitly allowed rules.  Those packets may be the 1st SYN packet of a TCP handshake where the byte count is recorded as zero.

An explanation can be found here:

https://live.paloaltonetworks.com/docs/DOC-1549

Thanks.

[ldormond]

Hi,

Thanks for your answer, however if you look at the "application" collumn, you can see that this is not one of the three definition tht you provided me, but "unknown-tcp".

Furthermore, as I said in my first post above, there are explicit specific rules for this traffic.

Regards,

Laurent

[rmonvon]

Hi Laurent...My previous post was to answer the app=not-applicable where  the bytes=zero.  Unknown-tcp means the TCP traffic does not match any of our AppID signatures so the application is unknown. 

Tthe traffic must have matched the  TCP/UDP ports for your explicit rules but it does not match the  applications that you specifically defined in those rules.  However, the PA device does not have an app signature for the traffic and classified it as unknown-tcp.

Thanks.