URL problems

[Radmin_85]

hello.although the rule is set to allow any but in request to some web-sites  we can see such a problem.there is incomplete in application coloumn.i understand that it cannot pass  the three-way handshake.but why only with any sites?

[reaper]

is your source NAT being applied properly? have you already taken a packetcapture to see what is being sent out and if you are receiving anything at all?

on the firewall you can use this guide to set up packetcaptures. if no packets return you may need to go to the upstream device to see what happens there: Getting Started: Packet Capture

[Radmin_85]

it only happens with some of the web sites.not at all

[kiwi]

Hi @Radmin_85,

HTTPS sites only ?

Any specific drops seen in global counters ?

Cheers,

-Kiwi.

[Radmin_85]

yes 

https://actuarial-academy.com/

for example this site

[reaper]

Hi @Radmin_85

can you provide more information (packetcapture, global counters,...)

all we can determine from your screenshot is that at least a SYN packet was sent out and that the server did not send something back at an early stage of the session, but it either did not reply to the handshake or did not reply to the client hello, more information will help determine what could be the root cause