Website getting blocked

[MohammedAsik]

Hi Team

We have PA 220 firewall with 8.1.5 PAN os version.

We have tried to reach one particular website but its not reachable. When we checked the traffic logs that application was shown as "incomplete" and the end session reason was aged-out.

Note : Same website can be reached by external network.

For testing purpose, we have created one security policy on the top as below 

After that also particular  we are getting the same error "application incomplete" in the traffic logs.

We have took the packet capture and its received only RX and Firewall files. No drops and tranmit packet we are not found

As per the packet capture logs, Its send syn packets only. No SYN-ACK packets we are not received.

How to fix the issue? Please help us 

Regards

Mohammed Asik

[reaper]

hi @MohammedAsik 

If no syn-ack is received from the webserver, the problem will be on the outside of the firewall or on the webserver itself

one thing you can check is to verify that outbound NAT is being applied properly, so the server has the right IP to reply to

next, you could try traceroute to see if you are able to get to the server IP (there could be a routing or peering issue at the ISP level, or your IP could have been blacklisted on the server)

[MohammedAsik]

Hi Reaper

If no syn-ack is received from the webserver, the problem will be on the outside of the firewall or on the webserver itself

Answer : For your information, I can able to reach the same website from the external network (outside network). Through the palo alto firewall only I couldn't access the website.

Need to check with ISP side aslo and let you know.

Regards

Mohammed Asik

[Brandon_Wertz]

---

@MohammedAsik wrote:

Hi Reaper

If no syn-ack is received from the webserver, the problem will be on the outside of the firewall or on the webserver itself

Answer : For your information, I can able to reach the same website from the external network (outside network). Through the palo alto firewall only I couldn't access the website.

Need to check with ISP side aslo and let you know.

Regards

Mohammed Asik

---

<edit> @reaper  already came up with all my cool ideas.

[reaper]

But wait, theres more: when you set up packet filters for packet capture, make sure you set filters in both directions and both pre- and post nat. See if the sequence numbers pan out, and verify the server isnt requesting some weird parameters the firewall wont support. For example: is there a smaller MTU somewhere? You may need to enable TCP MSS to circumvent that (if so, check if the server gets the message and is not ignoring it) Double check if outbound NAT is alright, check if the IP can independently traced to your firewall from the outside (potential arp issues on outside)