03-02-2021 07:25 AM
Does anyone have following experience and could give me some idea to fix this issue?
Thanks a lot ~
I found sometimes the traffic log shows that traffic match allow policy but the result was reset by default deny policy.
I have a policy for allow some users to access TCP 58975.
I checked traffic log and I found traffic be reset by interzone-default during 2/11 08:07:16 to 2/12 08:02:31
I already checked threat log and there is no log about drop or reset for this traffic.
And I checked configuration log and there is no change record.
I have a clue, this PA-3020 update apps-content everyday at 8:00.
Traffic begin reset at 2/11 08:07:16 that just update to 8374-6528.
And after 24 hours traffic be allow at 2/12 08:02:31 that also just update to 8375-6541.
But I'm not sure is it can cause this problem because I think the policy allow any application so it should be allow if traffic match L3 to L4 rule. And I'm not sure that always happen after apps-content update in the first few times.
I have open a case but support says they need capture packets or they doesn't have enough data to analysis this issue.
That is problem because I can not reproduce this situation.
PAN-OS : 8.1.16
03-04-2021 08:30 AM
This is interesting..
I see what you mean in your rules, dropped for about 24 hours.. then allowed again.
- Is this constant? or was this a one time event?
- Have you seen this before?
- It looks like you are just using Services and not apps? have you tried creating a custom app for this and allowing that application? Not sure that would matter.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!