Packet Deny even if there is an allow rule

[jguffroy]

Hello,

we're encountred an issue with SAAS service, we created a security rule 

but randomly we had issue during connection into the application, after packet capture, I saw a lot of tcp retransmission and client reset

When I checked the panorama logs I saw that the rule is not matched and flow is denied but I dont understand why because the security rule should be enough permissive.

Did you already encountred this issue ?

thank you for your feedback

[PavelK]

Thank you for the post @jguffroy

Based on screen shot you supplied it is not clear what the root cause is. Would it be possible to navigate in the log to very left side and click on magnifying glass, get session ID from denied and allowed log, then navigate to Firewall's CLI and check/compare details of each session?

show session id <session id>

Kind Regards

Pavel

[MP18]

@jguffroy 

If you have FQDN as destination address then that can be issue if IP changes on the url and PA it is not refreshed.

Default FQDN timer is 30 mins.

You can click on Destination address under address and then click on FQDN to see which IP it resolves and compare it with the

deny rule.

You can also refresh the fqdn so it learns the new ip of the fqdn

Regards

[MP18]

@jguffroy 

Also check this url

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHJCA0

Regards