FW (active)> show session id 2394622
Session 2394622
c2s flow:
source: 10.101.6.34 [INTERNAL2]
dst: 172.20.0.89
proto: 17
sport: 52125 dport: 5555
state: ACTIVE type: FLOW
src user: unknown
dst user: ee\ss
offload: Yes
s2c flow:
source: 172.20.0.89 [SERVER2]
dst: 10.101.6.34
proto: 17
sport: 5555 dport: 52125
state: ACTIVE type: FLOW
src user: ee\ss
dst user: unknown
offload: Yes
Slot : 1
DP : 0
index(local): : 2394622
start time : Thu Oct 31 16:30:53 2019
timeout : 30 sec
time to live : 28 sec
total byte count(c2s) : 1096464
total byte count(s2c) : 0
layer7 packet count(c2s) : 16345
layer7 packet count(s2c) : 0
vsys : vsys2
application : unknown-udp
rule : AVT
service timeout override(index) : False
session to be logged at end : True
session in session ager : True
session updated by HA peer : False
layer7 processing : completed
URL filtering enabled : True
URL category : any
session via syn-cookies : False
session terminated on host : False
session traverses tunnel : False
captive portal session : False
ingress interface : ae2.6
egress interface : ae2.20
session QoS rule : N/A (class 4)
tracker stage l7proc : ctd decoder bypass
end-reason : unknown
FW (active)> show clock
Mon Nov 4 10:12:36 PST 2019
And for whatever reason for this device 10.101.6.34 is seen as available to the server 172.20.0.89 for the application they are using, while all other are failing.