thanks for posting.
I would recommend to review traffic and security logs from: Monitor > Logs > Traffic / Threat to confirm exact reason for traffic to be denied / dropped. If you confirmed that vulnerability signature is causing an issue, here are 2 KBs for applying an exception either on signature or IP address level:
If you believe this is a false positive, you can reported: How to Submit a Vulnerability Signature False Positive
Thanks for the reply, PK.
This is strange. The Traffic logs report that the traffic is allowed, but I'm getting nothing but RST, ACK (with no connection), allegedly from the server.
The server, though, shows that it's listening on ports 8080 and 8443. I'm second-guessing my theory that the problem is Vulnerability protection. As I research, APP-ID could also be the problem, but again, all traffic is "allowed" in the traffic logs and isn't present in the Threat logs.
Any help here would be appreciated.
I assumed the problem was vulnerability protection because a profile is attached to the policy, but I see nothing in the traffic or threat logs indicating this.
thank you for reply.
To eliminate assumptions, could you check Unified logs with server's IP address in filter from: Monitor > Logs > Unified? Unified logs have all log types in one screen.
If it is possible could you take a packet capture from server? Also if it is possible could you temporarily take vulnerability profile out of the policy and test connection?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!