Yes, I know this session was port 5671. But he said all traffic to internet stops. So i was asking about a port 80 which is more likely to be allowed somewhere than port 5671.
TCP handshake didn't go through in this case as only 1 packet was seen, most likely SYN.
Application default port for TOR is TCP/dynamic. So no matter what the service setting is in the rule, PA will have to allow all TCP ports.
Ok, i didn't notice "interzone-default" in related logs so far. But even if this is a connection related to one of the sessions correctly recognised as TOR and dropped, it still doesn't explain why all traffic to internet stops.
... View more
