Meraki MS250-48FP Switch need help

[Shorrie97]

Hello guys

Back store on my job we have two websites our users can't access, this started 2 weeks ago. We are using Palo Alto firewalls. I'm been working with PA tech support they have tried all kind things on the firewall. Me and manager have done some troubleshooting as well. With have a Meraki MS250-48FP switch, with only router traffic inside interface. PA support thinks the problem is with the switch but we don't buy that. We have two internet providers, AT&T main provider and Comcast backup. I plugged directly into the comcast router was able to reach both websites, my manager connected his laptop to a mifi and was able to reach both websites, which makes think it has to be the router.

But I joined the community to see if there is a way to allow the website through Meraki switch then to get to the outside interface and by push the firewall? No answer might be no but we are trying to troubleshoot and get any help we can.

[Shorrie97]

Add-on to my first post. She read bypass the firewall.

[KarstenI]

Bypassing the firewall is nearly always a bad idea, also while troubleshooting. I would start with Captures (Wireshark/tcpdump) of the web-sessions. One capture for a working attempt and one capture with a failed attempt. Then compare these two captures if you spot something different.

Another troubleshooting: Have you tried lowering the MTU/MSS and try if the websites work with that modification? If it works, the PMTU discaovery could be broken in your environment..

[Shorrie97]

Hi Karstenl,

Thanks for responding. We have run some many packet capture, several inside the firewall, several in our switch and wireshark of course on the local pc. The website are not accessible they never load, so we can't get a good capture of it working. But we did capture a working website that use ssl like those two non-working website and compare those.

I we will give the MTU/MSS lowering a shot and update the board.

[PhilipDAth]

Can you ping the web site?

[Shorrie97 · Accepted solution]

Hello everyone,

Thank you for your help with this issue. We figured what was blocking those website. We have a device/service that monitors our network and does packet sniffing. Well it has a list that is called CountyKiller, it block urls from certain counties and Brazil is on the list and that's were the urls were coming from. So we got those website unblock. No one remembered that device is out there monitoring our network.

Thanks again for helping me out.

[KarstenI]

You should rethink of and reevaluate your complete network and your security-strategy. If no one is aware of this device, it was probably never updated and could also be a thread to the network. And if there is a device no one is aware of, it is not your network any more ...