What Does Application Incomplete Mean On Palo Alto?

What Does Application Incomplete Mean On Palo Alto?

Palo Alto firewalls flag traffic as Incomplete when session logs show a TCP or UDP connection that never produced usable application data. As of 2026, this remains one of the most common head-scratchers in Traffic logs—traffic appears to flow, but the firewall can’t identify what it is. Here’s the straight-shot fix and every fallback you’ll need.

What’s Actually Happening Here?

When Palo Alto logs show “Incomplete” in the Traffic log, two things usually explain it:

• The TCP handshake never finished (SYN, SYN-ACK, ACK never completed).
• The handshake finished, but neither client nor server sent enough data for App-ID to fingerprint the app.

As of 2026, the firewall still uses App-ID v3.0 signatures. Any flow delivering fewer than the minimum signature bytes (<128 B for TCP, <64 B for UDP) gets tagged “insufficient-data,” which shows up in the GUI as Incomplete in the App column.

How to Fix It, Step by Step

1. First, confirm the traffic is real

   • SSH into the firewall or open the CLI tab in the web UI.
   • Run show session all filter field app incomplete.
   • Note the Source Zone, Destination Zone, Source IP, Destination IP, Destination Port.

2. Check if the port is the problem

   If the destination port is a well-known one (80, 443, 3389, 5432, etc.) but the app is still unknown, the handshake may be completing while the payload stays too small.

   • Go to Objects → Services → Add.
   • Name it: Service-Override-Port.
   • Set Protocol to TCP or UDP.
   • Enter Destination Port: 80 (example).
   • Leave Source Port blank.
   • Click OK and commit.

3. Create an Application Override rule

   This tells the firewall, “Trust the port—don’t bother fingerprinting.”

   • Head to Policies → Application Override → Add.
   • Name it: AO-Port.
   • Pick the Source Zone where traffic enters.
   • Pick the Destination Zone where traffic exits.
   • Set Source Address to any.
   • Enter the server IP or range under Destination Address.
   • Choose the Service object you just made in step 2.
   • Set Action to Allow.
   • Use None for Profile Type (or your usual profiles).
   • Commit.

4. Increase the session timeout

   If the traffic is legitimate but slow to start (think MQTT keep-alive), give it more time.

   • Navigate to Device → Setup → Sessions → Session Timeout.
   • Change TCP/UDP Timeout from 30 to 60 seconds.
   • Commit.

Still Stuck? Try These Next Steps

• Look for asymmetric routing

  If packets take different paths in and out, the firewall never sees the SYN-ACK or data. Run show session all filter field src-addr client-ip and check the egress-interface column. If it’s different from the ingress, fix the routing or add a policy-based forwarding rule.

• Fire up a packet capture

  If you’re still unsure whether the handshake completes:

  • Go to Device → Packet Capture → Add.
  • Name it: TCP-port.
  • Set Type to Layer-3.
  • Pick the ingress/egress interface.
  • Use this filter: host client-ip and host server-ip and port port.
  • Capture for 30 seconds, stop, and download the .pcap.
  • Open in Wireshark, filter tcp.port == port, and look for SYN, SYN-ACK, ACK.

• Lower the App-ID signature threshold

  For custom or proprietary apps, you can relax the rules:

  • Go to Device → App-ID → Advanced → Minimum Bytes for TCP/UDP Fingerprint.
  • Change TCP from 128 to 64, UDP from 64 to 32.
  • Commit and test.

How to Keep This From Happening Again

Tip	How to Do It
Standardize ports	Document every internal service on one port only (e.g., web on 80, API on 8080). Use Objects → Services so every firewall rule references the service object instead of raw ports. Honestly, this is the best way to avoid “Incomplete” headaches.
Enable HTTPS decryption	Without decryption, App-ID only sees TLS handshake bytes. Turn on Device → Certificate Management → SSL Decryption globally and install the forward-trust certificate on clients. As of 2026, TLS 1.3 is everywhere, so make sure PAN-OS 11.0 or later is running.
Turn on App-ID acceleration	Enable Device → Setup → Content Inspection → Accelerate App-ID. This keeps signature hashes in hardware, cutting CPU load and speeding up identification.
Watch with a Security Policy	Add a rule at the bottom of your policy stack: Deny any application “incomplete”. This flags misbehaving hosts fast without blocking legitimate traffic once you’ve fixed the root cause.