topic Security Policy in Next-Generation Firewall Discussions

Security Policy

srikarpuligandla — Sun, 03 Dec 2023 18:21:45 GMT

Hello,

I have created a security policy with the below details. I am the hitting following URL https://10.x.x.x:15671 and I see the 'connection is reset' in the browser. I see traffic is hitting the policy (Hit count) but it's not logging. When I set the action to Deny/Drop/reset-client\reset-server the traffic is logging when hits the rule. What could be the reason why traffic is not logging for action 'Allow' and why traffic is not passing through?

Application - Any

Services - Application default

Action - Allow

Logging - Log st session start and end

Thanks,

Srikar

Re: Security Policy

reaper — Mon, 04 Dec 2023 13:43:31 GMT

Your service is set to application default while you're using port 15671 for ssl traffic (default port 443)

This means you will not be using this security rule to handle the traffic. You're most likely dropping down to the default intrazone deny rule, which has logging disabled

reason you're seeing the hit counter increase is when the SYN paxcket arrives there's no app-id yet, so no default port to enforce, the policy match goes by the 6tuple (source zone, source ip, destination zone, destination ip, destination port, protocol)

since you have an any any rule, the syn packet is allowed through until app-id kicks in, the rulebase is chcked again, this rule no longer matches and the next best match is de default rule

Re: Security Policy

srikarpuligandla — Thu, 07 Dec 2023 05:00:27 GMT

Thank you @reaper