topic Rule UUID mismatch in Policies and Traffic Logs/Discrepancy in Rule UUIDs within Traffic Logs and Policy in Next-Generation Firewall Discussions

Rule UUID mismatch in Policies and Traffic Logs/Discrepancy in Rule UUIDs within Traffic Logs and Policy

mohit-singhal — Mon, 29 Apr 2024 09:17:32 GMT

Dear Team,

We have 2 * PA-5250 Firewall Appliances configured in Active-Passive and managed by Panorama. PANOS version on both the firewalls and Panorama is PANOS: 10.1.12.

Issue:

I've noticed an inconsistency where the Rule UUID displayed in the Traffic Logs differs from the one shown in the actual Policy. Additionally, the Traffic Logs are associating multiple Rule UUIDs with a single rule. Excluding the correct UUID, various other UUIDs are appearing in the Traffic Logs.

Furthermore, when filtering the Traffic Logs by the correct Rule UUID, no traffic is displayed. However, if I filter by the rule name, traffic logs appear but with alternate UUIDs.

This issue is with the Active Firewall only while there is no issue in the Passive firewall.

For example:

Rule UUID in Policy: 48d8f35d-e9c9-4bed-9bc9-75317067bf7e

Rule UUID in Traffic logs: 7d379199-cccf-42ad-9979-2017e5a959d1
3c79c2c6-88e5-41cd-bc65-99d7b865d63f
e401849b-4eb2-4153-beb4-4d5f3c171048

Thanks in advance,

Re: Rule UUID mismatch in Policies and Traffic Logs/Discrepancy in Rule UUIDs within Traffic Logs and Policy

jfernandez1 — Mon, 29 Apr 2024 19:50:47 GMT

Hello Friend!

When rules are pushed from Panorama, they will all have the same UUID. However, rules created locally on a firewall will each have their own unique UUID. If you create a rule on a firewall after pushing rules from Panorama, the locally created rule will have its own UUID.

On the following Doc you can learn more about this: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/enumeration-of-rules-within-a-rulebase

Mark my comment as solved if you think this solves your query

Re: Rule UUID mismatch in Policies and Traffic Logs/Discrepancy in Rule UUIDs within Traffic Logs and Policy

mohit-singhal — Tue, 30 Apr 2024 00:44:32 GMT

Hi Jfernandez1,

Thanks for your response. I am aware about this concept, but the issue is not related to this.

Let me rephrase the issue:

For Example:

Rule Name: xyz/abc (Pushed from Panorama to the HA pair (Active/Passive).

Rule UUID visible in the Policy in both the Firewalls: 48d8f35d-e9c9-4bed-9bc9-75317067bf7e

Rule UUIDs visible in the Traffic logs for the same rule in the Active Firewall only:

7d379199-cccf-42ad-9979-2017e5a959d1
3c79c2c6-88e5-41cd-bc65-99d7b865d63f
e401849b-4eb2-4153-beb4-4d5f3c171048

The problem is exclusive to the Active Firewall; the Passive Firewall is functioning without any issues.

Issue is with all the rules configured in Active Firewall not with the specific rule.

I trust this clarification explained the issue clearly.