1. Ensure the Traffic is Routed Through the Firewall

If you don’t see any logs for RDP or ICMP traffic, the firewall might not be processing these packets.

Verify that the traffic is actually passing through the firewall and not taking an alternate route (e.g., direct L2 switching or a different gateway).

2. Check for Security Policy Matching

Use the Test Security Policy Match tool in PAN-OS to see if the traffic is hitting the expected rule.

If the traffic is not matching your deny rule, it might be getting permitted by another rule lower in the rulebase.

3. ICMP and Ping Handling

By default, ICMP (ping) is often handled by a separate setting under Network > Network Profiles > Security Profiles > Zone Protection Profiles rather than the security policy.

Ensure your Zone Protection Profile is configured to block ICMP if needed.

4. Application Identification and Session Setup

Some protocols like RDP (mstsc) might not be identified immediately in the first few packets.

Ensure your rule is not limited to a specific application but instead set to "any" in the application field.

If using application-based security policies, try switching to a service (port-based) rule instead.

5. Check for Asymmetric Routing

If the firewall sees only one side of the communication, it may not properly detect or log the traffic.

Run Session Browser under Monitor > Session Browser to check if the sessions are established as expected.

6. Security Rule Logging and Logging at Session End

Ensure your deny rule has "Log at Session End" enabled so that all blocked attempts are visible in the traffic logs.

Would you be able to provide a screenshot of your security rule or clarify if NAT is involved? That could help narrow down the issue further.

topic Re: Security policies not working in Next-Generation Firewall Discussions

Security policies not working

Re: Security policies not working

Re: Security policies not working