NGFW Blocking Router Login Traffic After Policy Update – Requesting Guidance

MaryBrown — Tue, 03 Jun 2025 11:14:44 GMT

Hi Community,

I’m reaching out for help with an issue I’m facing on my Palo Alto Next-Generation Firewall involving router login and network access control.

Issue:
After updating security policies to improve our network posture, I'm noticing that router login attempts (to internal and remote routers) are being blocked or timing out. These router connections were accessible before the policy changes. I’ve checked the logs and policy configurations but can’t determine what’s causing the problem.

Environment Details:

Model: PA-3220
PAN-OS Version: 10.2.x
Deployment Mode: Layer 3
Zones: Trust / Untrust
Services Involved: HTTPS, SSH (used for router login)
Devices Affected: Multiple internal routers (Cisco, Netgear)

What I’ve Done So Far:

Reviewed and reordered security policies
Verified that NAT rules haven’t changed
Checked traffic logs under Monitor > Traffic
Ran packet captures — sessions are initiated but drop after SYN
Tested access to router login pages from alternate zones — same issue

My Questions:

How can I accurately identify which policy is dropping the router login traffic?
Could the firewall's threat prevention or App-ID be interfering with router access?
Are there advanced diagnostic tools in PAN-OS I should use to trace this issue?

Any insights, especially from those who’ve handled similar router access issues, would be greatly appreciated. Let me know if I should provide config snippets or specific log entries.

Thanks in advance!
Marry Brown

Re: NGFW Blocking Router Login Traffic After Policy Update – Requesting Guidance

mshekh — Wed, 04 Jun 2025 08:04:24 GMT

Hi @MaryBrown ,

Thanks for info, you can try using the packet capture with specific filter and verify the global counters to see if there is a packet drop at firewall. Based on the counters you can troubleshoot further.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTJCA0

topic Re: NGFW Blocking Router Login Traffic After Policy Update – Requesting Guidance in Next-Generation Firewall Discussions

NGFW Blocking Router Login Traffic After Policy Update – Requesting Guidance

Re: NGFW Blocking Router Login Traffic After Policy Update – Requesting Guidance