topic Re: Intrazone rule - Can`t ssh in Panorama Discussions

Intrazone rule - Can`t ssh

Richard_M — Thu, 17 Aug 2023 08:48:06 GMT

Hi,
We have a case where a person is trying to ssh from zone "Safe" to zone "Safe". The src (a backup orchistrator) and dst (a compute) are though in different subnet. In this case he is not able to connect, but can ping.
As I understand since the src and dst ip addresses are in the same zones, this traffic is going through the Intrazone rule, and should therefore be allowed?

Does anyone know if there could be anything in the fw I need to check or is the problem another place?

Re: Intrazone rule - Can`t ssh

ozheng — Thu, 17 Aug 2023 09:40:15 GMT

Hello Richard_M,

Can you enable the logging at session end for all rules including the default rules?
Once it is done, you can check in the traffic logs which rule is blocking the traffic.

Also I invite you to read/listen this PANCast Episode about the security rules.

Olivier

Re: Intrazone rule - Can`t ssh

Richard_M — Thu, 17 Aug 2023 10:37:43 GMT

Hi @ozheng
The logging is already enabled with "Log at Session End". In the traffic logs I can't see any log of either ssh or ping, even though it is reported that the ping is going through.

Thank you the link!

//Richard

Re: Intrazone rule - Can`t ssh

ozheng — Thu, 17 Aug 2023 12:20:31 GMT

Hello Richard_M,

OK, on the firewall, you set a filter on the source/destination (and return traffic).

You turn the filter on.

You set the capture (1 distinct name for each stage).

You turn the capture on.

You initiate the SSH traffic.

You refresh the page on the firewall.

You see if there is any file for the drop stage.

If there is no receive file, the firewall is not even receiving the packet.

If there is no drop file, the firewall is not dropping the packet.

Olivier

Re: Intrazone rule - Can`t ssh

TomYoung — Thu, 17 Aug 2023 12:24:37 GMT

Hi @Richard_M ,

Is SSH allowed in your Interface Management Profile applied to the "safe" interface?

Thanks,

Tom

Re: Intrazone rule - Can`t ssh

Richard_M — Fri, 18 Aug 2023 06:15:14 GMT

Hi @ozheng

Didn't receive any files when I ran the packet capture while ssh was in being run. Have asked the person to look at their config again.

//Richard

Re: Intrazone rule - Can`t ssh

ozheng — Fri, 18 Aug 2023 06:48:09 GMT

Hello Richard_M,

If there was no file captured, then the packets were not seen on the firewall.

By the way, don't forget to disable the capture (I forgot to mentioned in my previous message).

Olivier

Re: Intrazone rule - Can`t ssh

Richard_M — Fri, 18 Aug 2023 07:02:14 GMT

Hi @ozheng
Thank you for your help. I read that it was needed to turn the packet capture off, so that is done 🙂

Re: Intrazone rule - Can`t ssh

Richard_M — Fri, 18 Aug 2023 07:17:41 GMT

Hi @TomYoung
It seem that Ping is the only one check for in the Interface Management Profile applied to that interface.
But since the ssh traffic is not droped or received when running the packet capture there should be an issue at the source side?

I have to look more into if ssh should be allowed at that Interface Management Profile.

//Richard

Re: Intrazone rule - Can`t ssh

TomYoung — Fri, 18 Aug 2023 12:34:51 GMT

Hi @Richard_M ,

Sorry! I thought you were trying to SSH to the IP address on the NGFW of the safe zone. If you are trying to SSH to the NGFW, then you need to enable it in the management profile.

With regard to your issue, is the traffic going through 2 interfaces in the same zone on the NGFW?

Thanks,

Tom

Re: Intrazone rule - Can`t ssh

Richard_M — Fri, 18 Aug 2023 13:44:06 GMT

Hi @TomYoung
I don`t see the that specific traffic in the logs, but when I search for the src and dst ip`s one by one (with other ip addresses in the other end) in the traffic log, they both use the same interface.

//Richard

Re: Intrazone rule - Can`t ssh

TomYoung — Fri, 18 Aug 2023 14:00:29 GMT

Hi @Richard_M ,

If both IP addresses are on the same subnet, they will talk directly to each other and not go through the NGFW. Your SSH issue is a problem with the hosts, and not the NGFW.

Thanks,

Tom