incorrect destination zone in threat logs

JuergenHolzer — Wed, 03 Jun 2020 11:57:31 GMT

Hi,

if the firewall is configured with zone protection profiles and the setting "set system setting additional-threat-log on" is configured, i have noticed the destination zone is not correctly (in my example 8.8.8.8 is reachable over the outside zone) displayed in the threat logs:

I noticed it with version 8.1.8, 9.0.8, 9.1.2.

Does anybody has an explanation for it?

Re: incorrect destination zone in threat logs

mivaldi — Wed, 03 Jun 2020 16:28:02 GMT

It is possible that the firewall is taking a discard action early, before policy-lookup, where the destination data in the packet is evaluated. Open a Support case to get additional insight.

topic Re: incorrect destination zone in threat logs in Advanced Threat Prevention Discussions

incorrect destination zone in threat logs

Re: incorrect destination zone in threat logs