topic Re: Log entry - packet count in General Topics

Log entry - packet count

adamszabo — Thu, 24 Aug 2023 17:41:00 GMT

Hello LiveCommunity,

I have a, hopefully, quick question regarding traffic log entries and packet counts.

What if: there is a security policy which has the action set to "Deny" and the application to traceroute (or anything else but the "send ICMP unreachable" box is ticked); when a packet is received that matches this "Deny" policy and the firewall sends the unreachable, will I see 1 packet received and 1 packet sent in the traffic log? Or to re-phrase: does the "ICMP unreachable" packet that is sent by the firewall appear in the logs/counted as a session-related packet?

Thanks for your answer!

Re: Log entry - packet count

Claw4609 — Fri, 25 Aug 2023 12:39:29 GMT

I would think so but not entirely sure. What are you looking to achieve with this information? Something to note as well, some traffic can still be passed on a deny rule if application identification is needed to make a policy decision.

Re: Log entry - packet count

adamszabo — Fri, 25 Aug 2023 12:47:31 GMT

I'm just curious as I don't really know the exact answer. I know that PAN-OS for certain apps in needs more than one packet. But will the firewall's "ICMP unreachable" packet appear in the packets sent column? So, A sends a ping to B but the firewall denies the traffic based on src IP + dst IP (doesn't even matter the app); the send "ICMP Unreachable" option is ticked - so in the traffic log I'll see that A sent 1 packet: will I also see that it received 1?
I don't know how clear what I'm trying to ask, sorry for that.