topic Re: Need help! Specific subnet cannot access my internal resource in General Topics

Need help! Specific subnet cannot access my internal resource

renzanjo11 — Thu, 07 Dec 2023 08:54:32 GMT

Hi Team,

I just need an advise.

I have this setup as attached but I have this mystery that's been bugging me for days now. There is only one subnet which cannot access my internal resource.

I ran the filter and global counter and there are specific counters I noticed.

Can someone enlighten me on this?

Regards,

Renz

Re: Need help! Specific subnet cannot access my internal resource

kiwi — Thu, 07 Dec 2023 09:19:14 GMT

Hi @renzanjo11 ,

You might be experiencing this issue:
Packets Dropped: Forwarded to a Different Zone

Hope this helps,

-Kim.

Re: Need help! Specific subnet cannot access my internal resource

msyeedrafiqi — Thu, 07 Dec 2023 12:05:53 GMT

you need to check on the monitor traffic logs and which policy it is hitting most probably its not hitting the correct policy.

Re: Need help! Specific subnet cannot access my internal resource

renzanjo11 — Fri, 08 Dec 2023 08:14:17 GMT

Hi everyone!

Thank you very much for all of the suggestions.

I am pretty sure it's hitting the correct policy and NAT rules. I tried clearing the sessions but still no good.

I'm really confused what here I am doing wrong. I am so used to NAT and policies but this time I'm dropping.

I can give you a glimpse of the logs I got.

Regards,

Renz

Re: Need help! Specific subnet cannot access my internal resource

msyeedrafiqi — Fri, 08 Dec 2023 09:13:20 GMT

from the traffic logs you can see the application is incomplete, please take a packet capture from the monitor tab and when you initiate the traffic run the below command(run this command 3-5 times):
filter should be source: 111.223.89.115 dst: 116.12.174.226 and vice versa
show counter global filter packet-filter yes delta yes

from this command you check what firewall is doing to the traffic

Re: Need help! Specific subnet cannot access my internal resource

renzanjo11 — Fri, 08 Dec 2023 10:20:37 GMT

@msyeedrafiqi Hi !

Thank you very much!

I am just curious, shouldn't I use the translated server address? Or for this case I should ignore it first?

Regards,

Renz

Re: Need help! Specific subnet cannot access my internal resource

msyeedrafiqi — Fri, 08 Dec 2023 10:34:21 GMT

You are correct. the correct filter would be your private client ip and public destination IP
2- your natted Ip and the destination IP
3- destination IP and private IP
4- Destination - your public IP

Re: Need help! Specific subnet cannot access my internal resource

renzanjo11 — Fri, 08 Dec 2023 15:35:49 GMT

Hi @msyeedrafiqi ,

Are these packet filter indexes?

2- your natted Ip and the destination IP
3- destination IP and private IP
4- Destination - your public IP

Regards,

Renz

Re: Need help! Specific subnet cannot access my internal resource

msyeedrafiqi — Fri, 08 Dec 2023 16:05:29 GMT

On the firewall packet capture we can only have 4 max filters.
The first filter would be Private Ip and Destination IP
Second would be vice versa
Third would be Natted IP and Destination IP

Fourth Vice versa