topic Firewall security policy match criteria query in General Topics

Firewall security policy match criteria query

barry_lee — Thu, 21 Dec 2023 08:35:40 GMT

Hi,

We have a security rule set up to allow voip traffic from A to B but limited to certain ports.

We are see an allowed traffic that matches the source and destination but however has a port number that is not in the list of allowed ports, with end reason aged out.

I would like to know how does the firewall actually do a lookup on the security policy as technically if the port number does not match traffic shouldn't be allowed.

Re: Firewall security policy match criteria query

reaper — Thu, 21 Dec 2023 12:56:22 GMT

are your ports set as services or as application-default?

if you're seeing ports you didn't expect, the session is most likely being allowed by a different rule

are you able to provide screenshots?

Re: Firewall security policy match criteria query

barry_lee — Thu, 21 Dec 2023 14:09:34 GMT

I'm unable to provide screenshots.

ports are set under services. i can see traffic logs hitting the voip rule.

weird thing is that port that is being allowed is not in the list of allowed ports.

Re: Firewall security policy match criteria query

Brandon_Wertz — Fri, 22 Dec 2023 14:35:16 GMT

When you say you allow "voip" traffic, what's the actual application? Is that application the only defined application on the rule? When you say "A to B" you have a defined source and destination IP objects/networks? As for the service (ports that are allowed and also not matching), are you certain the service object you're using isn't a service range?

To confirm you're saying the rule looks like this?

Source --> 1.1.1.0/24 (internal zone) | Destination --> 2.2.2.0/24 (internet zone) | Application <defined application> (not app any) | Service --> <specific ports defined> (Service 'Any' not selected in the drop down, as well as tcp/udp is defined on the service)

You're saying you have these options configured and you're seeing a port being allowed on this rule from a session allow / end?