topic Problem Creating Rule for IKE Traffic in General Topics

Problem Creating Rule for IKE Traffic

rmagowan — Fri, 15 Apr 2011 14:56:05 GMT

I think it's my phase II re-key traffic being dropped. I tried to set up a rule source untrust with a specific IP, dest untrust with my Firewall's IP, application IPSEC, service application default, Action Allow.

It never gets hit and my udp/500 traffic gets dropped by my clean-up rule.

I am brand new to Palo Alto and probably don't fully understand apps and services yet. If I turn off the drop rule, everything is fine but that seems to defeat the purpose of the firewall no?

Thanks

Re: Problem Creating Rule for IKE Traffic

bpappas — Fri, 15 Apr 2011 16:58:30 GMT

add IKE to your applications on the VPN rule.

the any/any cleanup rule is blocking intrazone traffic.

-Benjamin

Re: Problem Creating Rule for IKE Traffic

rmagowan — Fri, 15 Apr 2011 19:01:38 GMT

I've a much deeper understanding about the implicit drop rule. I was stiil in CP frame of mind. Folks wanted to see the dropped traffic, hence the rule with screwed up all my intrzone traffic and pushed my down the path of IKE policy things. I've taken out the drop rule (clean-up Rule), explained the situation to my co-workers and developed a pair of rules that will give drop info if needed later on. My PA5020 HA cluster thanks you, I thank you.