Same Zone Traffic to inside hitting different rules

F.Ledesma — Fri, 09 Jun 2017 18:26:41 GMT

Howdy All,

I'm running into an issue where traffic from "Colo-Voice" segment bound to Any on the inside is hittin an "Any L3" policy (shown below) that's in place as the last policy. During our capture, we can see there's another host from the same segment bound for the same segment however it is hitting the "Cisco Voice-to-Internal_Trust" policy (as it should be.) Below are the two rules configured on the PAN. We can't see to figure out why the host hitting the "Any L3" policy is not hitting the "Cisco Voice-to-Internal_Trust". For all sense and purposes, this traffic "should" hit the Cisco Voice...policy first.

Our goal is to finally be able to remove the "Any L3" policy so that the PAN can be locked down.

Any input on this is greatly appreciated.

================================

}
"Cisco Voice-to-Internal_Trust" {
from Colo-Voice;
to Internal_Trust;
source 10.10.60.0/24;
destination any;
source-user any;
category any;
application [ cisco-rtmt informix ms-office365-base ntp outlook-web-online rmi-iiop rtcp rtp-base sccp sip ssh ssl tftp web-browsing];
service any;
hip-profiles any;
action allow;
}

"Any L3" {
from [ Colo-Voice FW_110 Mgmt P2P SF-113 SF-114 SF-115 SF-116 Trust UCS-Mgmt Internal_Trust];
to [ Colo-Voice FW_110 Mgmt P2P SF-113 SF-114 SF-115 SF-116 Trust UCS-Mgmt Internal_Trust];
source any;
destination any;
source-user any;
category any;
application any;
service any;
hip-profiles any;
action allow;
profile-setting {
group Monitor;
}
disabled no;

================================

Re: Same Zone Traffic to inside hitting different rules

TranceforLife — Fri, 09 Jun 2017 20:32:39 GMT

Hey,

Can you post the screen shot of your policy set-up, please? Who is the source and who is the destination? Do you think destination(s) .141 and .2 are in the different zones? Usually, device will do exactly what you have asked it to do. Unfortunately, this is not always the same as what you want.

Re: Same Zone Traffic to inside hitting different rules

F.Ledesma — Fri, 09 Jun 2017 21:05:46 GMT

Hi,

Cap11 shows some of the rules above the 'Any L3'. Cap12 shows the 'Any L3' Rule. I have screen cap of all the policies that precede the "Cisco Voice-to-Internal_Trust".

Please advise if anything else is needed.

Thanks!Cap11Cap12

topic Re: Same Zone Traffic to inside hitting different rules in General Topics

Same Zone Traffic to inside hitting different rules

Re: Same Zone Traffic to inside hitting different rules

Re: Same Zone Traffic to inside hitting different rules