topic Re: PA 3020 - new security rule isn't active. in General Topics

PA 3020 - new security rule isn't active.

MPI-AE — Mon, 21 Aug 2017 08:28:04 GMT

Hey all!

There is a strange problem with my PA 3020 7.1.7:

I need access from a client pc to a printer with many ports so for testing I set up a security rule with application any and service any.

The rule is enabled but it's not effective.

The firewall even doesn't have traffic logs for this connection.

I already had this problem in the past, I don't know anymore how I solved it.

Are there some things I can do?

Thank you!

Re: PA 3020 - new security rule isn't active.

TranceforLife — Mon, 21 Aug 2017 08:43:01 GMT

Hi,

Did you enable log in the new policy? Are you sure that the user's traffic is passing (or should pass) the firewall in order to reach the printer? For the test create any to any zone with the source ip of the test pc going to the destination ip of the printer.

Re: PA 3020 - new security rule isn't active.

Remo — Mon, 21 Aug 2017 13:37:45 GMT

@MPI-AE

In addition to @TranceforLife's question: if you log the traffic, do you have no logs for that rule or effectively for that connection (src and dst IP as filter)?

Or is the printer may be not responding (or wrong/no default gateway?) And you have a rule above your any-any-allow rule with an application with default ports "tcp/udp/dynamic", so all connections never hit your test-rule?

Re: PA 3020 - new security rule isn't active.

Raido_Rattameister — Tue, 22 Aug 2017 01:46:00 GMT

If pc sends traffic to printer but printer does not answer then Palo logs application as incomplete.

https://live.paloaltonetworks.com/t5/Management-Articles/Not-Applicable-Incomplete-Insufficient-Data-in-the-Application/ta-p/65711

Does traffic pass firewall? Even if PC and printer are in different subnet there might be Layer3 switch routing traffic between internal subnets.

Does traffic match this test rule? I mean are source/destination zones correct etc?

Re: PA 3020 - new security rule isn't active.

MPI-AE — Wed, 23 Aug 2017 07:34:37 GMT

Thanks for your answers!

I'm not sure what was the exact problem.

The connection is now working, but I didn't change anything.

That's very strange.

But thanks for your support, though!

Re: PA 3020 - new security rule isn't active.

BPry — Wed, 23 Aug 2017 14:19:26 GMT

@MPI-AE,

If I would have to guess you likely want to take a look at the below article. It sounds like you don't have session-rematch enabled and the session wasn't getting properly closed on the session table.

https://live.paloaltonetworks.com/t5/Learning-Articles/How-Session-Rematch-Works/ta-p/60326