topic Re: Why am I seeing not seeing the dropped packets in my traffic feed? in General Topics

Why am I seeing not seeing the dropped packets in my traffic feed?

wrainwater — Fri, 05 Jan 2018 14:22:00 GMT

The way my firewall is configured, the wireless traffic gets routed to the internal traffic through it. After connecting my laptop to the wireless on our network, I am unable to reach a software that was recently implemented for some reason. I was tracing down what could've been the issue for hours. I logged into the firewall and went straight to the traffic log to see if I saw the firewall dropping the packets only to see nothing. I then ran a packet capture (from in the firewall) and finally saw the dropped packets. This is not the first time this has happened as I had a similar experience while troubleshooting AP's one time. Does anyone know why this happens?

Re: Why am I seeing not seeing the dropped packets in my traffic feed?

DIRTT — Fri, 05 Jan 2018 14:55:11 GMT

I am not sure if this is still the case but around 4 years ago I ran into an issue simallar to this and it turns out to be the firewall configuration. Try adding an explicit deny rule to the bottom of your security rules and this should start logging dropped "packets" (not the best word in this situation). My understanding is that if the traffic does not match a rule it will not be logged, but I could be way off on this one. Also check the logging options on all security rules if you are forwarding to Panorama.

Re: Why am I seeing not seeing the dropped packets in my traffic feed?

BPry — Fri, 05 Jan 2018 15:32:41 GMT

@wrainwater,

Instead of creating an explicit deny rule at the bottom of your security rules as @DIRTT mentioned; simply enabling logging on the 'interzone-default' security rule should give you the information you are looking for. By default the interzone-default and intrazone-default rules do not have logging enabled, however you can enable logging whenever you need it with ease.

Re: Why am I seeing not seeing the dropped packets in my traffic feed?

mhannan313 — Mon, 01 Jan 2024 12:11:49 GMT

Any recommendations?