topic Re: Policy Rules for BFD, OSPF , DHCP and DHCP relay in General Topics

Policy Rules for BFD, OSPF , DHCP and DHCP relay

Alex_Samad — Fri, 02 Mar 2018 05:46:47 GMT

So do I have to setup policy rules to allow OSPF, I have OSPF on the PA . But when i don't have the rules in place OSPF fails, when i have them it doesn't log anything

DHCP, do I need it if the PA is running DHCP. what is the source and destination ?

DHCP-relay, source is the input zone and the destination is the dhcp server I am relaying to. But it looks like I have to have 2 polies 1 for request and 1 for replies

BGP, is it the same i policy rules in place even if its that PA ?

Re: Policy Rules for BFD, OSPF , DHCP and DHCP relay

OtakarKlier — Fri, 02 Mar 2018 16:36:23 GMT

Hello,

I'll do my best here:

So do I have to setup policy rules to allow OSPF, I have OSPF on the PA . But when i don't have the rules in place OSPF fails, when i have them it doesn't log anything

Do you have logging enabled on the policy?

DHCP, do I need it if the PA is running DHCP. what is the source and destination ?

If you are using the builtin 'Intrazone' policy, then no. If you are like some and have a DENY ALL policy above those predefined policies, then possibly.

DHCP-relay, source is the input zone and the destination is the dhcp server I am relaying to. But it looks like I have to have 2 polies 1 for request and 1 for replies

Correct, this is how DHCP works since its not a tcp conection and the traffic gets generated both ways. ie the Clients send traffic to request and IP, the DHCP server then sends traffic with the IP info. This should not be required if the client and server are in the same zone.

Hope that helps.

Re: Policy Rules for BFD, OSPF , DHCP and DHCP relay

Alex_Samad — Sat, 03 Mar 2018 01:51:06 GMT

Yep I have my own intrazone drop rule

Yes I have logging on OSPF policy start and end

I don't see anything nor in monitor session

dhcp/dhcprelay .... so my issue with this is ... it supposed to be a new firewall with smarts. it should be expecting a reply..

🙂

So I know on my old cisco's once for example once I turned on snmp service i didn't need to allow access via acl it just worked.

Thanks