topic Re: Default deny logging question in General Topics

Default deny logging question

dstjames — Tue, 09 Jul 2019 19:03:07 GMT

I notice that if a connection comes in and does not hit any policy correctly I do not see the deny in the logs. I think this is because the default behavior of the intrazone-default rule is not to log anything. Is there a down side to setting this to log events so that we can see when a connection fails? Sometimes from a troubleshooting perspective this would be helpful but I wonder if its not enabled for a reason by default. I assume because it will generate a lot of logs but was wondering what everyone else thinks before I do this.

Re: Default deny logging question

OtakarKlier — Tue, 09 Jul 2019 20:02:04 GMT

Hello,

I always turn on logging so I can see traffic even if its denied. I honestly never use the default inter/intra policies and put a DENY ALL one as my last policy and only then allow the traffic I want.

The down side is the logs will fill up faster and the PAN wont keep as much. But its worth that cost.

Cheers!

Re: Default deny logging question

Mick_Ball — Wed, 10 Jul 2019 12:21:19 GMT

I have used both intrazone and block-alll policy.

i prefer to now use the custom block-all policy and leave the intrazone stuff alone.

we use panorama for our logs so this policy is not set for forwarding. It just logs locally.

you can of course just enable/disable when needed for diags.

Re: Default deny logging question

khsieh — Wed, 10 Jul 2019 20:51:50 GMT

I have a deny all and log as the last rule post rule in Panorama. It applies to all firewalls, so the default inter-zone and intra-zone rules never get hit. More logs is the double-edged sword. If I don't want to see something, I have been known to put in a rule to block traffic and not forward it to Panorama.

Re: Default deny logging question

Rboehme — Thu, 11 Jul 2019 15:29:05 GMT

Hi James,

from my point of view there is no downsite. If your ruleset is appropriate there is no reason to let the intra-/inter-zone Default rules not log events. As mentioned by other user you can have a deny/any/any rule before the default rules but this is basically only useful if you have setup policies for everything. Imagine some customer/partner wants to setup a VPN with your outside interface. As he is based within the outside zone as well as your outside interface this would normally hit the "intra-zone default rule" - which can not being hit when a deny/any/any statement is placed before.

The best practice is to set logging to "at session end" and you can safely enable the logging on those rules as I do primarily assume you do not want this rule to be it but when it gets hit you want to see it in the logs.

Kind regards,

Rene