topic Traffic showing from same zone in General Topics

Traffic showing from same zone

FarzanaMustafa — Mon, 30 Sep 2019 03:37:05 GMT

This is not a new setup. It was working fine before.

No change was made recently.

Firewall logs show traffic hitting the right policy, however from the same zone (NET to NET) instead of SZ104-ITSupport to LAN.

How to fix this issue?

Re: Traffic showing from same zone

MP18 — Mon, 30 Sep 2019 04:26:06 GMT

Do you see bytes send and receive?

Is the traffic hitting the right rule?

Re: Traffic showing from same zone

FarzanaMustafa — Mon, 30 Sep 2019 04:37:06 GMT

@MP18

Yes to both.

Re: Traffic showing from same zone

MP18 — Mon, 30 Sep 2019 04:39:57 GMT

Check the source and destination ip?

check if interface is assigned to right zone?

Re: Traffic showing from same zone

FarzanaMustafa — Mon, 30 Sep 2019 04:50:23 GMT

@MP18

Yes everything is fine.

This is an intermittent issue. It displayed this behavior till this morning and now it is fine.

It happens to the last policy that is applied before the interzone/interzone policy.

Re: Traffic showing from same zone

RobinClayton — Tue, 01 Oct 2019 09:36:01 GMT

Not enough information to go on.

Source Destination IP.

VLAN Config

Interface Config

NAT config.

Re: Traffic showing from same zone

OtakarKlier — Wed, 02 Oct 2019 19:02:57 GMT

Hello,

I highly recommend a support case. Grab pcaps of the traffic and a techsupport file to attach to the chase to make things go quicker. I am also seeing this behavior on one system. Our change was a code upgrade to 8.0.9. We are waiting for the results of our case and I will post if its relevant to this one.

Regards,

Re: Traffic showing from same zone

aleksandar.astardzhiev — Fri, 04 Oct 2019 19:56:03 GMT

Hi @FarzanaMustafa,

It doesn't sound you have enough investigation to exclude problems with adjacent devices...

- Have you done a packet capture when the issue occur?

- Can you confirm that the packets are coming from the right interface/zone?

- Have you compare packet captures when the issue occurs and when there is not issues?