topic Re: Trafic blocked when security profile enabled in General Topics

Trafic blocked when security profile enabled

Stephen24 — Thu, 12 Mar 2020 17:01:01 GMT

Hello Community,

Traffic is blocked by the Firewall Palo when security profile is enabled and need to disabled it to access to the destination server

How can we solve this?

Thanks!

Re: Trafic blocked when security profile enabled

Stephen24 — Thu, 12 Mar 2020 17:07:43 GMT

Additionnal information,

The same security profile is enabled on other security rules and do not cause any issue

Thank you

Re: Trafic blocked when security profile enabled

SutareMayur — Fri, 13 Mar 2020 14:50:48 GMT

Hi @Stephen24 What are you seeing in traffic logs? Which security profile is blocking traffic?

Mayur

Re: Trafic blocked when security profile enabled

Stephen24 — Fri, 13 Mar 2020 15:20:17 GMT

Hello Mayur,

In the traffic logs I see traffic is matching with the rule Deny All and after is allowed

Configuration of the security profile is :

Antivirus profile = av_all

Anti-Spyware Profile strict

Vulnerability Protection Profile protec_all

Thank you

Re: Trafic blocked when security profile enabled

SutareMayur — Fri, 13 Mar 2020 15:37:52 GMT

@Stephen24 If you are seeing deny all in traffic logs itself then cross verify security policy first. If anything is getting blocked/deny due to security profile, then it should be seen under Threat, URL filtering logs.

Please do security policy test using 'test' command under cli.

Mayur

Re: Trafic blocked when security profile enabled

Stephen24 — Tue, 17 Mar 2020 08:15:15 GMT

Thank you

May I use this command for example :

test security-policy-match source <source IP> destination <destination IP/netmask> protocol <protocol number>

Or is there a better way for testing what is blocking by the security profile?

Re: Trafic blocked when security profile enabled

SutareMayur — Tue, 17 Mar 2020 08:39:32 GMT

@Stephen24, Yes above mentioned test command will give you the security rule match for mentioned source and destination traffic. This will confirm if traffic is matching desired policy and confirm on traffic action.

Mayur

Re: Trafic blocked when security profile enabled

Stephen24 — Wed, 18 Mar 2020 15:23:40 GMT

unfortunately, the rule seen in the result of CLI is not the same than in GUI, is it normal?

ie. the rule which is matching the IPs source and destination in not the same