topic Re: VPN up but traffic not matching outbound policy, inbound policy is work in General Topics

VPN up but traffic not matching outbound policy, inbound policy is working

drewdown — Fri, 17 Jul 2020 16:22:47 GMT

Recent new VPN tunnel is up with Azure. I can see traffic matching zone VPN-S2S > trust but anything from trust > VPN-S2S zone is not matching that specific policy. The oubound traffic is matching the blanket outbound policy and I can't figure out why.

Can someone help me figure out what the deal is?

Re: VPN up but traffic not matching outbound policy, inbound policy is work

drewdown — Fri, 17 Jul 2020 18:26:06 GMT

So it looks to be matching the right policy from CLI but the GUI shows the wrong one when filtering by the destination IP within Azure. More importantly its not encrypting any packets towards AZURE and I can't figure that out.

admin@fw3-3020(active)> show vpn flow tunnel-id 2 | match bytes encap bytes: 0 decap bytes: 95848

admin@fw3-3020(active)> test security-policy-match source 10.100.1.2 destination 10.113.129.4 protocol 80 "Allow-Azure-Ok; index: 2" { from trust; source 10.100.0.0/16; source-region none; to VPN-S2S; destination 10.113.128.0/20; destination-region none; user any; category any; application/service 0:any/any/any/app-default; action allow; icmp-unreachable: no terminal yes; }

Re: VPN up but traffic not matching outbound policy, inbound policy is work

drewdown — Fri, 17 Jul 2020 19:37:02 GMT

More details...I can ping the AZURE instance from the PAN but not from anything behind the PAN on the LAN:

admin@fw3-3020(active)> ping source 10.100.2.5 host 10.113.129.4 PING 10.113.129.4 (10.113.129.4) from 10.195.2.5 : 56(84) bytes of data. 64 bytes from 10.113.129.4: icmp_seq=1 ttl=128 time=11.8 ms 64 bytes from 10.113.129.4: icmp_seq=2 ttl=128 time=11.1 ms 64 bytes from 10.113.129.4: icmp_seq=3 ttl=128 time=11.4 ms 64 bytes from 10.113.129.4: icmp_seq=4 ttl=128 time=11.3 ms

Re: VPN up but traffic not matching outbound policy, inbound policy is work

BPry — Sat, 18 Jul 2020 04:14:24 GMT

@drewdown,

The logs that you provided are showing that the traffic isn't taking the proper route from the look of things. The traffic log you provided shows that the traffic is attempting to route through your untrust interface.

Re: VPN up but traffic not matching outbound policy, inbound policy is work

drewdown — Mon, 20 Jul 2020 15:37:58 GMT

I know this, what I was asking is why. Either way one my direct reports figured it out and it had to do with PBR and ISP failover. Once he added the VPN-S2S zone and the remote CIDR to that policy traffic started to flow.