topic Re: Policy not matching actual traffic in General Topics

Policy not matching actual traffic

olloczky — Thu, 11 Feb 2021 15:02:16 GMT

Hi All,

I have a security rule to allow ip "A" to ssh to ip "B". I can see the traffic actually hitting the fw but it gets dropped with interzone-default. The test policy match also verifies that it matches the traffic.

IP "B" is actually the firewall. And IP "B" is nated like this: original packet source IP "C", original packet dest ip "A", translated packet source ip "B".

How can this happen? So the traffic hitting the firewall has an explicit allow rule but still missed.

IP "A" is on the other end of the IPSec tunnel and when this traffic comes, it successfully creates a child SA. Routing is also set up for IP "A"

Chhers,

Daniel

Re: Policy not matching actual traffic

olloczky — Fri, 12 Feb 2021 08:50:11 GMT

I also noticed that in the logs it says "application not-applicable". But the log clearly says that it is port 22 which is used... very strange..

Re: Policy not matching actual traffic

dmifsud — Sun, 28 Feb 2021 17:17:44 GMT

Not applicable is because the firewall does not waste resources trying to identify it when it's already matched the deny rule.

Are you sure the rule is set up correctly? When NAT is involved, the security rule should be to the pre-NAT IP, but the post-NAT zone.

- DM

Re: Policy not matching actual traffic

reaper — Mon, 01 Mar 2021 16:27:10 GMT

not-applicable is because the sesison is dropped, so the firewall doesn't care which application it is

In regards to NAT: you're connecting from A to B, but then have a NAT rule from C to A source B?

your nat rule is supposed to allign with the direction the session is being established in

so unless you forgot to mension bidirection is enabled, this will never work

but then you add that IP A is at the remote end of an IPSec tunnel, so the tunnel happens between D and B?

A will actually egress out of the tunnel interface, this should be a different zone than interface B. Did you account for this in the NAT rule?