Why traffic log shows that traffic match allow policy but the result was reset by default deny policy?

neilwu — Tue, 02 Mar 2021 15:25:10 GMT

Does anyone have following experience and could give me some idea to fix this issue?

Thanks a lot ~

I found sometimes the traffic log shows that traffic match allow policy but the result was reset by default deny policy.

For example:

I have a policy for allow some users to access TCP 58975.

I checked traffic log and I found traffic be reset by interzone-default during 2/11 08:07:16 to 2/12 08:02:31

I already checked threat log and there is no log about drop or reset for this traffic.

And I checked configuration log and there is no change record.

I have a clue, this PA-3020 update apps-content everyday at 8:00.

Traffic begin reset at 2/11 08:07:16 that just update to 8374-6528.

And after 24 hours traffic be allow at 2/12 08:02:31 that also just update to 8375-6541.

But I'm not sure is it can cause this problem because I think the policy allow any application so it should be allow if traffic match L3 to L4 rule. And I'm not sure that always happen after apps-content update in the first few times.

I have open a case but support says they need capture packets or they doesn't have enough data to analysis this issue.

That is problem because I can not reproduce this situation.

PA-3020

PAN-OS : 8.1.16

Re: Why traffic log shows that traffic match allow policy but the result was reset by default deny policy?

jdelio — Thu, 04 Mar 2021 16:30:53 GMT

This is interesting..

I see what you mean in your rules, dropped for about 24 hours.. then allowed again.

Questions:

- Is this constant? or was this a one time event?

- Have you seen this before?

- It looks like you are just using Services and not apps? have you tried creating a custom app for this and allowing that application? Not sure that would matter.

topic Why traffic log shows that traffic match allow policy but the result was reset by default deny policy? in General Topics

Why traffic log shows that traffic match allow policy but the result was reset by default deny policy?

Re: Why traffic log shows that traffic match allow policy but the result was reset by default deny policy?