Why am I seeing not seeing the dropped packets in my traffic feed?

Reply
L2 Linker

Why am I seeing not seeing the dropped packets in my traffic feed?

The way my firewall is configured, the wireless traffic gets routed to the internal traffic through it. After connecting my laptop to the wireless on our network, I am unable to reach a software that was recently implemented for some reason. I was tracing down what could've been the issue for hours. I logged into the firewall and went straight to the traffic log to see if I saw the firewall dropping the packets only to see nothing. I then ran a packet capture (from in the firewall) and finally saw the dropped packets. This is not the first time this has happened as I had a similar experience while troubleshooting AP's one time. Does anyone know why this happens?

L2 Linker

Re: Why am I seeing not seeing the dropped packets in my traffic feed?

I am not sure if this is still the case but around 4 years ago I ran into an issue simallar to this and it turns out to be the firewall configuration.  Try adding an explicit deny rule to the bottom of your security rules and this should start logging dropped "packets" (not the best word in this situation).  My understanding is that if the traffic does not match a rule it will not be logged, but I could be way off on this one.  Also check the logging options on all security rules if you are forwarding to Panorama.

L7 Applicator

Re: Why am I seeing not seeing the dropped packets in my traffic feed?

@wrainwater,

Instead of creating an explicit deny rule at the bottom of your security rules as @DIRTT mentioned; simply enabling logging on the 'interzone-default' security rule should give you the information you are looking for. By default the interzone-default and intrazone-default rules do not have logging enabled, however you can enable logging whenever you need it with ease. 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!