Why am I seeing not seeing the dropped packets in my traffic feed?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Why am I seeing not seeing the dropped packets in my traffic feed?

L2 Linker

The way my firewall is configured, the wireless traffic gets routed to the internal traffic through it. After connecting my laptop to the wireless on our network, I am unable to reach a software that was recently implemented for some reason. I was tracing down what could've been the issue for hours. I logged into the firewall and went straight to the traffic log to see if I saw the firewall dropping the packets only to see nothing. I then ran a packet capture (from in the firewall) and finally saw the dropped packets. This is not the first time this has happened as I had a similar experience while troubleshooting AP's one time. Does anyone know why this happens?

3 REPLIES 3

L2 Linker

I am not sure if this is still the case but around 4 years ago I ran into an issue simallar to this and it turns out to be the firewall configuration.  Try adding an explicit deny rule to the bottom of your security rules and this should start logging dropped "packets" (not the best word in this situation).  My understanding is that if the traffic does not match a rule it will not be logged, but I could be way off on this one.  Also check the logging options on all security rules if you are forwarding to Panorama.

@wrainwater,

Instead of creating an explicit deny rule at the bottom of your security rules as @DIRTT mentioned; simply enabling logging on the 'interzone-default' security rule should give you the information you are looking for. By default the interzone-default and intrazone-default rules do not have logging enabled, however you can enable logging whenever you need it with ease. 

 

  • 5202 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!