Default interzone deny rule showing Allow traffic logs.

[nithinbabup]

Default inter zone deny rule showing Allow traffic logs.

There are expected deny logs but some requests are getting allowed by hitting default interzone deny rule.

Very Strange behavior and we have already verified the Rule and its actions, it is configured to deny traffic from any to any.

Please share if any thoughts on this....

[BPry]

@nithinbabup,

So first things first, I would verify that they don't have any changes to commit (IE: Did someone modify the interzone-default back from allow and forget to commit). If that isn't the case when it comes to extremely weird cases that shouldn't be happening, I would schedule a time to restart the box and see if the issue persists after a reload. 

[reaper]

is there an application associated to the traffic?

it could be that the initial SYN packet is being allowed because its source/dest and port are allowed, but then the session turns into an application for which no rule exists, it will then be passed on to the default deny rule to discard (after the session had already been allowed which could explain the 'allow' entry)

[nithinbabup]

We have already rebooted the device and still allowed logs are generating randomly

[nithinbabup]

yes the traffic is identifying applications, and the scenario is most of the same pattern of traffic is denying as expected and only few of them are showing allowed and why it is happening only for this particular HA pair.

Even TAC guys are also not able to provide a clear explanation for this behavior.

[reaper]

- could you maybe provide some screenshots?

- have you been able to perform packet captures or run global counters

-  for the sessions where an application is present, what is displayed if you look up the session ID and then do 'show session id xxxx' from the cli (could you clean that up and paste it here)

- are the applications, matched to the dropped sessions' source/destination, allowed elsewhere in the rule set (i asked that in my last comment)

please look up 2 things: 1) is the source/dest/port allowed somewhere 2)is the source/dest/port/app allowed somewhere

[nithinbabup]

Thank you.This is almost confirmed that we are experiencing same behavior mentioned in the below KB link

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClrUCAS