Default interzone deny rule showing Allow traffic logs.

[nithinbabup]

Default inter zone deny rule showing Allow traffic logs.

There are expected deny logs but some requests are getting allowed by hitting default interzone deny rule.

Very Strange behavior and we have already verified the Rule and its actions, it is configured to deny traffic from any to any.

Please share if any thoughts on this....

[BPry]

@nithinbabup,

So first things first, I would verify that they don't have any changes to commit (IE: Did someone modify the interzone-default back from allow and forget to commit). If that isn't the case when it comes to extremely weird cases that shouldn't be happening, I would schedule a time to restart the box and see if the issue persists after a reload. 

[reaper]

is there an application associated to the traffic?

it could be that the initial SYN packet is being allowed because its source/dest and port are allowed, but then the session turns into an application for which no rule exists, it will then be passed on to the default deny rule to discard (after the session had already been allowed which could explain the 'allow' entry)

[nithinbabup]

We have already rebooted the device and still allowed logs are generating randomly

[nithinbabup]

yes the traffic is identifying applications, and the scenario is most of the same pattern of traffic is denying as expected and only few of them are showing allowed and why it is happening only for this particular HA pair.

Even TAC guys are also not able to provide a clear explanation for this behavior.