Default interzone deny rule showing Allow traffic logs.

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Default interzone deny rule showing Allow traffic logs.

L1 Bithead

Default inter zone deny rule showing Allow traffic logs.


There are expected deny logs but some requests are getting allowed by hitting default interzone deny rule.

Very Strange behavior and we have already verified the Rule and its actions, it is configured to deny traffic from any to any.


Please share if any thoughts on this....


Cyber Elite
Cyber Elite


So first things first, I would verify that they don't have any changes to commit (IE: Did someone modify the interzone-default back from allow and forget to commit). If that isn't the case when it comes to extremely weird cases that shouldn't be happening, I would schedule a time to restart the box and see if the issue persists after a reload. 

Cyber Elite
Cyber Elite

is there an application associated to the traffic?


it could be that the initial SYN packet is being allowed because its source/dest and port are allowed, but then the session turns into an application for which no rule exists, it will then be passed on to the default deny rule to discard (after the session had already been allowed which could explain the 'allow' entry)



Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

We have already rebooted the device and still allowed logs are generating randomly

yes the traffic is identifying applications, and the scenario is most of the same pattern of traffic is denying as expected and only few of them are showing allowed and why it is happening only for this particular HA pair.


Even TAC guys are also not able to provide a clear explanation for this behavior.

- could you maybe provide some screenshots?


- have you been able to perform packet captures or run global counters


-  for the sessions where an application is present, what is displayed if you look up the session ID and then do 'show session id xxxx' from the cli (could you clean that up and paste it here)


- are the applications, matched to the dropped sessions' source/destination, allowed elsewhere in the rule set (i asked that in my last comment)

please look up 2 things: 1) is the source/dest/port allowed somewhere 2)is the source/dest/port/app allowed somewhere




Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Thank you.This is almost confirmed that we are experiencing same behavior mentioned in the below KB link

  • 6 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!