Feature to test Firewall rule logic with test packets?

[choff123]

Im setting up some rules right now which 'should' just work as they are fairly straightforward.

Is there a feature that will let me state a certain packet with certain info is comming in on an interface and the FW can tell me what rules it hits and what path it takes through virtual routers?

I just want to see the flow of the packet through the firewall so i know whats going wrong.

thanks

[sdurga · Accepted solution]

You can use the test commands on the device. The test command can be used to test variety of rules like NAT, secuirty, dos , etc.

You can test a security policy is working or not as below.

And the same applies for the NAT policy also. You can test NAT policy as below,

You can use a wide range of criteria's in your test like source ip, source-user, destination application and more. Take the help  of ? symbol while using this commands and test your rules.

[choff123]

thanks very much! thats exactly what i was hoping for.

also, i was able to find the protocol numbers the rules refer to

http://en.wikipedia.org/wiki/List_of_IP_protocol_numbers