GRE protocol traffic

[Tician]

Hello to All,

I noticed some strange behavior regarding GRE protocol, and try to explain what exactly is strange:

Customer has unfortunate GRE VPN tunnel and in one policy "Public_ulaz_GRE" they stated to pass only GRE and NVGRE protocol respectively. (following picture)

 

But, when you filter traffic by mentioned policy, you can see that beside legitimate, bunch of non-gre traffic are allowed by this policy!??

Is someone have reasonable explanation for this behavior?

Regards,

Tician

[kadak · Accepted solution]

Hello Tician,

Yes this is expected if "Public_ulaz_GRE" lies at the top of your security rules .  Before the 3-way handshake completes and the session's application is detected as incomplete/in-sufficient data, the security policy lookup for the session will match the first security policy which matches all attributes except application.  Once the 3-way handshake completes and the firewall sees a data packet which can be used to identify the app the session will shift the application to the appropriate value and do another security policy lookup.

Because the application is not known, when the SYN packet is received, the application portion of the security policies can not be applied.  As a result, the security policy lookup is performed against the 6 tuples of the session, source and destination IP and port, ingress interface (actually zone) and protocol.  The first policy which matches these 6 tuples will be used to allow the SYN and any additional packets that traverse the firewall before the application is identified.

Hope that helps!

Thanks and regards,

Kunal Adak

[Tician]

Hello Kunal,

yes this is very helpful answer, thank you...