Log entry - packet count

[adamszabo]

Hello LiveCommunity,

I have a, hopefully, quick question regarding traffic log entries and packet counts. 

What if: there is a security policy which has the action set to "Deny" and the application to traceroute (or anything else but the "send ICMP unreachable" box is ticked); when a packet is received that matches this "Deny" policy and the firewall sends the unreachable, will I see 1 packet received and 1 packet sent in the traffic log? Or to re-phrase: does the "ICMP unreachable" packet that is sent by the firewall appear in the logs/counted as a session-related packet?

Thanks for your answer!

[Claw4609]

I would think so but not entirely sure. What are you looking to achieve with this information? Something to note as well, some traffic can still be passed on a deny rule if application identification is needed to make a policy decision.

[adamszabo]

I'm just curious as I don't really know the exact answer. I know that PAN-OS for certain apps in needs more than one packet. But will the firewall's "ICMP unreachable" packet appear in the packets sent column? So, A sends a ping to B but the firewall denies the traffic based on src IP + dst IP (doesn't even matter the app); the send "ICMP Unreachable" option is ticked - so in the traffic log I'll see that A sent 1 packet: will I also see that it received 1?
I don't know how clear what I'm trying to ask, sorry for that.