02-04-2021 10:37 AM
I'm having issues with my garage door opener thru my PA 220 FW, v9.1.6, with the latest dynamic updates.
It uses DNS and TCP 8883 to communicate to the MyQ servers. In Monitor>Logs>Traffic, I can see DNS traffic from the opener to 184.108.40.206 with return bytes, but no other traffic. In Session Browser, I see the 8883 traffic but hitting the Interzone Default policy. This is strange as other devices are on the same network/zone and working fine. In a packet capture of traffic from the opener, I see the 8883 traffic in the receive, transmit and drop stages.
At the time of this post, I'm still troubleshooting connectivity but maybe Security Policies just for the opener and specifying DNS and 8883 in their own policies may have helped.
I'm curious why I can see traffic in the Logs>Traffic for all other devices and only DNS for the opener but not the 8883 traffic?
Thanks for any input.
02-04-2021 12:27 PM
By default the firewall will not log traffic hitting the intrazone-default policy, so you'll want to override that to actually enable logging if you want to log traffic hitting it. The reason the traffic is getting denied is likely because you don't have a matching security entry for this traffic.
Create a service object for 8883/tcp and use it to allow the traffic explicitly on your PA-220. See what app-id is identified (likely ssl) and then add said app-id to the entry you just created to allow the identified application over what will likely not be a default port.
02-04-2021 12:55 PM - edited 02-04-2021 01:02 PM
The Interzone Default makes sense.
There is only one Security Policy allowing all from trust to untrust, so not sure why it was hitting the Interzone Default policy.
I created a service TCP/8883 and applied it to a Security Policy with the garage opener IP and zone as the source, untrust as the dest zone, and this service. I cloned that for DNS, though I didn't need to. No changes to NAT policies.
After creating the Security Policy with the 8883 service, the MyQ management worked.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!