Traffic not in logs but in Packet Capture

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Traffic not in logs but in Packet Capture

L3 Networker

I'm having issues with my garage door opener thru my PA 220 FW, v9.1.6, with the latest dynamic updates.

It uses DNS and TCP 8883 to communicate to the MyQ servers. In Monitor>Logs>Traffic, I can see DNS traffic from the opener to 8.8.8.8 with return bytes, but no other traffic. In Session Browser, I see the 8883 traffic but hitting the Interzone Default policy. This is strange as other devices are on the same network/zone and working fine. In a packet capture of traffic from the opener, I see the 8883 traffic in the receive, transmit and drop stages.

 

At the time of this post, I'm still troubleshooting connectivity but maybe Security Policies just for the opener and specifying DNS and 8883 in their own policies may have helped.

 

I'm curious why I can see traffic in the Logs>Traffic for all other devices and only DNS for the opener but not the 8883 traffic?

Thanks for any input.

 

Jeff

 

Passionate about network infrastructure and all things Palo Alto Networks.
3 REPLIES 3

Cyber Elite
Cyber Elite

@jeff6strings,

By default the firewall will not log traffic hitting the intrazone-default policy, so you'll want to override that to actually enable logging if you want to log traffic hitting it. The reason the traffic is getting denied is likely because you don't have a matching security entry for this traffic. 

Create a service object for 8883/tcp and use it to allow the traffic explicitly on your PA-220. See what app-id is identified (likely ssl) and then add said app-id to the entry you just created to allow the identified application over what will likely not be a default port. 

@BPry 

The Interzone Default makes sense.

 

There is only one Security Policy allowing all from trust to untrust, so not sure why it was hitting the Interzone Default policy.

I created a service TCP/8883 and applied it to a Security Policy with the garage opener IP and zone as the source, untrust as the dest zone, and this service. I cloned that for DNS, though I didn't need to. No changes to NAT policies.

After creating the Security Policy with the 8883 service, the MyQ management worked.

 

Thanks.

Jeff

 

 

Passionate about network infrastructure and all things Palo Alto Networks.

  • 5110 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!