Trafic blocked when security profile enabled

[Stephen24]

Hello Community,

Traffic is blocked by the Firewall Palo when security profile is enabled and need to disabled it to access to the destination server

How can we solve this?

Thanks!

S

[Stephen24]

Additionnal information,

The same security profile is enabled on other security rules and do not cause any issue

Thank you

[SutareMayur]

Hi @Stephen24 What are you seeing in traffic logs? Which security profile is blocking traffic?

Mayur

[Stephen24]

Hello Mayur,

In the traffic logs I see traffic is matching with the rule Deny All and after is allowed

Configuration of the security profile is :

Antivirus profile = av_all

Anti-Spyware Profile strict

Vulnerability Protection Profile protec_all

Thank you

[SutareMayur]

@Stephen24 If you are seeing deny all in traffic logs itself then cross verify security policy first. If anything is getting blocked/deny due to security profile, then it should be seen under Threat, URL filtering logs.

Please do security policy test using 'test' command under cli.

Mayur

[Stephen24]

Thank you

May I use this command for example :

test security-policy-match source <source IP> destination <destination IP/netmask> protocol <protocol number>

Or is there a better way for testing what is blocking by the security profile?

[SutareMayur]

@Stephen24, Yes above mentioned test command will give you the security rule match for mentioned source and destination traffic. This will confirm if traffic is matching desired policy and confirm on traffic action.

Mayur

[Stephen24]

unfortunately, the rule seen in the result of CLI is not the same than in GUI, is it normal?

ie. the rule which is matching the IPs source and destination in not the same