VPN up but traffic not matching outbound policy, inbound policy is working

Showing results for 
Search instead for 
Did you mean: 

VPN up but traffic not matching outbound policy, inbound policy is working

L4 Transporter

Recent new VPN tunnel is up with Azure.  I can see traffic matching zone VPN-S2S > trust but anything from trust > VPN-S2S zone is not matching that specific policy.  The oubound traffic is matching the blanket outbound policy and I can't figure out why.  


Can someone help me figure out what the deal is?  





L4 Transporter


So it looks to be matching the right policy from CLI but the GUI shows the wrong one when filtering by the destination IP within Azure.  More importantly its not encrypting any packets towards AZURE and I can't figure that out.  

admin@fw3-3020(active)> show vpn flow tunnel-id 2 | match bytes
        encap bytes:            0
        decap bytes:            95848



admin@fw3-3020(active)> test security-policy-match source destination protocol 80

"Allow-Azure-Ok; index: 2" {
from trust;

source-region none;
to VPN-S2S;
destination-region none;
user any;
category any;
application/service 0:any/any/any/app-default;
action allow;
icmp-unreachable: no
terminal yes;






More details...I can ping the AZURE instance from the PAN but not from anything behind the PAN on the LAN:


admin@fw3-3020(active)> ping source host
PING ( from : 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=128 time=11.8 ms
64 bytes from icmp_seq=2 ttl=128 time=11.1 ms
64 bytes from icmp_seq=3 ttl=128 time=11.4 ms
64 bytes from icmp_seq=4 ttl=128 time=11.3 ms


The logs that you provided are showing that the traffic isn't taking the proper route from the look of things. The traffic log you provided shows that the traffic is attempting to route through your untrust interface. 

I know this, what I was asking is why.  Either way one my direct reports figured it out and it had to do with PBR and ISP failover.  Once he added the VPN-S2S zone and the remote CIDR to that policy traffic started to flow.  

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!