Why traffic log shows that traffic match allow policy but the result was reset by default deny policy?

[neilwu]

Does anyone have following experience and could give me some idea to fix this issue?

Thanks a lot ~

I found sometimes the traffic log shows that traffic match allow policy but the result was reset by default deny policy.

For example:

I have a policy for allow some users to access TCP 58975.

I checked traffic log and I found traffic be reset by interzone-default during 2/11 08:07:16 to 2/12 08:02:31

I already checked threat log and there is no log about drop or reset for this traffic.

And I checked configuration log and there is no change record.

I have a clue, this PA-3020 update apps-content everyday at 8:00.

Traffic begin reset at 2/11 08:07:16 that just update to 8374-6528.

And after 24 hours traffic be allow at 2/12 08:02:31 that also just update to 8375-6541.

But I'm not sure is it can cause this problem because I think the policy allow any application so it should be allow if traffic match L3 to L4 rule. And I'm not sure that always happen after apps-content update in the first few times.

I have open a case but support says they need capture packets or they doesn't have enough data to analysis this issue.

That is problem because I can not reproduce this situation.

PA-3020

PAN-OS : 8.1.16

[jdelio]

This is interesting..  

I see what you mean in your rules, dropped for about 24 hours.. then allowed again.

Questions:

 - Is this constant?  or was this a one time event? 

 - Have you seen this before?

 - It looks like you are just using Services and not apps? have you tried creating a custom app for this and allowing that application? Not sure that would matter.