NGFW Blocking Router Login Traffic After Policy Update – Requesting Guidance

[MaryBrown]

Hi Community,

I’m reaching out for help with an issue I’m facing on my Palo Alto Next-Generation Firewall involving router login and network access control.

Issue:
After updating security policies to improve our network posture, I'm noticing that  router login  attempts (to internal and remote routers) are being blocked or timing out. These router connections were accessible before the policy changes. I’ve checked the logs and policy configurations but can’t determine what’s causing the problem.

Environment Details:

• Model: PA-3220

• PAN-OS Version: 10.2.x

• Deployment Mode: Layer 3

• Zones: Trust / Untrust

• Services Involved: HTTPS, SSH (used for router login)

• Devices Affected: Multiple internal routers (Cisco, Netgear)

What I’ve Done So Far:

• Reviewed and reordered security policies

• Verified that NAT rules haven’t changed

• Checked traffic logs under Monitor > Traffic

• Ran packet captures — sessions are initiated but drop after SYN

• Tested access to router login pages from alternate zones — same issue

My Questions:

1. How can I accurately identify which policy is dropping the router login traffic?

2. Could the firewall's threat prevention or App-ID be interfering with router access?

3. Are there advanced diagnostic tools in PAN-OS I should use to trace this issue?

Any insights, especially from those who’ve handled similar router access issues, would be greatly appreciated. Let me know if I should provide config snippets or specific log entries.

Thanks in advance!
Marry Brown

[mshekh]

Hi @MaryBrown ,

Thanks for info, you can try using the packet capture with specific filter and verify the global counters to see if there is a packet drop at firewall. Based on the counters you can troubleshoot further.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTJCA0