Intrazone rule - Can`t ssh

[Richard_M]

Hi,
We have a case where a person is trying to ssh from zone "Safe" to zone "Safe". The src (a backup orchistrator) and dst (a compute) are though in different subnet. In this case he is not able to connect, but can ping.
As I understand since the src and dst ip addresses are in the same zones, this traffic is going through the Intrazone rule, and should therefore be allowed? 

Does anyone know if there could be anything in the fw I need to check or is the problem another place?



 

[ozheng]

Hello Richard_M,

Can you enable the logging at session end for all rules including the default rules?
Once it is done, you can check in the traffic logs which rule is blocking the traffic.

Also I invite you to read/listen this PANCast Episode about the security rules.

Olivier

[Richard_M]

Hi @ozheng 
The logging is already enabled with "Log at Session End". In the traffic logs I can't see any log of either ssh or ping, even though it is reported that the ping is going through.

Thank you the link!

//Richard 

[ozheng · Accepted solution]

Hello Richard_M,

OK, on the firewall, you set a filter on the source/destination (and return traffic).

You turn the filter on.

You set the capture (1 distinct name for each stage).

You turn the capture on.

You initiate the SSH traffic.

You refresh the page on the firewall.

You see if there is any file for the drop stage.

If there is no receive file, the firewall is not even receiving the packet.

If there is no drop file, the firewall is not dropping the packet.

Olivier

[TomYoung]

Hi @Richard_M ,

Is SSH allowed in your Interface Management Profile applied to the "safe" interface?

Thanks,

Tom

[Richard_M]

Hi @ozheng 

Didn't receive any files when I ran the packet capture while ssh was in being run. Have asked the person to look at their config again. 

//Richard

[ozheng]

Hello Richard_M,

If there was no file captured, then the packets were not seen on the firewall.

By the way, don't forget to disable the capture (I forgot to mentioned in my previous message).

Olivier

[Richard_M]

Hi @ozheng 
Thank you for your help. I read that it was needed to turn the packet capture off, so that is done 🙂 

[Richard_M]

Hi @TomYoung 
It seem that Ping is the only one check for in the Interface Management Profile applied to that interface.
But since the ssh traffic is not droped or received when running the packet capture there should be an issue at the source side? 

I have to look more into if ssh should be allowed at that Interface Management Profile. 

//Richard

[TomYoung]

Hi @Richard_M ,

Sorry!  I thought you were trying to SSH to the IP address on the NGFW of the safe zone.  If you are trying to SSH to the NGFW, then you need to enable it in the management profile.

With regard to your issue, is the traffic going through 2 interfaces in the same zone on the NGFW?

Thanks,

Tom

[Richard_M]

Hi @TomYoung 
I don`t see the that specific traffic in the logs, but when I search for the src and dst ip`s one by one (with other ip addresses in the other end) in the traffic log, they both use the same interface. 

//Richard

[TomYoung · Accepted solution]

Hi @Richard_M ,

If both IP addresses are on the same subnet, they will talk directly to each other and not go through the NGFW.  Your SSH issue is a problem with the hosts, and not the NGFW.

Thanks,

Tom