About bfarely

bfarely · ‎06-27-2017

This is actually common. The end type log is the traffic log indicating the traffic matched an allow policy . If you Look at the security policy it will break down from left to right with each field as an AND condition up to the action field which is allow or deny. After determining if the traffic is allowed it applies the threat profiles which generate an action in the threat logs in this case "dropped" In the threat log details you are seeing the associated traffic log which had the allow action which only indicates the traffic matched an allow policy.

bfarely · ‎02-24-2015

Hi Tician, First of all I would recommend opening a case with tech support. There are a few things that could go wrong here so I would start with the traffic logs. If you have an explicit rule in place there should be logging for the session to verify it is allowed and the log details will confirm if packets are being sent and received. Assuming everything looks ok here try running a packet capture with filters for both directions (.10 to .15 and vice versa) and all 4 stages set. The drop stage will show if anything is being dropped out and counters may give the reason for any drops. This doc should help with setting up the filters and checking the counters. Packet Capture, Debug Flow-basic and Counter Commands regards, Brandon

Member Since	‎07-05-2013 01:05 PM
Date Last Visited	‎05-17-2019 10:18 AM
Posts	50

Online Status	Offline
Date Last Visited	‎05-17-2019 10:18 AM

About bfarely

Re: Threat been dropped and yet allowed on the next try?

Re: L3 gateway Interface traffic relaying

Threat been dropped and yet allowed on the next try?

Re: GlobalProtect issue

Re: Threat been dropped and yet allowed on the next try?

Re: L3 gateway Interface traffic relaying