topic Re: Private traffic match Internet Object in Firewall and Security Management

Private traffic match Internet Object

FWNinja — Mon, 23 Nov 2020 22:28:09 GMT

Hi guys,

specific traffic with a private ip as destination, is matching a rule with the "Internet" object in destination field. This traffic don't pass trough External/DMZ interfaces.

Do you have any ideas?

Thanks and best regards

Francesco

Re: Private traffic match Internet Object

PhoneBoy — Mon, 23 Nov 2020 22:37:05 GMT

Version/JHF level?
What is the precise rule (screenshot helpful)?
What interfaces does the traffic pass through and how is the topology defined on the relevant interfaces?

Re: Private traffic match Internet Object

HristoGrigorov — Tue, 24 Nov 2020 04:40:54 GMT

Yeah, give us some more info. For example if it is a private IP but in a peer VPN domain it will be considered external (Internet).

Re: Private traffic match Internet Object

FWNinja — Tue, 24 Nov 2020 08:39:30 GMT

R80.30 take_219 installed.

I attached screenshots.

The traffic pass through "Internal" interfaces ("This Network" in the topology).

Thanks and Best Regards

Francesco

Re: Private traffic match Internet Object

FWNinja — Tue, 24 Nov 2020 08:40:49 GMT

It's not a VPN traffic.

I attached screenshots in the previous reply.

Thanks and Best Regards

Francesco

Re: Private traffic match Internet Object

_Val_ — Tue, 24 Nov 2020 08:53:14 GMT

Quoting from sk64543:

"Internet" means "include all traffic directed to External or DMZ according to gateway topology".

Internet object, unlike many people expect, do not represent all routable Internet addresses. Instead, it is a sum if all networks that GW does not have defined as internal.

Check your internal networks in question are defined in GW topology. If this is not the case, system is working as designed.

Re: Private traffic match Internet Object

FWNinja — Tue, 24 Nov 2020 08:59:49 GMT

Hi,

Traffic is passing through interfaces defined as "This network" or internal.

So, this traffic should not match policies configured with Internet object in destination field.

Thanks

Francesco

Re: Private traffic match Internet Object

_Val_ — Tue, 24 Nov 2020 09:02:33 GMT

We cannot establish that, since you did not post your GW topology. If you are 100% positive that is the case, raise a TAC support request.

Re: Private traffic match Internet Object

FWNinja — Tue, 24 Nov 2020 10:34:45 GMT

I attached screenshots.

Thanks

Francesco

Re: Private traffic match Internet Object

_Val_ — Tue, 24 Nov 2020 10:59:23 GMT

Already said above, open a service request.

Re: Private traffic match Internet Object

Ilya_Yusupov — Tue, 24 Nov 2020 13:30:05 GMT

Hi @FWNinja ,

according to log detail screen shot you matched on Rule 140 but you put screen shot of rule 142.

can you share rule 140?

Thanks,

Ilya

Re: Private traffic match Internet Object

FWNinja — Tue, 24 Nov 2020 13:37:07 GMT

Hi,

the rule is the same. The customer added 2 rules before and the rule 140 become 142.

Thanks

Francesco