topic Re: Two Layers - Order rule issues in Firewall and Security Management

Two Layers - Order rule issues

carlosgeib — Sun, 10 May 2020 23:51:28 GMT

Hi Checkmaters.

I had a very strange problem. I have a firewall policy with two layers, one for firewall rules and other for app control and url filtering. (layer.jpeg)

The CleanUp rule in the second layer is Accept. (cleanup_accept.jpeg)

A specific traffic was being accepted in the cleanup rule, but it was intermittent, sometimes working, sometimes not. (cleanup_accept_log.jpeg).

In a desperate attempt to solve the problem, I created a specific rule in the top of the second layer to deal with this traffic. For my surprise, the problem was solved, the traffic worked perfectly. (specific_rule.jpeg and specific_rule_log.jpeg)

What happened? I have no idea! Has anyone had this problem? Do you have any idea why this happened?

Thank you!

PS: version R80.30, take 111.

Re: Two Layers - Order rule issues

PhoneBoy — Mon, 11 May 2020 01:59:33 GMT

When it was matching on a different rule (before you added the specific rule) what rule did it match on?
Note that evaluation against the rulebase is a continual process and if the stream looks like a different app later on, and a different, earlier rule matches, it will apply instead.
This is by design.

Re: Two Layers - Order rule issues

carlosgeib — Mon, 11 May 2020 07:28:45 GMT

It was matching in the CleanUp Rule, whose action is Accept.

There was no policy change that could impact.

Re: Two Layers - Order rule issues

PhoneBoy — Mon, 11 May 2020 13:16:44 GMT

The policy didn't change but the traffic stream clearly did in how it was identified.
I'm also not clear from your explanation either what rule it was supposed to match or what rule was matching instead when things stopped working.