topic Re: Some traffic not showing up in the logs in Firewall and Security Management

Some traffic not showing up in the logs

P_M — Wed, 14 Dec 2022 22:47:03 GMT

Hello,

We have a Security Gateway with version R81.10 and SecureXL enabled on the "Secure" Interfaces (DMZ interfaces).

We are troubleshooting SIP traffic issues with traffic going through one of the DMZ interfaces.

When we generate traffic, most specifically UDP traffic, some of the traffic, but not all of the traffic appears in the logs?

I am wondering if this is due to the SecureXL being enabled therefore not all allowed traffic is inspected (logged).

Or could there be a problem somewhere else that causes not all traffic to be visible in the logs.

Thanks and Kind regards

Re: Some traffic not showing up in the logs

the_rock — Wed, 14 Dec 2022 23:02:37 GMT

You could disable sxl to make sure, but that should not cause traffic not being visible in the logs, at least I had never seen that.

Re: Some traffic not showing up in the logs

PhoneBoy — Wed, 14 Dec 2022 23:09:33 GMT

Just because something is accelerated with SecureXL doesn't mean it won't get logged.
It could also be logged differently than you expect as well.

How precisely did you determine some UDP traffic wasn't logged?
Is the traffic that you're seeing as "not logged" related to SIP?
What precise Access Policy rules are allowing the traffic?

Re: Some traffic not showing up in the logs

Chris_Atkinson — Wed, 14 Dec 2022 23:58:14 GMT

One known occurrence would be if the same traffic was being seen by the gateway twice unexpectedly (sk172204) but that's not specific to VoIP rather a topology or routing issue.

Re: Some traffic not showing up in the logs

Chris_Atkinson — Thu, 15 Dec 2022 00:05:03 GMT

Which JHF take is installed?

T75 or higher fixes an issue with VOIP (MGCP) traffic PRJ-40930,PRJ-40928

Additionally sk177365 is also going to be addressed in an upcoming take refer PRJ-28732, PRHF-11703.

To verify if either is relevant please consult TAC to debug further.