topic Re: Policy Installation in Firewall and Security Management

Policy Installation

joc — Wed, 15 May 2019 11:25:27 GMT

Hi,

We have noticed that during a policy installation our incoming traffic from the internet is not getting through the firewall. We then receive alerts from site 24x7 that they are unable to connect/monitor our website.

We have also seen our internal monitoring server getting timeouts when trying to perform its checks (ping, telnet, etc,) against our web servers, again only during a policy install on the FW's

We are running version 80.10 on all FW's

Thanks,

John

Re: Policy Installation

PhoneBoy — Mon, 20 May 2019 19:08:20 GMT

Depending on how much traffic your gateway is passing, this may happen.
This is because there is a period of time during the policy installation process where SecureXL needs to be refreshed with the updated new policy, which causes all traffic to go through F2F (slowpath).
This is one of the things that was fixed with the redesign of SecureXL in R80.20 and above.

Re: Policy Installation

Timothy_Hall — Mon, 20 May 2019 22:26:13 GMT

Unless your monitoring system is cranked up to a ridiculous level of sensitivity, you normally shouldn't have disruptions during policy loads that last long enough to cause the effects you are seeing. This assumes of course that you have a properly sized gateway for your traffic load, what model numbers are we talking here (let me take a guess - 3200 or lower) and about how much traffic are they pushing?

Re: Policy Installation

tpoole_global — Mon, 20 May 2019 23:24:35 GMT

Please add more specifics related to policy, type of traffic, load, appliance, etc. It;s hard to respond to a non-detailed question