topic Re: R80(.20) rule matching in Firewall and Security Management

R80(.20) rule matching

Hugo_vd_Kooij — Thu, 08 Nov 2018 12:44:05 GMT

I was a bit surprised by the rule matching logic in R80(.20).

I have a parent rule for Internal to DMZ traffic:

And a parent rule for Internal to Internal traffic:

In the Internal to Internal policy I have a rule for my Active Directory traffic:

But as I missed a protocol in this bunch the traffic was dropped. But not on the rule I expected it to be dropped on:

So why would it drop on the wrong rule here?

There seems to be an inconsistence in the logging as it goes from Internal to Internal on the left hand but on the right hand it declares it from Internal to DMZ.

Can anyone explain why this inconsistence behaviour occurs?

Re: R80(.20) rule matching

Vladimir — Thu, 08 Nov 2018 13:12:02 GMT

Hugo,

The only thing that comes to mind is if your DMZs IPv6 scope is including the destination, but there is likely a mechanism that should prevent it from happening.

Re: R80(.20) rule matching

Tal_Ben_Avraham — Thu, 08 Nov 2018 14:33:43 GMT

Hi,

Please verify your topology configuration. If it is configured correctly please open a support ticket.

Thanks,

Tal