topic Re: TCP Port 8082 dropped by implied rule 0 in General Topics

TCP Port 8082 dropped by implied rule 0

Cihat_Bulut — Tue, 05 Mar 2019 12:53:14 GMT

Hi,

In R80.20, when you have a tcp server accessed by tcp port 8082, it is dropped by CP implied rule 0.

TCP 8081,8083 … works, but 8082 not.

The SYN packet cannot be seen after Inbound VM chain. Anybody have an idea?

Re: TCP Port 8082 dropped by implied rule 0

Mark_Mitchell — Tue, 05 Mar 2019 12:59:08 GMT

Hi Cihat,

Are you able to share the Log entry relevant to the drop please?

Regards

Mark

Re: TCP Port 8082 dropped by implied rule 0

Cihat_Bulut — Tue, 05 Mar 2019 18:50:45 GMT

Unfortunately, there is no log entry. Only "fw ctl zdebug + drop" output. It is dropped by implied rule 0, nothing else.

Re: TCP Port 8082 dropped by implied rule 0

Mark_Mitchell — Tue, 05 Mar 2019 19:05:47 GMT

Within SmartConsole can you screen shot the service you created for 8082 please?

Would I be correct in assuming that you are not logging implied rules?

Regards

Mark

Re: TCP Port 8082 dropped by implied rule 0

Maarten_Sjouw — Tue, 05 Mar 2019 19:22:18 GMT

Is this by any chance a Cloudguard VM in Azure/AWS?

There are a number of SK's where there is the following line:

The following ports cannot be used: 444, 8082 and 8880.

I could not find why but it seems these ports have an internal use there.

Re: TCP Port 8082 dropped by implied rule 0

Cihat_Bulut — Wed, 06 Mar 2019 06:16:45 GMT

It is normal TCP service, nothing else. Add new service and just type 8082.

Re: TCP Port 8082 dropped by implied rule 0

Cihat_Bulut — Wed, 06 Mar 2019 06:19:13 GMT

I know it, but my system is appliance. You can test it on any appliance or in vm.

Re: TCP Port 8082 dropped by implied rule 0

Mark_Mitchell — Wed, 06 Mar 2019 16:47:12 GMT

It may be worth getting a TAC case raised to investigate further. Have you had a look at the implied rules to see if the traffic matches anyone of those? If I get time this evening, I'll have a further look for you.

Regards

Mark

Re: TCP Port 8082 dropped by implied rule 0

Mark_Mitchell — Wed, 06 Mar 2019 21:53:53 GMT

I had a quick check and I cannot see any implied rules that would cause your traffic to be blocked.

If you have a hardware appliance with SecureXL on, you could try turning off SecureXL and seeing if you can see anything further within fw monitor. I would recommend just checking your current loading, as if you box is already highly utilized you will want to disable during a maintenance window.

If you don't see anything further with SecureXL disabled, then I would suggest raising a TAC case.

Regards

Mark

Re: TCP Port 8082 dropped by implied rule 0

PhoneBoy — Thu, 07 Mar 2019 02:13:18 GMT

I belive those ports are used internally (specifically for MultiPortal).

As such they cannot be used in this context and a different port should be used.

Re: TCP Port 8082 dropped by implied rule 0

Cihat_Bulut — Thu, 07 Mar 2019 07:08:42 GMT

The exact scenario is;

GW External IP:8082 -> Static NAT -> Server internal IP:8082

I have tested in two different environment, one is fresh appliance and the other is in vm.

Re: TCP Port 8082 dropped by implied rule 0

Cihat_Bulut — Thu, 07 Mar 2019 07:44:57 GMT

You can use any port, but please document it. Because my customer spent 5 hours to discover this issue. At the end, replaced the port.