topic Re: Unexpected rejection of NTP traffic by URLF in General Topics

Unexpected rejection of NTP traffic by URLF

Vladimir — Wed, 24 Mar 2021 19:34:23 GMT

Can anyone tell me the reason I am seeing NTP traffic being bagged by the gateway?

NTP is not listed as the service associated with the Facebook and it is actually an Apple's service/domain:

Re: Unexpected rejection of NTP traffic by URLF

HeikoAnkenbrand — Thu, 25 Mar 2021 10:15:10 GMT

try the following:
1) Create a clone of the service ntp-udp
2) Enable "Protocol Signature"
3) Use the new service ntp-udp_Clone in the ruleset.

This limits the PSL analysis only to UDP port 123.

Re: Unexpected rejection of NTP traffic by URLF

Vladimir — Thu, 25 Mar 2021 21:18:59 GMT

Thanks @HeikoAnkenbrand , but this does not explain why it was rejected in the first place, which is what I am trying to figure out:)

Re: Unexpected rejection of NTP traffic by URLF

PhoneBoy — Thu, 25 Mar 2021 21:59:49 GMT

Going to guess a bad signature got pushed out.

Re: Unexpected rejection of NTP traffic by URLF

Vladimir — Thu, 25 Mar 2021 22:01:54 GMT

You may want to alert relevant team about his one: either apple or NTP bound to have issues...

Re: Unexpected rejection of NTP traffic by URLF

the_rock — Thu, 25 Mar 2021 23:27:53 GMT

Hm...I see your point, thats very odd. Looking at your rule, it only shows app facebook,not any ntp services, so its not very logical as to why it would drop it on that rule. Did this just start happening recently or you ever noticed it before after you created the rule?

Andy

Re: Unexpected rejection of NTP traffic by URLF

Vladimir — Thu, 25 Mar 2021 23:39:17 GMT

Did not see it before, but then thi is a lab setup where I work out some issues for the clients or trying things out for myself. This gem manifested only after said rule was created.

Re: Unexpected rejection of NTP traffic by URLF

Avi_Bechor — Mon, 05 Apr 2021 11:04:15 GMT

Hi Vladimir,
I have contacted you in a private message which will help better understand your case. To my current understanding, the NTP detection worked as expected, but more details regarding your case and environment may be needed. Let's continue this offline
Thanks,
Avi