topic Re: Mapping Rule numbers from R80.20 to fwaccel stat output in General Topics

Mapping Rule numbers from R80.20 to fwaccel stat output

Arne_Boettger — Thu, 20 Dec 2018 10:05:36 GMT

Hello,

we have VSX Gateways with R77.30 managed by R80.20. On one VS, acceleration is disabled according to fwaccel stat.

Accelerator Status : on
Accept Templates   : disabled by Firewall
                     disabled from rule #112
Drop Templates     : enabled
NAT Templates      : disabled by user

However, we see no reason for this in rule 1.112, and even moved this rule. The status did not change, neither did the rule number diabling acceleration. We found sk62323, and the note regarding R80 to add/substract one from the rule number. But the surrounding rules also dont look like they could disable acceleration.

How can we map the Rule number from R80.20 Policy to the gateway?

Regards, Arne

Re: Mapping Rule numbers from R80.20 to fwaccel stat output

Danny — Thu, 20 Dec 2018 11:26:31 GMT

To understand, which rule exactly prevents SecureXL from creating Accept Templates:

Open the policy files on Security Management Server / Domain Management Server:
- $FWDIR/conf/<Security_Policy_Name>.pf
- $FWDIR/conf/<Security_Policy_Name>.set
Search for '(rule-N', where N is the rule number in the output of 'fwaccel stat'.
Note the 'name' of the calculated rule within policy files.
Search for 'name' within your SmartConsole rulebase (might be a completely different number to the calculated number within the policy files).

Re: Mapping Rule numbers from R80.20 to fwaccel stat output

Arne_Boettger — Thu, 20 Dec 2018 11:35:56 GMT

Hello,

there is no $FWDIR/conf/<Security_Policy_Name>.pf File. And the $FWDIR/conf/<Security_Policy_Name>.set was not updated since we upgraded the MDS from R77.30 to R80.20:

-rw-rw-r-- 1 admin root 15528060 Nov 28 12:36 Standard.set

So I guess Policy Compliation changed significantly with R80, not leaving this file any more.

Any other hints or ideas?

Re: Mapping Rule numbers from R80.20 to fwaccel stat output

Danny — Thu, 20 Dec 2018 11:50:12 GMT

Try $FWDIR/state/local/FW1/local.rule

Re: Mapping Rule numbers from R80.20 to fwaccel stat output

PhoneBoy — Fri, 21 Dec 2018 02:17:12 GMT

I believe you’ll find the relevant files in the backward compatibility directories for R77 (not in $FWDIR/conf).

Re: Mapping Rule numbers from R80.20 to fwaccel stat output

Arne_Boettger — Fri, 21 Dec 2018 08:21:51 GMT

Thank you for the reminder. We did indeed find the file under $R77CMPDIR of the CMA, found that rule #112 was indeed rule #1.112. And seeing the full rule, I realized I had hidden the "time" column in my SmartConsole.

There was a time object limiting validity, and removing this re-enabled acceleration.

Re: Mapping Rule numbers from R80.20 to fwaccel stat output

Danny — Fri, 21 Dec 2018 09:11:38 GMT

I'm glad we could help you.