implied rules getting hit and dropping traffic

[Roy_Smith]

Hi

Started migrating vlans from an internal Cisco ASA to a new VSX cluster. I am now getting some intermittent reports of applications or servers not connecting as expected. When I look through the logs, I see lots of drops related to an implied rule. This is hit by different sources and destinations and different ports. 

After following sk110218, I am able to see the implied rule name, which is "Implied Rule - enforce_net_quota". The name of this rul seems to indicate I'm hitting some sort of limit but not sure what.

Can anyone tell me what enforce_net_quota refers to please?

Many Thanks
Roy

[Danny · Accepted solution]

Try turning off Network Quota and verify if this helps.

[the_rock]

Can you send screencap of it if possible? I checked sk you mentioned, but does not sadly seem too useful here. I also saw what @Danny suggested, but cant find that protection even in my R81.20 lab with updated IPS.

Searching CP support site, cant find much on it, so might be worth if you do zdebug to verify if you get exact same messages. We might be able to figure out from those drops if there is indeed actual IPS protection causing an issue.

Andy

[PhoneBoy · Accepted solution]

This is definitely the Network Quota protection, which is inactive by default.
You can do one of two things:

• Disable it by going to Security Policies > Inspection Settings and setting it to Inactive for the relevant profile
• Create an exception for the relevant traffic in the protection

Changing this setting requires pushing the Access Policy (not Threat Prevention) since this is a Core Protection handled by the firewall (not IPS).

[the_rock]

Ah, inspection setting, thats why I could not find it...duh, silly me. Anyway, let us know @Roy_Smith if what phoneboy suggested works.

[Roy_Smith]

Guys

It was the Network Quota in Inspections Settings that was being referred to. I set it back to inactive and that solved the issue. 

Thanks for the help

[PointOfChecking]

Hi PhoneBoy,

Any reason why the default for this setting is disabled? I've found it as enabled in my environment and was thinking it could be useful to fend off DoS attacks?

Thank you

[PhoneBoy]

Network Quota has a performance impact of Critical, which is why it is disabled by default.
If you're looking to mitigate DoS attacks, you're far better off using fwaccel dos, which is SecureXL friendly.
See: https://support.checkpoint.com/results/sk/sk112454 

[PointOfChecking]

Will look into this. Thank you.