Recently one of the 3rd parties we connect to moved their services to AWS and as a result we identified an issue connecting to their site. We checked the logs and could see the allowed https traffic going to AWS, however we were unable to see any other dropped traffic to AWS. From further investigation we were able to identify that the traffic to connect for the CRL check on port 80 could be seen from a packet capture taken from the firewall, however this was was not showing in the logs despite no rules to allow access e.g., we were expecting to see this as dropped in the logs. After updating the policy to allow this traffic it is now showing in the logs as allowed.
We are currently running R81.10 on a VSX platform.
Has anyone else come across this situation whereby crl traffic is not showing as being dropped in the firewall logs but does appear in a packet capture?
