cancel
Showing results for 
Search instead for 
Did you mean: 
Post a Question

Mapping Rule numbers from R80.20 to fwaccel stat output

Jump to solution

Hello,

we have VSX Gateways with R77.30 managed by R80.20. On one VS, acceleration is disabled according to fwaccel stat.

Accelerator Status : on
Accept Templates   : disabled by Firewall
                     disabled from rule #112
Drop Templates     : enabled
NAT Templates      : disabled by user

However, we see no reason for this in rule 1.112, and even moved this rule. The status did not change, neither did the rule number diabling acceleration. We found sk62323, and the note regarding R80 to add/substract one from the rule number. But the surrounding rules also dont look like they could disable acceleration.

How can we map the Rule number from R80.20 Policy to the gateway?

Regards, Arne

0 Kudos
1 Solution

Accepted Solutions
Admin
Admin

Re: Mapping Rule numbers from R80.20 to fwaccel stat output

Jump to solution

I believe you’ll find the relevant files in the backward compatibility directories for R77 (not in $FWDIR/conf).

0 Kudos
6 Replies
Danny
Jade

Re: Mapping Rule numbers from R80.20 to fwaccel stat output

Jump to solution

To understand, which rule exactly prevents SecureXL from creating Accept Templates:

  1. Open the policy files on Security Management Server / Domain Management Server:

    • $FWDIR/conf/<Security_Policy_Name>.pf
    • $FWDIR/conf/<Security_Policy_Name>.set
  2. Search for '(rule-N', where N is the rule number in the output of 'fwaccel stat'.

  3. Note the 'name' of the calculated rule within policy files.

  4. Search for 'name' within your SmartConsole rulebase (might be a completely different number to the calculated number within the policy files).
0 Kudos

Re: Mapping Rule numbers from R80.20 to fwaccel stat output

Jump to solution

Hello,

 

there is no $FWDIR/conf/<Security_Policy_Name>.pf File. And the $FWDIR/conf/<Security_Policy_Name>.set was not updated since we upgraded the MDS from R77.30 to R80.20:

-rw-rw-r-- 1 admin root   15528060 Nov 28 12:36 Standard.set

So I guess Policy Compliation changed significantly with R80, not leaving this file any more.

Any other hints or ideas?

0 Kudos
Danny
Jade

Re: Mapping Rule numbers from R80.20 to fwaccel stat output

Jump to solution

Try $FWDIR/state/local/FW1/local.rule

0 Kudos
Admin
Admin

Re: Mapping Rule numbers from R80.20 to fwaccel stat output

Jump to solution

I believe you’ll find the relevant files in the backward compatibility directories for R77 (not in $FWDIR/conf).

0 Kudos

Re: Mapping Rule numbers from R80.20 to fwaccel stat output

Jump to solution

Thank you for the reminder. We did indeed find the file under $R77CMPDIR of the CMA, found that rule #112 was indeed rule #1.112. And seeing the full rule, I realized I had hidden the "time" column in my SmartConsole.

There was a time object limiting validity, and removing this re-enabled acceleration.

0 Kudos
Danny
Jade

Re: Mapping Rule numbers from R80.20 to fwaccel stat output

Jump to solution

I'm glad we could help you.