I'm experiencing an issue where same traffic(same source, source port, destination and destination port) is being accepted by a rule and also being dropped by cleanup rule.
Accept traffic settings:
Accepted by rule 121 with TCP Service Object - "MS-SQL-Server" (Protocol set to None and Match by Port 1433, Override global domain settings is chosen in 'Advanced' Tab). We have NAT happening on this traffic
Source:10.208.34.143 Destination:10.247.158.45 Service: MS-SQL-Server . This is being NAtted to SNAT:160.xx.xx.xx DNAT: 10.154.204.xx
We have static route on the firewall for both original destination and Natted destination as below
10.247.158.0/24 to x.x.x.x
10.154.204.0/24 also to x.x.x.x
The traffic is being accepted and natted ( we see this on CLM logs) but right below that we also see traffic being dropped. The only difference is accept traffic is on 'Mgmt' interface and dropped traffic is on another interface 'eth3'.
The gateways are on R80.20
Any thoughts on why this is happening ?