Threat Prevention

[Aleksey135563]

   

Could you please tell me why the exclusion rule in the Threat Prevention policy might not be triggered? We configured an exclusion rule for Threat Emulation at the IP address src:10.216.5.184 dst:146.75.119.52 (for the resource download.postgresql.org), but judging by the ITU logs, the rule isn't triggered and traffic is being routed to emulation. Traffic to emulation is routed to the following devices in the screenshot.

 

[tankp]

I cannot determine from the screenshots whether the connection matched the exception rule. You can try clicking the "Add Exception" button in the connection's detailed log or consider creating a Global Exception rule.

[Aleksey135563]

[the_rock]

I dont see the gateway listed for policy install referenced in the other screenshot you attached. Maybe thats the reason? Im referring to one called fw-internet.

[Martijn · Accepted solution]

Hi,

Did you made a typo in the object's configuration?
Object name is 10.216.5.184 but is the configured IP correct?

Have had this before and could not find out why a rule was not hit. It was a typo in the objects configuration.

Martijn

[the_rock]

Excellent point @Martijn . I had seen that happen to few people before, definitely worth checking.

[Aleksey135563]

Thanks to everyone for the feedback, I'll try to make the rule using a different logic.

[the_rock]

There is absolutely nothing wrong with your logic. Just make sure as Martijn said IP is correct and also policy is installed on the right gateway.