Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Jon_Dyke
Contributor

Drops on accept rule

Hi All

I am currently having a very odd issue that I cannot get to the bottom of on pair of R80.10 gateways.  I am seeing 'weird drops' on rules which are actually accept rules.

Here is one example:-

I open a browser on 192.168.3.14 and go to Intel.com. 

The site opens ok but :-

fw ctl zdebug drop | grep 192.168.3.14

shows:-

;[cpu_0];[fw4_1];fw_log_drop_ex: Packet proto=6 192.168.3.14:50702 -> 34.238.108.124:443 dropped by fw_send_log_drop Reason: Rulebase drop - on layer "Site0-Simplified-Policy Secur" rule 3;

Rule 3 is an accept rule!!!!

Any help appreciated.

Thanks

Jon

12 Replies
Maik
Advisor

Hey Jon,

Hm indeed, sounds weird.

Can you please verify the currently installed policy on the related security gateway with "fw stat" and check if the install date matches the latest policy changes?

If that's not the case try to push the current policy. Also; what does Smartview Monitor show you in the logging section? If there aren't any logs verify that logging is enabled for the related rule.

Another thing; how exactly does your rule look like?

Regards,

Maik

0 Kudos
Maarten_Sjouw
Champion
Champion

Seen this in 77.30 a couple of times, every time it was related to IPS.

You will need to open a TAC ticket to see what is really going on.

Regards, Maarten
0 Kudos
Timothy_Hall
Legend Legend
Legend

In R80.10 the signature dropping this traffic on an accept rule is almost certainly located under "Inspection Settings" and not IPS assuming there is not a separate IPS log entry.

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
_Val_
Admin
Admin

No, IPS drop will be shown in a different debug message. It will not be "rulebase drop"

0 Kudos
Tomer_Sole
Mentor
Mentor

What does the log card say

Jon_Dyke
Contributor

Thanks for the responses.  I have the IPS blade on a limited scope at the moment as I am testing so I will try disabling this to see if this makes a difference.

The rule is actually one of the mgmt rules where a few host groups have access to the FW cluster and gateway addresses.

 

It has nothing to do with with outbound access at all which is why I am confused at to why its even:-

a: this rule is getting involved at all

b: its an accept rules anyway so should not be dropping

There is nothing in the logs BTW - I only see the drops when using fw ctl zdebug 

Jon

0 Kudos
vikas_mandhan
Explorer

Hey Jon, Did you find the root cause of the issue ? we are having the same issue where firewall drop https packet on accept rule. 

0 Kudos
_Val_
Admin
Admin

FW kernel does not read rule numbers from the policy package. It is only counting rules applied to a particular GW. If you are using something other than "Policy targets" in the "Install On" column, it might be rule other than number 3 in the policy package. 

If this is not the case, check the policy name installed on the GW and the date it was installed on. It might be that some rules were inserted or removed afterwards but policy was not re-applied. 

For "rulebase drop" there is no chance it is dropped on accept.

0 Kudos
Tal_Ben_Avraham
Employee
Employee

Please open a a support ticket for the issue

Nir_Shamir
Employee Employee
Employee

Hi,

have you resolved this issue ? 

I am seeing the same behavior on a customer of mine.

Rule worked on when the cluster was managed by R80.10 SMS . we moved the cluster to an MDS with the same policy and the traffic was dropped by the same rule.

0 Kudos
nirm1
Explorer

Hi,

did anyone solved this ? having same issue on my site, r80.10 take 204.

0 Kudos
Alan_Long
Participant

I am having same issue after upgrade from R77.30 to R80.10 Jumbo 203, note none of our R80.10 with Jumbo 154 have this issue
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events