Logs from External Firewall on a Different Segement is not Showing up

[SecurityNed]

Hello Everyone,

I have a laboratory wherein I have an external firewall and an internal firewall managed by a single Smart-1 appliance residing in the internal network side. Please see diagram below:

I'm able to see logs comfing from CP FW INT, but not from CP FW EXT. Connectivity from Smart-1 to CP FW EXT is fine as I'm able to push policies to it. On the Log tab on the side of the CP FW EXT firewall, the setting is logs should be forward to the Smart-1 appliance.

Am I missing something or is there any peculiarities in this setup? This is a first on my end so im currerntly confused.

Hoping for the community inisght on this.

[Amir_Senn · Accepted solution]

Do you have a NAT rule defined on MGMT host?

[SecurityNed]

Hello @Amir_Senn

No NAT rules related to the MGMT host IP yet.

May I know what configuration am I lacking?

[AmirArama]

since you have two ip addresses on your MGMT server (is that correct?) i assume in the mgmt host object the MGMT server is configured with it's internal IP, and the external FW attempt to send the logs to this internal IP, but maybe don't have the correct route to it (or the correct anti spoofing configuration on that interface in order not to drop the replies from the mgmt internal IP)

it's just an assumption of what can go wrong in this topology.

can you confirm if this is the case?

[SecurityNed]

Hello @AmirArama

since you have two ip addresses on your MGMT server (is that correct?) -> Yes, I have 192.168.4.23 and 172.16.16.250 configured in my MGMT interface.
mgmt host object the MGMT server is configured with it's internal IP -> Yes,  this is correct as well.

I want to add to the diagram btw, Both internal and external firewalls are connected physicall, (Internal FW  via WAN port, External FW via an internal interface)

EDIT:

I might have thought about something, do I need to put the 192.168.4.0/24 network on the inteface topology? What I'm scared about this is if I'll add it, I might break the connectivity from my MGMT to the External FW.

[Amir_Senn]

External FW has a route to 192.168.4.0/24?

[SecurityNed]

@Amir_Senn 

Yes, but it is through the connection between Internal FW and External FW:

[AmirArama · Accepted solution]

so you might have asymmetry,

the external GW go via the internal GW, and the reply from MGMT going directly to the external GW maybe.

bottom line, topology needs to be examined. run 'tcpdump/fw monitor' on all GWs and mgmt to understand how the traffic flows.

run fw ctl zdebug + drop on all GWs on maintenance window to see if & who drops the traffic. (reset with 'fw ctl debug 0')

consider changing the topology. if not, at least make sure all your connections from/to mgmt routed in symmetric way.

[SecurityNed]

Hello @Amir_Senn, @AmirArama,

Thank you for your insight as I was able to resolve this. I have created a destination route in my External FW in this manner: Destination: MGMT, Gateway: 172.16.16.254, and all External FW logs are now seen in the SMS.

Thank you so much!