Service object shown in logging vs policy

[marki]

Hey there, Maybe someone can point me in the right direction trying to understand logs.

This is what logging on a specific source ip looks like:

• flow from .107 to .113 on TCP/102 is allowed and shows "ICCP"
• flow from .107 to .111 on TCP/102 is rejected and shows a custom service definition (don't know why that was set up for the same port)

The custom service is set as "match for Any"

Now the questions are
1) Why does the allowed flow show ICCP as the service while rule 156 contains the custom service definition and not ICCP?
2) Why does the reject flow show the custom service?

Thanks.

[PhoneBoy]

Think of it as a "reverse resolution" issue.
What information is stored for a firewall rule log is the connection 5-tuple (among other meta data).
When SmartView renders the log entry, it has to turn the destination port into a service.
Since you have multiple services defined with the same port, it will pick one of them to display.

I assume the resolution process is different for “accept” traffic versus “reject” traffic thus why you see different results.
You could open a TAC case for this, but I suspect this is expected behavior.