- Local User Groups
Welcome to CheckMates
Journey to the Cloud with Confidence!
Webinar: Wed 10 June @ 8am PT | 11am ET
I am Gil Shwed
Ask Me Anything!
for working from home
APT41 and Living Off The Land
I am currently having a very odd issue that I cannot get to the bottom of on pair of R80.10 gateways. I am seeing 'weird drops' on rules which are actually accept rules.
Here is one example:-
I open a browser on 192.168.3.14 and go to Intel.com.
The site opens ok but :-
fw ctl zdebug drop | grep 192.168.3.14
;[cpu_0];[fw4_1];fw_log_drop_ex: Packet proto=6 192.168.3.14:50702 -> 126.96.36.199:443 dropped by fw_send_log_drop Reason: Rulebase drop - on layer "Site0-Simplified-Policy Secur" rule 3;
Rule 3 is an accept rule!!!!
Any help appreciated.
Hm indeed, sounds weird.
Can you please verify the currently installed policy on the related security gateway with "fw stat" and check if the install date matches the latest policy changes?
If that's not the case try to push the current policy. Also; what does Smartview Monitor show you in the logging section? If there aren't any logs verify that logging is enabled for the related rule.
Another thing; how exactly does your rule look like?
In R80.10 the signature dropping this traffic on an accept rule is almost certainly located under "Inspection Settings" and not IPS assuming there is not a separate IPS log entry.
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com
Thanks for the responses. I have the IPS blade on a limited scope at the moment as I am testing so I will try disabling this to see if this makes a difference.
The rule is actually one of the mgmt rules where a few host groups have access to the FW cluster and gateway addresses.
It has nothing to do with with outbound access at all which is why I am confused at to why its even:-
a: this rule is getting involved at all
b: its an accept rules anyway so should not be dropping
There is nothing in the logs BTW - I only see the drops when using fw ctl zdebug
FW kernel does not read rule numbers from the policy package. It is only counting rules applied to a particular GW. If you are using something other than "Policy targets" in the "Install On" column, it might be rule other than number 3 in the policy package.
If this is not the case, check the policy name installed on the GW and the date it was installed on. It might be that some rules were inserted or removed afterwards but policy was not re-applied.
For "rulebase drop" there is no chance it is dropped on accept.
have you resolved this issue ?
I am seeing the same behavior on a customer of mine.
Rule worked on when the cluster was managed by R80.10 SMS . we moved the cluster to an MDS with the same policy and the traffic was dropped by the same rule.