cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post
Jon_Dyke
Nickel

Drops on accept rule

Hi All

I am currently having a very odd issue that I cannot get to the bottom of on pair of R80.10 gateways.  I am seeing 'weird drops' on rules which are actually accept rules.

Here is one example:-

I open a browser on 192.168.3.14 and go to Intel.com. 

The site opens ok but :-

fw ctl zdebug drop | grep 192.168.3.14

shows:-

;[cpu_0];[fw4_1];fw_log_drop_ex: Packet proto=6 192.168.3.14:50702 -> 34.238.108.124:443 dropped by fw_send_log_drop Reason: Rulebase drop - on layer "Site0-Simplified-Policy Secur" rule 3;

Rule 3 is an accept rule!!!!

Any help appreciated.

Thanks

Jon

12 Replies
Maik
Silver

Re: Drops on accept rule

Hey Jon,

Hm indeed, sounds weird.

Can you please verify the currently installed policy on the related security gateway with "fw stat" and check if the install date matches the latest policy changes?

If that's not the case try to push the current policy. Also; what does Smartview Monitor show you in the logging section? If there aren't any logs verify that logging is enabled for the related rule.

Another thing; how exactly does your rule look like?

Regards,

Maik

0 Kudos

Re: Drops on accept rule

Seen this in 77.30 a couple of times, every time it was related to IPS.

You will need to open a TAC ticket to see what is really going on.

Regards, Maarten
0 Kudos

Re: Drops on accept rule

In R80.10 the signature dropping this traffic on an accept rule is almost certainly located under "Inspection Settings" and not IPS assuming there is not a separate IPS log entry.

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

"IPS Immersion Training" Self-paced Video Class
Now Available at http://www.maxpowerfirewalls.com

Re: Drops on accept rule

No, IPS drop will be shown in a different debug message. It will not be "rulebase drop"

0 Kudos

Re: Drops on accept rule

What does the log card say

Jon_Dyke
Nickel

Re: Drops on accept rule

Thanks for the responses.  I have the IPS blade on a limited scope at the moment as I am testing so I will try disabling this to see if this makes a difference.

The rule is actually one of the mgmt rules where a few host groups have access to the FW cluster and gateway addresses.

 

It has nothing to do with with outbound access at all which is why I am confused at to why its even:-

a: this rule is getting involved at all

b: its an accept rules anyway so should not be dropping

There is nothing in the logs BTW - I only see the drops when using fw ctl zdebug 

Jon

0 Kudos

Re: Drops on accept rule

Hey Jon, Did you find the root cause of the issue ? we are having the same issue where firewall drop https packet on accept rule. 

0 Kudos

Re: Drops on accept rule

FW kernel does not read rule numbers from the policy package. It is only counting rules applied to a particular GW. If you are using something other than "Policy targets" in the "Install On" column, it might be rule other than number 3 in the policy package. 

If this is not the case, check the policy name installed on the GW and the date it was installed on. It might be that some rules were inserted or removed afterwards but policy was not re-applied. 

For "rulebase drop" there is no chance it is dropped on accept.

0 Kudos
Highlighted
Employee+
Employee+

Re: Drops on accept rule

Please open a a support ticket for the issue

Employee
Employee

Re: Drops on accept rule

Hi,

have you resolved this issue ? 

I am seeing the same behavior on a customer of mine.

Rule worked on when the cluster was managed by R80.10 SMS . we moved the cluster to an MDS with the same policy and the traffic was dropped by the same rule.

0 Kudos
nirm1
Ivory

Re: Drops on accept rule

Hi,

did anyone solved this ? having same issue on my site, r80.10 take 204.

0 Kudos
Alan_Long
Ivory

Re: Drops on accept rule

I am having same issue after upgrade from R77.30 to R80.10 Jumbo 203, note none of our R80.10 with Jumbo 154 have this issue
0 Kudos