Private traffic match Internet Object

[FWNinja]

Hi guys,

specific traffic with a private ip as destination, is matching a rule with the "Internet" object in destination field. This traffic don't pass trough External/DMZ interfaces.

Do you have any ideas?

Thanks and best regards

Francesco

[PhoneBoy]

Version/JHF level?
What is the precise rule (screenshot helpful)?
What interfaces does the traffic pass through and how is the topology defined on the relevant interfaces?

[FWNinja]

R80.30 take_219 installed.

I attached screenshots.

The traffic pass through "Internal" interfaces ("This Network" in the topology).

Thanks and Best Regards

Francesco

[_Val_]

Quoting from sk64543:

"Internet" means "include all traffic directed to External or DMZ according to gateway topology".

Internet object, unlike many people expect, do not represent all routable Internet addresses. Instead, it is a sum if all networks that GW does not have defined as internal.

Check your internal networks in question are defined in GW topology. If this is not the case, system is working as designed.

[FWNinja]

Hi,

Traffic is passing through interfaces defined as "This network" or internal.

So, this traffic should not match policies configured with Internet object in destination field.

Thanks

Francesco

[_Val_]

We cannot establish that, since you did not post your GW topology. If you are 100% positive that is the case, raise a TAC support request.

[FWNinja]

I attached screenshots.

Thanks

Francesco

[_Val_]

Already said above, open a service request.

[HristoGrigorov]

Yeah, give us some more info. For example if it is a private IP but in a peer VPN domain it will be considered external (Internet).

[FWNinja]

It's not a VPN traffic.

I attached screenshots in the previous reply.

Thanks and Best Regards

Francesco

[Ilya_Yusupov]

Hi @FWNinja ,

according to log detail screen shot you matched on Rule 140 but you put screen shot of rule 142.

can you share rule 140?

Thanks,

Ilya 

[FWNinja]

Hi,

the rule is the same. The customer added 2 rules before and the rule 140 become 142.

Thanks

Francesco