Reverse HTTPS traffic is getting dropped on Checkpoint Gateway

[SurajGaikwad]

Hi Team,

We are facing issue where reverse https traffic from destination to source is being dropped.

Below example FYI

*****Forward Traffic******

Source:10.10.10.10 (source is behind gateway 1)

Source port: Random (52437)

Destination: 20.20.20.20 (Destination is behind gateway 2)

Destination port: 443

Traffic is getting allowed on both Gateway

*****Reverse Traffic******

Source: 20.20.20.20 (Destination is behind gateway 2)

Source port: 443

Destination: 10.10.10.10 (source is behind gateway 1)

Destination port: Random (52437) --->Same Random Port which observed in forward traffic

Traffic is getting dropped on gateway 2

**********************

This is unexpected behavior in stateful firewall, 

Any thoughts on why this is happening , and what could be solution? 

[_Val_]

What does the drop log say?

For TCP 443 you do not need two rules, one should be enough. Also, what about NAT?

[SurajGaikwad]

Hello _Val_

Thanks for reply.

Zdebug Drop logs says "dropped by fw_send_log_drop Reason: Rulebase drop". Same observed in smartconsole logs, traffic is getting dropped by default cleanup rule.

Nating is not enabled for both source and destination.

[emmap]

Do you see accept logs for forward traffic on both gateways, and which gateway is logging the drop?

[SurajGaikwad]

Hello emmap,

Yes can see accept logs for forward traffic on both gateways.

Drop log is observed on first gateway of return traffic (gateway 2 as explain in question)

[_Val_]

This does not make much sense. Check for asymmetric routing.

[PhoneBoy]

Please provide screenshots of both the accept and drop logs (masking sensitive data).

[SurajGaikwad]

Hello PhoneBoy,

Attached accept and drop logs where forward traffic is accepted and reverse traffic is dropped

[PhoneBoy]

Please provide the full log card for each log entry.

[SurajGaikwad]

attached full log card.

Also let me know is return traffic visible in smartconsole logs.. if forward traffic is accepted.

[PhoneBoy]

I’m not seeing the “origin” field on these log entries (I.e. the gateway that is actually logging these packets).
Have you confirmed the same gateway that is allowing the traffic is actually blocking it?