Technical Note: Use of the service 'ALL' in a firewall policy with v5.2.2
Description
Solution
This article provides a solution for the case where UDP traffic (For example: DNS, NTP) is affected in a firewall policy where the service 'ALL' and default protocol number of 6 (TCP) is used. As a result UDP traffic will be dropped because it is matching only TCP traffic. This is seen with firmware version 5.2.2.
Solution
In v5.2.2 for firewall service custom 'ALL' the default protocol number is 6. The workaround is to change the protocol number to 0 via the CLI:
Best Practices
While you can use a predefined service, it is best to leave these alone; create a new service and name it something similar such as the same service name with a descriptive identifier appended.
For information on protocol numbers, see http://www.iana.org.
config firewall service customThe change can also be made via the GUI:
edit "ALL"
set protocol IP
set protocol-number 0
end
Best Practices
While you can use a predefined service, it is best to leave these alone; create a new service and name it something similar such as the same service name with a descriptive identifier appended.
For information on protocol numbers, see http://www.iana.org.
