Skip to main content
asheen
asheen
New Member
July 26, 2024
Question

Internal Zone to External Zone policy not applying

  • July 26, 2024
  • 5 replies
  • 1824 views

Hi,

 

I've had an issue with a 200F v7.2.8 

 

We have an issue where policies for VLANs attached to a port that is part of a Zone labelled DMZ are not applied when using the Zone in the firewall policy.

 

for example 

Port 2 has multiple separate VLANs that are various DMZ networks.

Port 2 is assigned to the DMZ Zone

One such DMZ VLAN is a quarantine DMZ (for testing suspicious USBs etc)

 

Port 24 is our main internet connection assigned to the WAN zone

 

If I create a rule From DMZ Zone to WAN Zone with source set to the IP Range used on the quarantine DMZ destination all, service all 

I see no traffic hit that rule and logs show traffic from the IP of the device being blocked.

 

Even if I use a DMZ Zone interface source all to WAN destination all I still get not policy hits.

 

If I modify the rule so that the incoming interface is the Quarantine VLAN instead of the DMZ zone then the policy works.

 

I've worked around this by using the VLANs for the rules but I would like to consolidate our rules to start tidying this up by using zones.

 

5 replies

amrit
Staff & Editor
amrit
Staff & Editor
July 26, 2024

Use policy lookup tool on the firewall policy page and check if it is matching with the intended firewall policy when zones are used. 

Run the debug

di de flow filter addr <dst ip> 

di de flow show function-name en

di de flow trace start 50 

di de en 

Initiate ping or other test traffic to this destination and share the debug output

    asheen
    asheenAuthor
    New Member
    July 26, 2024

    Debug output as below

     

    id=65308 trace_id=4 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=60."
    id=65308 trace_id=4 func=init_ip_session_common line=6009 msg="allocate a new session-14775074, tun_id=0.0.0.0"
    id=65308 trace_id=4 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
    id=65308 trace_id=4 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
    id=65308 trace_id=4 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
    id=65308 trace_id=5 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=61."
    id=65308 trace_id=5 func=init_ip_session_common line=6009 msg="allocate a new session-1477532f, tun_id=0.0.0.0"
    id=65308 trace_id=5 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
    id=65308 trace_id=5 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
    id=65308 trace_id=5 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
    id=65308 trace_id=6 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=62."
    id=65308 trace_id=6 func=init_ip_session_common line=6009 msg="allocate a new session-147754c3, tun_id=0.0.0.0"
    id=65308 trace_id=6 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
    id=65308 trace_id=6 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
    id=65308 trace_id=6 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"

    asheen
    asheenAuthor
    New Member
    July 26, 2024

    Policy that it should be using below

    config firewall policy
    edit 60
    set name "Quarantine Allow out - All"
    set uuid ea703fd6-c6d3-51ed-d8ad-31effd795561
    set srcintf "DMZ"
    set dstintf "WAN"
    set action accept
    set srcaddr "QuarantineDMZ address"
    set dstaddr "all"
    set schedule "always"
    set service "ALL"
    set utm-status enable
    set ssl-ssh-profile "certificate-inspection"
    set av-profile "default"
    set webfilter-profile "default"
    set dnsfilter-profile "default"
    set ips-sensor "default"
    set application-list "default"
    set logtraffic all
    next
    end

    amrit
    Staff & Editor
    amrit
    Staff & Editor
    July 26, 2024

    As per the debugs traffic is leaving out via port24 , find a route: flag=04000000 gw-203.54.189.241 via port24"

    which is a part  of the wan zone so ideally it should match with policy 60.

    For testing, remove all the utm profiles from the policy 60, check the source address and its subnet, check the schedule ‘Always’ object also verify the services ‘ALL set asic offload disable and run the debugs again

    config firewall policy

    edit 60

    set auto-asic-offload disable

    end

    end

      asheen
      asheenAuthor
      New Member
      July 26, 2024

      Changed policy - see below

       

      edit 60
      set name "Quarantine Allow out - All"
      set uuid ea703fd6-c6d3-51ed-d8ad-31effd795561
      set srcintf "DMZ"
      set dstintf "WAN"
      set action accept
      set srcaddr "QuarantineDMZ address"
      set dstaddr "all"
      set schedule "always"
      set service "ALL"
      set utm-status enable
      set ssl-ssh-profile "certificate-inspection"
      set logtraffic all
      set auto-asic-offload disable

       

      Same debug 

      See below

      id=65308 trace_id=16 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=72."
      id=65308 trace_id=16 func=init_ip_session_common line=6009 msg="allocate a new session-14790f04, tun_id=0.0.0.0"
      id=65308 trace_id=16 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
      id=65308 trace_id=16 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
      id=65308 trace_id=16 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
      id=65308 trace_id=17 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=73."
      id=65308 trace_id=17 func=init_ip_session_common line=6009 msg="allocate a new session-14791029, tun_id=0.0.0.0"
      id=65308 trace_id=17 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
      id=65308 trace_id=17 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
      id=65308 trace_id=17 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
      id=65308 trace_id=18 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=74."
      id=65308 trace_id=18 func=init_ip_session_common line=6009 msg="allocate a new session-1479127b, tun_id=0.0.0.0"
      id=65308 trace_id=18 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
      id=65308 trace_id=18 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
      id=65308 trace_id=18 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
      id=65308 trace_id=19 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=75."
      id=65308 trace_id=19 func=init_ip_session_common line=6009 msg="allocate a new session-14791487, tun_id=0.0.0.0"
      id=65308 trace_id=19 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
      id=65308 trace_id=19 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
      id=65308 trace_id=19 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
      id=65308 trace_id=20 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=76."
      id=65308 trace_id=20 func=init_ip_session_common line=6009 msg="allocate a new session-147915a9, tun_id=0.0.0.0"
      id=65308 trace_id=20 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
      id=65308 trace_id=20 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
      id=65308 trace_id=20 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
      id=65308 trace_id=21 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=77."
      id=65308 trace_id=21 func=init_ip_session_common line=6009 msg="allocate a new session-14791774, tun_id=0.0.0.0"
      id=65308 trace_id=21 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
      id=65308 trace_id=21 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
      id=65308 trace_id=21 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"

       

      Given it is getting "Denied by forward policy check (policy 0)" it would appear it is not hitting policy 60 and is hitting the Implicit Deny. Correct?

      amrit
      Staff & Editor
      amrit
      Staff & Editor
      July 26, 2024

      Yes, it is hitting implicit deny policy. I recommended opening a TAC case , It is not an expectedly behaviour. I am suspecting some OS level issue. If possible try rebooting the device. 

        Terms & ConditionsAccessibility statement