A question re local-in-policy, logging, security policies, and possibly zones.
We've got two ISPs, so separate wan interfaces for each, collected into a zone for firewall rules. Local in policy blocks (or should block) a number of services (like telnet) to these wan interfaces, like so:
config firewall local-in-policy edit 1 set intf "wan-zn" set srcaddr "all" set dstaddr "all" set action deny set service "Svcs-LI-Block-For-Wan" set schedule "always" set status enable end
I still see a bunch of logs blocking these services, where the policy ID usually matches one of our lan_to_wan policies, but sometimes matches the default deny policy.
Questions:
[ol]
My understanding is that when local-in-policy blocks something, there is no log entry created. Correct?I assume the logs I'm seeing are for attacks from the wan that are attempted as part of a session initiated from our lan, since otherwise they should be getting blocked by either the local-in-policy or the default deny policy, not the lan_to_wan policies? How would the telnet attempts, for example, have gotten through to where the default deny rule had to handle them, as opposed to local-in-policy?Any suggestions on how to track this backwards? For example, I'd like to figure out specific websites users are visiting that then use the connection to try such an attack. I'd really like to figure out the attacks that seem to be bypassing local-in-policy which are getting blocked by the default deny.[/ol]Thanks.
