Technical Note: Use of the service 'ALL' in a firewall policy with v5.2.2

[edumbrava]

Description

This article provides a solution for the case where UDP traffic (For example: DNS, NTP) is affected in a firewall policy where the service 'ALL' and default protocol number of 6 (TCP) is used.  As a result UDP traffic will be dropped because it is matching only TCP traffic.  This is seen with firmware version 5.2.2.

Solution

In v5.2.2 for firewall service custom 'ALL' the default protocol number is 6.  The workaround is to change the protocol number to 0 via the CLI:

config firewall service custom
edit "ALL"
set protocol IP
set protocol-number 0
end

The change can also be made via the GUI:

Best Practices

While you can use a predefined service, it is best to leave these alone; create a new service and name it something similar such as the same service name with a descriptive identifier appended.

For information on protocol numbers, see http://www.iana.org.