Denied by forward policy check (policy 0)

[zak]

Hi, I have this reject for a new rule wich use both NAT (source and destination) Rule :     edit 4465         set srcintf "any"         set dstintf "any"         set srcaddr "153.65.21.20"         set dstaddr "vip_10.118.247.251-to-192.168.60.219-5901" "vip_10.118.247.251-to-192.168.60.219-5902"         set action accept         set schedule "always"         set service "tcp_5901" "tcp_5902"         set logtraffic all         set nat enable         set ippool enable         set poolname "ippool_10.118.58.217" We want to nat

153.65.21.20 --> 10.118.247.251   into:

10.118.58.217 --> 192.168.60.219 Logs : 2015-05-20 15:10:41 id=13 trace_id=4270 msg="vd-PAEv1 received a packet(proto=6, 153.65.21.20:12765->10.118.247.251:5902) from fmc1/2.305. flag S, seq 4222833505, ack 0, win 5260" 2015-05-20 15:10:41 id=13 trace_id=4270 msg="allocate a new session-f767ce2f" 2015-05-20 15:10:41 id=13 trace_id=4270 msg="find SNAT: IP-192.168.60.219(from IPPOOL), port-49052" 2015-05-20 15:10:41 id=13 trace_id=4270 msg="VIP-192.168.60.219:49052, outdev-fmc1/2.305" 2015-05-20 15:10:41 id=13 trace_id=4270 msg="DNAT 10.118.247.251:5902->192.168.60.219:49052" 2015-05-20 15:10:41 id=13 trace_id=4270 msg="find a route: flags=00000000 gw-192.168.76.54 via fmc1/2.300" 2015-05-20 15:10:41 id=13 trace_id=4270 msg="use addr/intf hash, len=147" 2015-05-20 15:10:41 id=13 trace_id=4270 msg="Denied by forward policy check (policy 0)" I don't understand why we hit a policy 0 and not the 4465. i have check the bug "the service ALL had been changed to protocol 6 instead of 0", it seems to be OK on the GUI interface and with the command "show firewall service custom ALL" Thanks if anyone have an idea.

[zak]

Hi,

Thanks i will do this modification and ask for a new test, did you let the source interface to "any" ?

[Johan_Witters]

Yes, I did... I used the complete configuration like you posted it, except for changing the IP's and the ports to match my network..

For a security point of view it is not adviced to use "any", but it might be necessary due to network design..

[zak]

OK i have put back my original configuration with the new ports, i will let you know as soon as a new test will be possible.

Edit : It's ok with the natted ports on the rule, the policy has matched correctly, thanks a lot for your help !