Internal Zone to External Zone policy not applying

[asheen]

Hi,

I've had an issue with a 200F v7.2.8 

We have an issue where policies for VLANs attached to a port that is part of a Zone labelled DMZ are not applied when using the Zone in the firewall policy.

for example 

Port 2 has multiple separate VLANs that are various DMZ networks.

Port 2 is assigned to the DMZ Zone

One such DMZ VLAN is a quarantine DMZ (for testing suspicious USBs etc)

Port 24 is our main internet connection assigned to the WAN zone

If I create a rule From DMZ Zone to WAN Zone with source set to the IP Range used on the quarantine DMZ destination all, service all 

I see no traffic hit that rule and logs show traffic from the IP of the device being blocked.

Even if I use a DMZ Zone interface source all to WAN destination all I still get not policy hits.

If I modify the rule so that the incoming interface is the Quarantine VLAN instead of the DMZ zone then the policy works.

I've worked around this by using the VLANs for the rules but I would like to consolidate our rules to start tidying this up by using zones.

[amrit]

Use policy lookup tool on the firewall policy page and check if it is matching with the intended firewall policy when zones are used. 

Run the debug

di de flow filter addr <dst ip> 

di de flow show function-name en

di de flow trace start 50 

di de en 

Initiate ping or other test traffic to this destination and share the debug output

[asheen]

Debug output as below

id=65308 trace_id=4 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=60."
id=65308 trace_id=4 func=init_ip_session_common line=6009 msg="allocate a new session-14775074, tun_id=0.0.0.0"
id=65308 trace_id=4 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
id=65308 trace_id=4 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
id=65308 trace_id=4 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
id=65308 trace_id=5 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=61."
id=65308 trace_id=5 func=init_ip_session_common line=6009 msg="allocate a new session-1477532f, tun_id=0.0.0.0"
id=65308 trace_id=5 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
id=65308 trace_id=5 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
id=65308 trace_id=5 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
id=65308 trace_id=6 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=62."
id=65308 trace_id=6 func=init_ip_session_common line=6009 msg="allocate a new session-147754c3, tun_id=0.0.0.0"
id=65308 trace_id=6 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
id=65308 trace_id=6 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
id=65308 trace_id=6 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"

[asheen]

Policy that it should be using below

config firewall policy
edit 60
set name "Quarantine Allow out - All"
set uuid ea703fd6-c6d3-51ed-d8ad-31effd795561
set srcintf "DMZ"
set dstintf "WAN"
set action accept
set srcaddr "QuarantineDMZ address"
set dstaddr "all"
set schedule "always"
set service "ALL"
set utm-status enable
set ssl-ssh-profile "certificate-inspection"
set av-profile "default"
set webfilter-profile "default"
set dnsfilter-profile "default"
set ips-sensor "default"
set application-list "default"
set logtraffic all
next
end

[amrit]

As per the debugs traffic is leaving out via port24 , find a route: flag=04000000 gw-203.54.189.241 via port24"

which is a part  of the wan zone so ideally it should match with policy 60.

For testing, remove all the utm profiles from the policy 60, check the source address and its subnet, check the schedule ‘Always’ object also verify the services ‘ALL set asic offload disable and run the debugs again

config firewall policy

edit 60

set auto-asic-offload disable

end

end

[asheen]

Changed policy - see below

edit 60
set name "Quarantine Allow out - All"
set uuid ea703fd6-c6d3-51ed-d8ad-31effd795561
set srcintf "DMZ"
set dstintf "WAN"
set action accept
set srcaddr "QuarantineDMZ address"
set dstaddr "all"
set schedule "always"
set service "ALL"
set utm-status enable
set ssl-ssh-profile "certificate-inspection"
set logtraffic all
set auto-asic-offload disable

Same debug 

See below

id=65308 trace_id=16 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=72."
id=65308 trace_id=16 func=init_ip_session_common line=6009 msg="allocate a new session-14790f04, tun_id=0.0.0.0"
id=65308 trace_id=16 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
id=65308 trace_id=16 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
id=65308 trace_id=16 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
id=65308 trace_id=17 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=73."
id=65308 trace_id=17 func=init_ip_session_common line=6009 msg="allocate a new session-14791029, tun_id=0.0.0.0"
id=65308 trace_id=17 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
id=65308 trace_id=17 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
id=65308 trace_id=17 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
id=65308 trace_id=18 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=74."
id=65308 trace_id=18 func=init_ip_session_common line=6009 msg="allocate a new session-1479127b, tun_id=0.0.0.0"
id=65308 trace_id=18 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
id=65308 trace_id=18 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
id=65308 trace_id=18 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
id=65308 trace_id=19 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=75."
id=65308 trace_id=19 func=init_ip_session_common line=6009 msg="allocate a new session-14791487, tun_id=0.0.0.0"
id=65308 trace_id=19 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
id=65308 trace_id=19 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
id=65308 trace_id=19 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
id=65308 trace_id=20 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=76."
id=65308 trace_id=20 func=init_ip_session_common line=6009 msg="allocate a new session-147915a9, tun_id=0.0.0.0"
id=65308 trace_id=20 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
id=65308 trace_id=20 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
id=65308 trace_id=20 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"
id=65308 trace_id=21 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.66.6.7:1->104.21.6.6:2048) tun_id=0.0.0.0 from QuarantineDMZ. type=8, code=0, id=1, seq=77."
id=65308 trace_id=21 func=init_ip_session_common line=6009 msg="allocate a new session-14791774, tun_id=0.0.0.0"
id=65308 trace_id=21 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-203.54.189.241 via port24"
id=65308 trace_id=21 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=14, len=3"
id=65308 trace_id=21 func=fw_forward_handler line=827 msg="Denied by forward policy check (policy 0)"

Given it is getting "Denied by forward policy check (policy 0)" it would appear it is not hitting policy 60 and is hitting the Implicit Deny. Correct?

[amrit]

Yes, it is hitting implicit deny policy. I recommended opening a TAC case , It is not an expectedly behaviour. I am suspecting some OS level issue. If possible try rebooting the device.