Traffic match with wrong Schedule

[itmdadmin]

Foritgate FW version : 7.4.4

I have created two proxy policy with different schedule, office hour and non office hour.

and i notice that the traffic is matched with non office hour schedule and policy when I access internet in office hour. 

anyone have experience this issue ? 

Observed Update on 8/July/2024:

Traffic between 4PM to 3 AM will go to office hour policy with schedule 8AM-7PM

Traffic between 3AM to 4 PM will go to non office hour policy  with schedule 7PM-8AM  

[itmdadmin]

sry are you replied a wrong post... 

[hbac]

Hi @itmdadmin,

I can't reproduce this issue in my lab. Please check FortiGate timezone and make sure it is correct. You can also collect debug flow to see if it really matches that policy. https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connecti...

Regards, 

[itmdadmin]

1. Timezone is correct and I have worked with a foritgate engineer to troubleshoot it but still not solved and the case is under researching....

[hbac]

Hi @itmdadmin,

Does it also happen to regular firewall policy or just proxy policy?

Regards,

[HarshChavda]

Hello,

Can you verify source and destination in policy look up and Check to see there are no other firewall rules that supersede this rule.  Remember that firewall rules are processed from top-to-bottom.

[itmdadmin]

there is no other policy that will supersede those two rules

[sw2090]

what I see is that your one schedule's ending time is exactly the start time of the other and vice versa.

Probably this might result in sessions being created with wrong policy because both are active for that minute and then the first will  match?

[itmdadmin]

we had try setting the start time and end time with 1 min different but still the same result. 

[smaruvala]

Hi,

- Do you see the issue all the time or only for a specific period of time every day?

- Is the "fast-policy-match" configuration enabled in the Firewall? 

Regards,

Shiva