Traffic match with wrong Schedule

[itmdadmin]

Foritgate FW version : 7.4.4

I have created two proxy policy with different schedule, office hour and non office hour.

and i notice that the traffic is matched with non office hour schedule and policy when I access internet in office hour. 

anyone have experience this issue ? 

Observed Update on 8/July/2024:

Traffic between 4PM to 3 AM will go to office hour policy with schedule 8AM-7PM

Traffic between 3AM to 4 PM will go to non office hour policy  with schedule 7PM-8AM  

[itmdadmin]

It happen all the time.

The "fast-policy-match" is not configurated, is it default enable ? shall i disable it ?

[smaruvala]

Hi,

- When was the Policy created? I can see the issue started from 8th of June. Was the Policy created on 7th of June?

- In the screenshot we can see the schedule status is showing as inactive. But if you edit the policy and go into the policy then check the status of schedule, does it show inactive or active?

- I think I am able to reproduce the issue in the lab. I did not face the issue yesterday. But today I am seeing the issue. So I am assuming it was matching office-hours proxy policy first. Then during non-office hours it was matching the non-office policy and it has not changed back to office hours policy.

- I would suggest you to open a support case. Replication should be possible in version 7.4.4 but I think we need to give one day time. If you have already opened the case let me know the case number.

Regards,

Shiva

[smaruvala]

Hi,

I can see couple of open bugs reported internally in 7.4.4 which looks same. I am assuming the wad process is not getting the correct time so it is matching the incorrect policy.

Regards,

Shiva

[itmdadmin]

- The original policy was created year ago, the test policy was created on 3 July.

- The schedule time is show as active for both office and non office hour in the edit mode

- Yes i have created a support case already and one of your engineer have remoted to check it - Ticket No. 9677466

[ede_pfau]

I think it is related to session lifetime. When the correct schedule is matched, a session is allowed to be established. Then the schedule expires, but the session is not re-evaluated ('dirty').

Isn't there an option to force that lookup?

There is an option which governs the behavior of active sessions vs. schedule expiration:

config firewall policy

edit <nn>

set schedule-timeout enable

If enabled, sessions will be terminated on schedule expiry. If disabled, active sessions are allowed to continue while new sessions will be prevented. Disabled is the default.

I'd give it a try.

[itmdadmin]

After some test, its seems that the scheduler is using the GMT+0 as the measure time instead of my local time GMT+8