What is Policy ID 0 and why lot of denied traffic on this policy?

[sridharsre]

Hi All,

I have a problem with Policy ID 0, which is blocking certain broadcast traffic which is generating huge size of logs.

I googled and found the following command could stop this traffic:

config log setting   set local-in-deny-broadcast {enable | disable}     set local-in-deny-unicast {enable | disable} end   But my question is, why is it generating this much of deny logs ? how to identify the origin of this ? Please help me ...   Firewall version: 5.0.7   Thanks a trillion in advance !!!   Regards, Sridhar Sre  

[AlexFeren]

> why is it generating this much of deny logs ? how to identify the origin of this ?

Look at the logs - they will tell you origin and destination.

I had similar problem, but not "huge size of logs". Destination was a (EIGRP) multicast address and it was received on a transparent mode VDOM that was also a management VDOM.

[Sylvia]

You can try to use

config system settings

  set ses-denied-traffic enable

end

to reduce the number of logs for denied traffic

Regards,

Sylvia

[sridharsre]

Hi Alex,

thanks for the reply,

these logs are due to policy ID 0 and would like to stop log this traffic, how to do that ?

Thanks in advance !!!

[sridharsre]

Is the Policy ID 0 represents "implicit rule" of the firewall ? 

If that is the case, I get accept log too through this policy ID 0 :(

[ede_pfau]

"policy 0" is the last, implicit DENY ALL policy which is triggered if no other policy created by the admin matches the traffic. As with broadcasts, the FGT will drop broadcast traffic by default; what you see are these events.

Please follow your own suggestion and configure

config log setting
  set local-in-deny-broadcast {enable | disable}  
  set local-in-deny-unicast {enable | disable}
end

and post back if that reduces your logging volume.

You can as well find the source of these broadcasts and try to reduce these.

@Sylvia's suggestion

config system settings
  set ses-denied-traffic enable

only influences the session table. I don't think that including denied sessions will help you finding the reason for it but you might give it a try. The default is 'disable' and you should set it to 'disable' once you are done debugging.

[sridharsre]

Hi Ede,

Thanks for the response. but I still get accept / closed / update in the status, after I apply "set local-in-deny disable". 

I have following settings:

ROCKOne (setting) # get brief-traffic-format: disable daemon-log          : disable fwpolicy-implicit-log: disable (in some of the firewalls it is enabled, if I disable it, will this stop all the deny logging for implicit rule) fwpolicy6-implicit-log: disable gui-location        : disk local-in-allow      : enable local-in-deny       : disable local-out           : disable log-invalid-packet  : disable log-user-in-upper   : disable neighbor-event      : disable resolve-apps        : enable resolve-hosts       : enable resolve-ip          : disable resolve-port        : enable user-anonymize      : disable

What would be the out come of the following:

fwpolicy-implicit-log: disable

local-in-deny       : disable

Will this log any traffic? or stop all the logs of the implicit rule ? 

I do not have option " broadcast " to disable it 

I'm so confused :('

Thanks in advance !!!

[ede_pfau]

'local-in-deny' set to 'disable' will prevent logging of denied traffic directed to the FGT itself.

Detailed settings for logging changed from version to version so some options might not be available on your FGT.

[AtiT]

Hi,

If you see accept/close on policy ID 0 it seems to me that the traffic is targeted to the firewall's IP address.

You have a local allowed traffic enabled for logging:

local-in-allow      : enable

Try to disable it whether it helps.

[sridharsre]

Dear All,

Thanks a lot for your responses. Could you please help me with the below one ?

fwpolicy-implicit-log: disable (in some of the firewalls it is enabled, if I disable it, will this stop all the deny logging for implicit rule)

Which status it should be: disable or enable ?

Thanks in advance  !!!