Traffic blocked for no reason

Hi,

I suspect you have taken to generalisation to the vlan to vlan rule. You need a rule for each VLAN to reach all other VLANs. So basically you need a rule for each VLAN if you wan the XG to route the traffic. Alternatively you route the traffic within the switch providing the VLANs and leave the XG to manage internet access.

Ian

Hi.

thanks for you reply!

so...you are saying that if i have 4 vlans...

i need to create a rule for each vlan to allow traffic for all the other 3 vlans?

thats 9 separate rules! just for internal traffic.

are you absolutely sure about that?

because right now - internal traffic is working just fine - its just that specific error thats annoying me  

Just in case...

i created a new rule,

allowing traffic from one vlan to all other vlans.

that made no difference at all!

What I am saying is you need a vlan1 to vlans2-4 and vlan2 to vlan1 and vlan3-4.

And then there is the configuration issue for the devices that are not generating the timestamp on their transmissions.

Ian

i created a such a rule - a screenshot is my previous comment.

made no difference

Hello Avi,

It does seem IPS have pre-processed your traffic. Could you please change the settings according to this KBA ? As it does seem you are affected by it.

Hi

thats exactly what i ended up doing and it seems to solve the issue...but...

this command disables the IPS ability to look for anomalies,

and at the end of the day...looking for anomalies is the whole point of IPS

thats what IPS is supposed to do - look for anomalies!

disabling this feature - really missed the whole point of having IPS

Hi Avi,

IPS would still work, all you would need is to apply IPS policy on the firewall rule where the traffic transverses through and manage the signatures if they cause some traffic to drop. Pre-processing at the moment is not configurable.

Hi

i have to curcle you back to the initial comment on this post.

the firewall rule that caused the internal traffic to be flaged and dropped had no ips policy on it.

it was a firewall that allow all internal traffic between all vlans and had no we policy, no ips, no application policy. none!

and still traffic was blocked!

Hi

i have to curcle you back to the initial comment on this post.

the firewall rule that caused the internal traffic to be flaged and dropped had no ips policy on it.

it was a firewall that allow all internal traffic between all vlans and had no we policy, no ips, no application policy. none!

and still traffic was blocked!