Firewall Rule not displayed in Log Viewer

Hi,

is the rule passing traffic?

ian

Currently I have created a rule to block an external site. Although I am able to see that rule was created and updated but when I try to access external site.  Firewall ID does not show up in Log Viewer. 

Kindly let me know what to change or update. 

Thanks

Hi,

please post a copy of your block rue. Next which logviewer pages are you reviewing?

Ian

Do you have ips enabled? What logviewer tabs have you reviewed?

ian

I have created policy in web, application and firewall. Also can you please let me know in enabling IPS ??  I have attached my LogViewer page. Please check and let me know

In the field below application policy selection you use for this test select lan to wan.

your logviewer shows failed attempts which is normal because there is no matching firewall rule.

logviewer has a number of other reports have you checked them?

ian

I have added LAN to WAN in IPS for application policy. Please find the attachment. Firewall ID is still not showing up in Viewer. Also could you please let me know about the other reports in LogViewer.  Your help will of great use to me. 

Hello Muthu,

Adding to what Rfcat has mentioned, it doesn't look like the traffic is hitting this Firewall Rule, I would recommend you to do a GUI Packet Capture or a TCPdump with the IP of the computer you’re using for testing to confirm if the traffic is arriving at the XG and which rule it is using.

Regards,

Hi Muthu,

logviewer has a number of additional reports other then the default firewall. If you move your mouse over the logviewer -> firewall you will see a drop down menu to select others from.

Also in t he firewall view, refine by putting in the IP address of the source PC and see what rule it is hitting, this is an alternative method to that suggested by Emmanuel.

ian

Hi Muthu,

logviewer has a number of additional reports other then the default firewall. If you move your mouse over the logviewer -> firewall you will see a drop down menu to select others from.

Also in t he firewall view, refine by putting in the IP address of the source PC and see what rule it is hitting, this is an alternative method to that suggested by Emmanuel.

ian