Thread Info
  • Locked Locked
  • Replies 7 replies
  • Subscribers 4 subscribers
  • Views 25396 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM 9 ASG Software 9.313-3 blocking allowed traffic

mckarto

We have about 90 servers behind the affected UTM9, all have an external interface and a dedicated dnat and snat entry to their internal IP. Actually everything is fine, a HA slave is attached. 

But sometimes traffic gets dropped even though it's allowed.

Like some weeks ago I opened traffic for two external networks to an internal host with a paket filter rule, this worked fine. Today I added a new host IP to the allowed group, but traffic from this IP is dropped see below (IP/MAC addresses changed), traffic from over IPs in that group go through-

16:48:53 Default DROP TCP  
111.222.111.222 : 56449
→
192.168.4.150 : 80
 
[SYN] len=60 ttl=54 tos=0x00 srcmac=00:00:00:00:00:01 dstmac=00:00:00:00:00:02

We had this issue before especially with incoming traffic from hosts that also are natted and reading BALfsons rules (don't find them anymore in the old forum) to not attach the internal IP to the internal Network but to any. This trick helped once, but not this time.

DNAT and SNAT is any to/from internal host_IP-
Intrusion Prevention is enabled (drop silently)

Any hints?



This thread was automatically locked due to age.
Parents

  • I'm a little confused that you have a lag for your WAN interface - why is that?

    Agreed with InformaticaOostkamp - please click on 'Use rich formatting' and show us a picture of the Edit of your Firewall rule with the Host definition for 192.168.4.150 also open in Edit mode with 'Advanced' also open.

    Cheers - Bob

  • in reply to BAlfson

    I wanted to have more throughput and so added two hardwarenics of the firewall to a lag0 and get 2GBit/s instead of just 1GBit/s with so many machines behind it.

    Here are the screenshots. With the rule, most IPs from the two groups just go through as expected. Just one doesn't.

    cheers and thanks

  • in reply to mckarto
    All I can tell you is that the packet didn't qualify for your firewall rule. There's so much obfuscated here that I really can't put the puzzle together.

    Cheers - Bob
Reply Children
No Data