0

I have a lot of legitimate outbound traffic intermittently being denied by WatchGuard's "Internal Policy." Today I tried to go to Splunk's homepage and my traffic was denied by my watchguard XTM 22 with Pro upgrade.

What is the "Internal Policy" and what can I do to control it?

Example of Traffic being blocked

Type    Date            Action      Source IP   Port    Interface       Destination IP  Port    Policy  
Traffic 2011-09-21T18:24:43 Deny    10.0.0.90   49627   3-Primary LAN   64.127.105.40   80  Firebox Internal Policy http/tcp

Top three firewall policies:

enter image description here

Improve this question

3 Answers 3

Reset to default
2

The first firewall policy is "Deny any traffic from 10.0.0.90", so that's what it's doing (your source IP is 10.0.0.90 in the deny message).

Policies are applied from top to bottom, and denies before allows, so that policy matches, denies the traffic, and no more are looked at.

What can you do about it? Change the policies.

Improve this answer
4
  • It is not a deny policy, the bar sinister indicates that the policy is disabled. That Policy is only there why I need to test out the secondary WAN connection using Policy Based Routing.
    – vfilby
    Oct 3, 2011 at 13:35
  • Also, the blocked packets are intermittent which isn't what I would expect from a block policy. And the policy in the log message would say 'FromVince' as opposed to 'Firebox Internal Policy'.
    – vfilby
    Oct 3, 2011 at 13:37
  • 1
    Oops. OK. The "internal policy" I can think of now is the blocked sites list, or the blocked ports list (which takes precedense over an Any-allowed rule. Previous versions of the firmware were happy to put internal IP addresses in the blocked sites list, which might explain why it's intermittent - although the latest version doesn't do that.
    – TessellatingHeckler
    Oct 3, 2011 at 19:49
  • That may be the case, I have never seen anything in the blocked sites list but the time duration is set to 1min. I will have to look into this further. Thank you!
    – vfilby
    Oct 18, 2011 at 18:14
1

One other possibility due to poor notifications from WatchGuard's user interface is licensing issues.

Even if you have manually entered activation codes, some models of XTM will go into single user mode. Only one IP, typically the one logged in as admin user, will be able to go out to the internet.

The Dashboard, SYSLOG entries ("Deny" due to "Internal Policy") and the license activation page will not give a clear indication that the Live Activation must be performed.

Further, WatchGuard's own support will frequently miss this issue while reviewing the configuration details.

Improve this answer
0

Your policy for Vince is disabled and that is why it will not allow the port 49627 traffic through. As far as other traffic you have to see what ports are being used. Bigger question is why 49627 out and not using 80?

For example: The 15th Circuit Court of Palm Beach County http://15thcircuit.co.palm-beach.fl.us:8080/web/guest

They are using 8080 and it is blocked by an internal policy and Unhandled exception packet-00. You have to create a policy for tcp port 8080 and apply it and then the website will show up.

If you have a proxy rule then you can add the site/port/whatever to it. Or you can create a policies for managers\users if you use WSSO for you AD. But that is for a work\corp network

I have seen this all the time and have to do that for certain clients.

I am answering this even though it is old because google still shows this when people search so it may help.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .