up vote 0 down vote favorite
share [g+] share [fb]

I have a lot of legitimate outbound traffic intermittently being denied by WatchGuard's "Internal Policy." Today I tried to go to Splunk's homepage and my traffic was denied by my watchguard XTM 22 with Pro upgrade.

What is the "Internal Policy" and what can I do to control it?

Example of Traffic being blocked

Type    Date            Action      Source IP   Port    Interface       Destination IP  Port    Policy  
Traffic 2011-09-21T18:24:43 Deny    10.0.0.90   49627   3-Primary LAN   64.127.105.40   80  Firebox Internal Policy http/tcp

Top three firewall policies:

enter image description here

link|improve this question
80% accept rate
feedback

1 Answer

up vote 2 down vote accepted

The first firewall policy is "Deny any traffic from 10.0.0.90", so that's what it's doing (your source IP is 10.0.0.90 in the deny message).

Policies are applied from top to bottom, and denies before allows, so that policy matches, denies the traffic, and no more are looked at.

What can you do about it? Change the policies.

link|improve this answer
It is not a deny policy, the bar sinister indicates that the policy is disabled. That Policy is only there why I need to test out the secondary WAN connection using Policy Based Routing. – vfilby Oct 3 '11 at 13:35
Also, the blocked packets are intermittent which isn't what I would expect from a block policy. And the policy in the log message would say 'FromVince' as opposed to 'Firebox Internal Policy'. – vfilby Oct 3 '11 at 13:37
1  
Oops. OK. The "internal policy" I can think of now is the blocked sites list, or the blocked ports list (which takes precedense over an Any-allowed rule. Previous versions of the firmware were happy to put internal IP addresses in the blocked sites list, which might explain why it's intermittent - although the latest version doesn't do that. – TessellatingHeckler Oct 3 '11 at 19:49
That may be the case, I have never seen anything in the blocked sites list but the time duration is set to 1min. I will have to look into this further. Thank you! – vfilby Oct 18 '11 at 18:14
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.