log shows drop on an encrypt rule

[rdk]

any ideas why I would be seeing a drop in my logs against a rule that is an encrypt/decypt. The customer is seeing it as blocked. Thanks.

 

[ChrisAC]

More information please. Is it a site to site VPN, SecureClient? Do you have your encryption domains set up correctly? Is it just a particular type of traffic or all traffic in the rule? Do other encrypt/decrypt rules work?

Chris.
**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[rdk]

Chris, Yes it is a site to site vpn. I think the encryptiondomains are correct. It drops on

http://www traffic,

but I see decrypts on other traffic types from the same source.

 

[brianpaterson]

Is it dropping on rule 0 or the VPN rule?

What do you mean by

http://www traffic?

Http, Https, SSL?

A sumary of your VPN rule would be helpful.

Cheers B-)
Brian, CCSE
brian@domain-integrity.com

 

[rdk]

ok, I am not a fw expert but this is what I found. we were actually getting

15:40:11 drop Custfw005 >eth-s2p2c0 proto tcp src 10.1.35.118 dst 10.28.78.204 service tcp-80-90 s_port 4959 rule 34 reason: port belong to service in TCP Fast Mode, port: tcp-80-90

So I looked at the services and tcp-80-90 was NOT set for fast mode. I looked through the rest of them and found one called http-fastmode, which was used on a different fw. I cleared fastmode and the problem was fixed. So now I am stuck. Is this because I used the default service "ANY"? does that mean its any defined service in the EMC? If you could explain this I would appreciate it alot, thanks.