Packets dropped with "Enforced Firewall Rule"

03/26/2020 161 19203

DESCRIPTION:

This article explains why the firewall sometimes drops packets with drop code "Enforced Firewall Rule"  or "Policy Drop" 

CAUSE:

This packet drop can be due to the following reasons:

1) The packet may have characteristics which violate the firewall's state table (ie: MAC address conflict in the ARP table, source IP address seen on an interface for which the firewall has no route table entry, etc.).
2.) If the traffic requires a NAT policy (for instance, from WAN to LAN) to traverse the firewall, the NAT policy may be incorrect, or non-existent.
3.) The packet came in on an interface on which the firewall was not expecting it.
4.) The firewall is not able to determine how to process the traffic due to an unrelated NAT policy overlapping with the traffic.
5.) The firewall is not able to determine how to process the traffic due to a route policy conflict.

6) CFS prohibits access ( in case of websites)

RESOLUTION:

Sometimes when taking a packet capture on the firewall, packets will show as dropped, and when you look up the drop code for the dropped packet, the drop code may indicate that the packet was dropped due to an enforced firewall rule, yet there is no rule visible which should be dropping the packet in question.

In order to avoid these kinds of problems, the following steps should always be considered when creating rules, nat policies, and route policies on the firewall:
--
1) Label your policies with proper comments so that you can be certain why they were put in place to begin with.
2) Be as specific as possible with each policy you create on the firewall. Ambiguous policies on the firewall increase the chances for logical conflicts and overlap issues as your configuration grows in size.
3) Try to make proper use of the firewall's object-oriented system by placing multiple destinations or sources into groups and referencing those group objects, rather than creating individual policies for each individual source or destination network. 

4) Ensure there are appropriate access rules, NAT policies and routes to allow traffic to be forwarded when it hits the firewall. 

5) Ensure there are CFS policies that allow the traffic to be allowed ( in case of specific websites)