- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
Packets dropped with "Enforced Firewall Rule"
03/26/2020 
174 People found this article helpful
104,631 Views
Description
This article explains why the firewall sometimes drops packets with drop code "Enforced Firewall Rule" or "Policy Drop"
Cause
This packet drop can be due to the following reasons:
1) The packet may have characteristics which violate the firewall's state table (ie: MAC address conflict in the ARP table, source IP address seen on an interface for which the firewall has no route table entry, etc.).
2.) If the traffic requires a NAT policy (for instance, from WAN to LAN) to traverse the firewall, the NAT policy may be incorrect, or non-existent.
3.) The packet came in on an interface on which the firewall was not expecting it.
4.) The firewall is not able to determine how to process the traffic due to an unrelated NAT policy overlapping with the traffic.
5.) The firewall is not able to determine how to process the traffic due to a route policy conflict.
6) CFS prohibits access ( in case of websites)
Resolution
Sometimes when taking a packet capture on the firewall, packets will show as dropped, and when you look up the drop code for the dropped packet, the drop code may indicate that the packet was dropped due to an enforced firewall rule, yet there is no rule visible which should be dropping the packet in question.
In order to avoid these kinds of problems, the following steps should always be considered when creating rules, nat policies, and route policies on the firewall:
--
1) Label your policies with proper comments so that you can be certain why they were put in place to begin with.
2) Be as specific as possible with each policy you create on the firewall. Ambiguous policies on the firewall increase the chances for logical conflicts and overlap issues as your configuration grows in size.
3) Try to make proper use of the firewall's object-oriented system by placing multiple destinations or sources into groups and referencing those group objects, rather than creating individual policies for each individual source or destination network.
4) Ensure there are appropriate access rules, NAT policies and routes to allow traffic to be forwarded when it hits the firewall.
5) Ensure there are CFS policies that allow the traffic to be allowed ( in case of specific websites)
Related Articles
- ‘Error sending one-time password’ encountered when connecting to NetExtender
- Supported SonicWall and 3rd party SFP and SFP+ modules that can be used with SonicWall NSsp series
- Supported SonicWall and 3rd party SFP and SFP+ modules that can be used with SonicWall NSA series
Categories
- Firewalls > TZ Series
- Firewalls > SonicWall SuperMassive E10000 Series
- Firewalls > SonicWall SuperMassive 9000 Series
- Firewalls > SonicWall NSA Series
YES
NO