topic FTD 1010 - Traffic No Action Policy in Network Security

FTD 1010 - Traffic No Action Policy

Othacon — Fri, 13 Dec 2024 14:14:01 GMT

Hi all,

I've configured a Cisco FTD 1010 and I'm having a weird behavior happening. I've configured all the policies from inside to outside and the default action is to block.

I've configured several policies and I can see them being allowed and matching correctly, but then I saw this:

The default action of the firewall is to block. Why is the firewall not matching any traffic and putting the traffic in No Action??

Please anyone can help?

Thank you all

Re: FTD 1010 - Traffic No Action Policy

MHM Cisco World — Fri, 13 Dec 2024 14:16:49 GMT

can I see show access-list of FTD

MHM

Re: FTD 1010 - Traffic No Action Policy

Othacon — Fri, 13 Dec 2024 14:28:19 GMT

hi @MHM Cisco World

unfortunately I really can't put the entire rule list, but I can put the last ones, please see below:

access-list NGFW_ONBOX_ACL line 34 remark rule-id 268435458: ACCESS POLICY: NGFW_Access_Policy
access-list NGFW_ONBOX_ACL line 35 remark rule-id 268435458: L5 RULE: Blocked Traffic
access-list NGFW_ONBOX_ACL line 36 advanced deny object-group |acSvcg-268435458 ifc inside any ifc outside any rule-id 268435458 event-log both (hitcnt=483795) (Last Hit=14:19:25 UTC Dec 13 2024) 0x7aae9053
access-list NGFW_ONBOX_ACL line 36 advanced deny ip ifc inside any ifc outside any rule-id 268435458 event-log both (hitcnt=483795) (Last Hit=14:19:25 UTC Dec 13 2024) 0xe41ebd9d
access-list NGFW_ONBOX_ACL line 37 remark rule-id 1: ACCESS POLICY: NGFW_Access_Policy
access-list NGFW_ONBOX_ACL line 38 remark rule-id 1: L5 RULE: DefaultActionRule
access-list NGFW_ONBOX_ACL line 39 advanced deny ip any any rule-id 1 event-log both (hitcnt=278693635) (Last Hit=14:19:26 UTC Dec 13 2024) 0x84953cae

Since the rules are configured I would expect for them to match their respective policies, but from the image, the FTD is not matching some traffic with anything and it's putting it as No Action, and i really can't understand why. I even double on the deny action to no avail

Thank you

Re: FTD 1010 - Traffic No Action Policy

MHM Cisco World — Fri, 13 Dec 2024 14:32:27 GMT

I will send you some hints about FTD ACL

Thanks

MHM

Re: FTD 1010 - Traffic No Action Policy

ckleopa — Sat, 14 Dec 2024 19:27:54 GMT

This can happen when an access control rule has not finished evaluating a connection and at that point the connection just breaks our stops outside the firewall. At that point the rule was still pending and it logged the latest state it was evaluating at the time. If that’s what it is it’s possible you have an Application rule that requires more packets to be fully evaluated.
Future versions will include this state as a new state as part of the Reason field to avoid confusion.