Bug with Analyzer

rtarson98 — Wed, 01 Jan 2025 14:45:45 GMT

So I am working on getting our firepower for our company setup. So far got things set up for the most part. Now I am just getting connectivity over site-to-site and make sure I can access servers and services throughout. I was adding rules for our XDR and MDR to make sure they dont get blocked and also the streaming service we use to access the desktops. However when I was adding more rules the analyzer keeps saying that all my rules under are "Shadowing". Saying that none of the rules are going to be hit because the proceeding rule matches. However I doubt see how this is true.

The rule its matching on is the Geo-Block rule. We as a company have no reason to access or use anything outside North America. So I have it hard blocking any geo locations seen below:

in the Geo-Block-All every country is selected but USA and Canada.

The analyzer says this otherwise says that it matches the preceding rule. But what I notice in the defenseorchestrator it shows any for the destination network? So I dont know if this is the bug or I am doing something wrong?

Re: Bug with Analyzer

Marvin Rhoads — Thu, 02 Jan 2025 14:10:52 GMT

From what I can see in your screenshots it appears the shadowing rule is actually the #1 Allow-Standard-Outbound. Since it has "any" in the destination networks, Rule #2 and most subsequent rules will be shadowed

The policy analyzer is pretty new and I have found it can give misleading or downright incorrect results.

topic Re: Bug with Analyzer in Network Security

Bug with Analyzer

Re: Bug with Analyzer