topic Re: FMC connection events problem in Network Security

FMC connection events problem

figura.jan — Fri, 21 Feb 2020 16:51:32 GMT

Hello all,

I am having a strange issue with virtual FMC which is managing ~10 FTD firewalls (some of them being offline at the moment) - if I display connection events I see all of them as expected....however if I search for events matching specific access control rule the result shows no events...so I went to see the table view of connection events and for every single connection event the column "access control rule" is simply empty which is strange itself but funny enough the traffic is allowed/blocked exactly by means of the configured rules in every policy

this was definitely working few weeks back so I am wondering if there is a bug in 6.2.3.9 or if possible that som of my colleagues changed some logging settings somewhere that would cause this?

Re: FMC connection events problem

Rahul Govindan — Tue, 26 Feb 2019 13:34:16 GMT

Any chance you have this trusted/blocked under the Pre-filter rule? This might cause it to not check the ACP at all. Can you share a santized screenshot of what you are seeing?

Re: FMC connection events problem

Franklin2020 — Tue, 05 Mar 2019 16:47:15 GMT

I have the same issue here.. FMC is on version 6.2.3.10, basically event is logged however access control rule is blank?

Re: FMC connection events problem

braydon2k — Tue, 12 Nov 2019 15:32:18 GMT

I know this is an old thread but figured id ask to see if you found a solution. I have the exact same issue.

My FMC version is 6.2.3 (build 83)

Thanks in advance