02-25-2019 05:57 AM - edited 02-21-2020 08:51 AM
Hello all,
I am having a strange issue with virtual FMC which is managing ~10 FTD firewalls (some of them being offline at the moment) - if I display connection events I see all of them as expected....however if I search for events matching specific access control rule the result shows no events...so I went to see the table view of connection events and for every single connection event the column "access control rule" is simply empty which is strange itself but funny enough the traffic is allowed/blocked exactly by means of the configured rules in every policy
this was definitely working few weeks back so I am wondering if there is a bug in 6.2.3.9 or if possible that som of my colleagues changed some logging settings somewhere that would cause this?
02-26-2019 05:34 AM
Any chance you have this trusted/blocked under the Pre-filter rule? This might cause it to not check the ACP at all. Can you share a santized screenshot of what you are seeing?
03-05-2019 08:47 AM
I have the same issue here.. FMC is on version 6.2.3.10, basically event is logged however access control rule is blank?
11-12-2019 07:32 AM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide