%FW-6-DROP_PKT: Dropping Unknown-l4 session X.X.X.X:0 X.X.X.X:0 on zone-pair ZONE-PAIR class class-default due to DROP action found in policy-map with ip ident 0

[Ricky Sandhu]

Good day all,

Just thought I post this discussion to help somebody that may run into this issue in future.  This is how I resolved this problem,  may or may not apply to all but worth a shot.  

I have a Cisco 2951 ISR  running Zone Based Firewall.  I kept seeing the unknown Layer 4 error even though the ACL was set to allow all IP traffic (permit IP any any) between the zones and policy-maps were inspecting the resulting packets.  However even simple TCP packets were marked as unknown and were getting dropped.  Spent hours trying to fix it.  At the end it turned out to be a bug in the version of IOS I was running (c2951-universalk9-mz.SPA.152-3.T3.bin).  Upgraded the IOS to latest one from Cisco (c2951-universalk9-mz.SPA.155-3.M7.bin) and immediately the router started to identify packets correctly and issue was resolved.

Cheers!!

[Richard Burts]

Thanks for posting about your experience with this issue. I hope it will be helpful to other readers in the forum. It does remind us that sometimes when we are dealing with a problem and the config seems right that we should consider the possibility of bug in the software. +5 for this.

HTH

Rick

[Andrii Oliinyk]

008825: *May 1 06:46:54.279 utc: %FW-6-PASS_PKT: (target:class)-(self2internet:self-out-pass) Passing Unknown-l4 pkt XXX.XXX.XXX.XXX:0 => YYY.YYY.YYY.YYY:0 with ip ident 58035
rtr-ca-v-cayug-01#sho ver | i 15\.
Cisco IOS Software, C2951 Software (C2951-UNIVERSALK9-M), Version 15.7(3)M4a, RELEASE SOFTWARE (fc1)
ROM: System Bootstrap, Version 15.0(1r)M16, RELEASE SOFTWARE (fc1)

[Georg Pauwen]

Hello,

interesting. It is not listed as a bug. 

Recommended release is 15.7.3M6 MD...curious to know if the dropped packets occur in that release as well...could you try and upgrade and report the results ?

[Andrii Oliinyk]

this box is in annual patch list with its colleagues :0)
This Unknown-l4 is ESP between 2 IPSec peers (this rtr & remote another). as u may expect ESP obviously is passed under its class but platform doesnt recognize it in the logs :0)