Hi
After we updated to 26.7 we struggling with floating rules.
So for example, we have a rule where allowing remote networks via IPSec to internal networks as interface rule and another role where deny all traffic to other subnets as floating:
Floating rule:
Interface: nothing selected
Quick: false
Action: Block
Protocol: *
Source: *
Port: *
Destination: alias_all_int (as subnet alias 10.16.0.0/20)
Port: *
Interface rule:
Interface: IPsec encapsulation
Quick: true
Action: Pass
Protocol: *
Source: alias_net_ipsec_dest3 (as subnet alias 172.27.9.0/24 192.168.2.0/24 192.168.42.0/24)
Port: *
Destination: *
Port: *
- Before upgrade it went fine
- After upgrade, the first rule (floating) matches and blocks all traffic
- After disabling, an automatic generated (default blocking) rule blocks the traffic, so enabling again...
- I removed the "IPsec encapsulation" from the interface list, so it moves up to the floating rules, i moved it before the blocking rule -> still blocking the IPsec traffic
- Rebooting the FW -> now, the right rule is taken and the traffic is accepted
- Moving rule back as interface rule ("IPsec encapsulation"), still running fine
- FW reboot -> The blocking rule wins and the traffic is blocked again
- Snapshot restore to 26.1.11 -> Everything is working again
So I think, there is something where goes wrong in 26.7. Maybe interesting: We started with this FW with 26.1 and worked from beginning on with "Firewall > Rules [new]", nothing was edited or added in "Firewall > Rules"...
Ivo