Hello, we recently installed NSX to use for firewall and segmentation.
I have two rules setup for a File Share Servers and it seems to be working no problem except i see the logs showing some traffic as being blocked even though the rule above says it should be allowed.
The two rules are setup as follows
Source = Any - Destination (My File Server) - Service = MS-DS, MS-DS-UDP, NBSS, NetBios Session Service UDP - Action = Allow
Source = Any - Destination (My File Server) - Service = Any - Action = Block
The 4 services listed are port 445 and 139 TCP and UDP. I dont thnk UDP is needed and actually 139 does not seem to be needed either but i was being careful for now and added them in there.
I have gotten no complaints, I can access the file share and so can the users. However when i go into Log Insight to see if its blocking anything, i get some traffic being dropped like so
2016-11-10T18:50:48.274Z -( our host) dfwpktlogs: 28772 INET match DROP domain-c177/1068IN 40 TCP (Source IP)/64701->(DestinationIP)/445 RA FileShareBlockIn
The Rule ID shows that its the second rule i have thats blocking the traffic. However the Destination IP is correct and the destination Port is 445 which should be allowed.
I thought maybe it was a different protocol but in front of the the Source it says TCP so im assuming its TCP traffic so that should be covered under the MS-DS service which is port 445 TCP.
Im just a little worried legitimate traffic is being blocked and no one has complained yet
Is it possible the Log is just wrong and maybe its not TCP traffic and its another protocol? In which case it should be blocked
Just FYI, there are more in the logs where the source IP is different and the Source port is different. So its not always the same source that its blocking.
Hopefully this all made sense
Thanks
Mike
