I am testing a simple dynamic address group (DAG) based on policy tag matching...but the when I add the DAG to the policy all traffic stops and no IPs ever populate the DAG. I verified the LFP matches the desired IPs in the traffic logs so its not a matter of the IPs not existing in the logs.

Tag: "Static Addresses"
DAG: Name: Internal Static Addr
     Match: "Static Addresses"
LFP: Name Internal Address Detection
        Rule1: Name: Static
               Type: traffic
               Filter: (addr.src in
               Action: "static", target: 'source address', timeout: 0, Tags: 'Static Addresses'
Security Rule:
     SZone: Trust
     Source: "Internal Static Addr"
     DZone: Untrust
     Destination: Any
     Application: Any
     Service: application-default
     Actions: LFP: "Internal Address Detection"

While enabled, all traffic stops for the internal IPs and the DAG never populates with any of my internal IPs. When I remove the DAG from the Rule and set source back to "any" my traffic works again.

What am I doing wrong?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.