Firewall troubleshooting

Each entry names a symptom, its cause and what to do, with the console first. Message ids link to the entry in the error codes.

Port closed after the mode enforce

Cause. The adapter now enforces its rules, and no rule allows the port. A public adapter keeps only what its profile and its own rules allow, which for the profile public-default is SSH and ping. A service that worked in the mode Off or Monitor is blocked when it was not in the proposal of the monitor report, or when the monitor period did not include its traffic. Replies to connections that the virtual machine opened before a switch straight from Off are also dropped until it sends again.

Remedy.

1. Open the virtual machine, select the tab Firewall and read the table Effective rules. Select Simulate, describe a packet to the port and select Simulate; the result names the rule or the default action that drops it. See Effective rules.
2. Select Open port for the port, or Apply template for a kind of server. See Open a port.
3. When you cannot reach the virtual machine and a confirmation timer runs, wait: the previous mode comes back at the end of the time. Otherwise a provider administrator selects Change mode and sets the mode Monitor.
4. As a last resort, a provider administrator with the bypass privilege opens the host for a short time; see Emergency bypass.

Adapter shown as unprotected

Cause. The network adapter cannot be firewalled, so its mode stays Off and the button Change mode is not available for it. The adapter is on a Linux bridge or a quarantine bridge, or port security is off on its network (error.firewall.unprotected). When the adapter has a public address, the tab Firewall warns that every port is reachable.

Remedy.

1. Read the reason in brackets next to Protection on the card of the adapter.
2. Connect the adapter to a host-bridge network that is an Open vSwitch bridge, as described in Host-bridge networks, or ask an administrator to turn port security on for its network.
3. Select Change mode and set the mode again.

Virtual machine without a firewall

Cause. The tab Firewall shows No firewall on this VM, and a request for a template or a mode fails with error.firewall.no_vnic. The virtual machine has no network adapter on a host-bridge network.

Remedy. Connect an adapter of the virtual machine to a host-bridge network in its hardware settings, then repeat the action.

Mode switch that went back by itself

Cause. A switch with a confirmation timer was not confirmed in time, so the adapter returned to its previous mode. The event list (Events) has an event with the severity warning. A confirmation after that moment fails with error.firewall.not_pending.

Remedy.

1. On the tab Firewall, check the Mode of each adapter.
2. Select Change mode, switch again and choose a longer time under Confirm within when the check needs it.
3. Confirm with Confirm the new mode before the countdown ends. Confirming needs the provider privilege to manage the firewall.

Realization that stays waiting

Cause. A host runs an older version of its firewall plan than the control plane wants. The host can be busy, disconnected, or running an old host agent. After a publish, the console lists the hosts that did not apply the change in time.

Remedy.

1. Open the home page, select Firewall and the tab Realization. Select Reload and compare the Wanted version and Applied version version of the host.
2. When the difference stays, check that the host is connected and that its host agent runs a current version, in the inventory of the host.
3. Wait for the Last report time to move: the host reports regularly.

See Realization.

Realization with an error or a precondition

Cause. The state is Error or Precondition not met. A plan can compile to more firewall flows than a bridge may hold; the host then keeps the previous version in force. The precondition ct-zone-range is not met on a host: the connection-tracking zone range of Open vSwitch does not end below the firewall zones, so the host firewalls no adapter.

Remedy.

1. Read the text in the columns Error and Preconditions not met.
2. For the flow limit, reduce the groups and rules that grew, or raise Flow limit per bridge on the tab Settings.
3. For ct-zone-range, the owner of the host sets the zone range and restarts the host agent. The console does not change it.

Policy that is refused when you publish

Cause. The change would leave the firewall with one or more validation errors, so nothing is saved (error.firewall.validation). Frequent reasons:

• The action Pass in a policy of the category Application, or a tenant policy in Emergency or Infrastructure (error.firewall.category_scope).
• A port or range outside 1 to 65535, or an ICMP code without a type.
• A group or service that does not exist, or groups that contain each other or are nested more than 5 levels deep.
• A policy with more than 1,000 rules.

Remedy.

1. In the review of the pending changes, read the list Validation issues. An error blocks publishing; a note does not. Select Back to editing and correct what it names.
2. When the console says that someone else changed the object, select Reload and keep my edits and apply your change again.
3. Check what a rule matches with the preview What does this match in the rule editor, and test the published rules with Simulate.

Quota reached

Cause. The change would take the tenant over a firewall quota: groups, policies, rules or group members (error.firewall.quota).

Remedy. Delete groups, policies, rules or members that nobody uses, or ask a provider administrator to raise the quota. The quotas and their defaults are in the firewall reference.

Built-in object or reserved name

Cause. A name that starts with sys: is reserved (error.firewall.reserved_name), and built-in groups, services, policies and profiles cannot be changed or deleted (error.firewall.builtin).

Remedy. Choose another name. To get other behaviour, create an object of your own and use it next to the built-in one; a built-in profile is replaced from the tab Settings and comes back with Restore.

Profile that cannot be chosen or deleted

Cause. A tenant chose a profile that the provider did not mark as selectable (error.firewall.profile_not_selectable), or a profile that network adapters still use is deleted (error.firewall.in_use).

Remedy. Open the ports you need with Open port instead of changing the profile. A provider administrator can switch Tenants may choose it on for the profile on the tab Settings. To delete a profile, first give each adapter that uses it another profile on the tab Firewall of its virtual machine: choose the profile under the adapter and select Set profile.

No log records or counters at zero

Cause. The tab Log records is not shown without the privilege to read logs. A rule writes records only when Log matches is on, and the log rate of the host limits how many it writes. Records older than 30 days are gone. A counter stays at zero when no packet reached the rule, when the adapter is in the mode Off, or when the rule applies only to ports of overlay segments (Not counted).

Remedy.

1. Switch Log matches on for the rule and publish, as in Statistics and logs.
2. Check the Mode of the adapter and the filters Host and Rule number of the list.
3. Ask an administrator for the privilege to read logs when the tab is missing.

No access to the firewall

Cause. The page shows No access to the firewall: the role of the account has no firewall privilege at that place. Tabs appear according to the privileges: without the provider privilege there are no tabs Rollout and Settings, and without the bypass privilege there is no tab Bypass.

Remedy. Ask an administrator for a role with the privileges that you need. See Firewall reference.

Outgoing mail still blocked

Cause. Outbound TCP port 25 has its own switch and a provider rule that no tenant rule can override. The template mail-server opens inbound mail ports only.

Remedy. Follow Outbound mail.

Related

• Firewall concepts
• Effective rules
• Realization
• Networking troubleshooting