Syslog Messages - Blocked or not?
I am sending logs from Sonicwall TZ470 (SonicOS 7.0.1) to a 3rd party log management system (Graylog) and it generally works very well.
One issue I am seeing is related to Geo-blocking.
I see connections that are successfully Geo-blocked in Sonicwall, and I can see that they do not get passed along to my application. This is great.
The Syslog messages for these connections, though, list the firewall action as "NA" (allowed) rather than "DROP." This is a problem because it looks like these connections are allowed in my log management reports, when they are actually blocked.
My theory is that these connections match a rule allowed traffic, so they are marked as firewall action "NA" with a syslog message, then further processing blocks them because they match the GeoIP rule. I do see a further log message that the connection is dropped, but it seems to me like there should never be an "NA" message because the connection isn't passed on.
Here's an example of two messages:
<109> id=firewall sn=123456789ABC time="2023-02-14 11:34:37" fw=X.X.X.X pri=5 c=0 gcat=6 m=1197 msg="NAT Mapping" src=XXX.YYY.ZZZ.4:35071:X1 srcZone=WAN natSrc=XXX.YYY.ZZZ.4:35071 dst=AAA.BBB.200.18:53:X0 dstZone=LAN natDst=X.X.X.X:53 proto=udp/dns sent=72 rule="25 (WAN->LAN)" app=2 note="Source: XXX.YYY.ZZZ.4, 35071, Destination: X.X.X.X, 53, Protocol: 17" n=4834210 fw_action="NA" dpi=0
<105> id=firewall sn=123456789ABC time="2023-02-14 11:34:37" fw=X.X.X.X pri=1 c=0 gcat=3 m=1198 srcMac=aa:bb:cc:11:22:33 src=XXX.YYY.ZZZ.4:35071:X1 srcZone=WAN natSrc=XXX.YYY.ZZZ.4:35071 dstMac=dd:ee:ff:44:55:66 dst=AAA.BBB.200.18:53:X0 dstZone=LAN natDst=X.X.X.X:53 proto=udp/dns rcvd=72 rule="25 (WAN->LAN)" app=2 msg="Initiator from country blocked: Initiator IP:XXX.YYY.ZZZ.4 Country Name:Republic of Internet Attacks" n=170982 fw_action="drop"
I'm interpreting the first rule as the connection is allowed, and the second is the connection is blocked.
Is that a correct interpretation? Any ideas on how to avoid the false reporting that a connection is allowed?