Cannot access management interface on wan interface

Pischta

Hi,

we have 3 Sonicwall firewalls, 2 TZ670s and one TZ370.

On the TZ370 I enabled the https management on the x1 interface, and checked that I have a policy that enables the connection to the interface, but I cannot connect to it. The used port is not even open. I checked that when I enable ssh on a not common port, the port became accessible, but when I set that port for the https management, the port remains closed.

On a TZ670, we had similar problem, but I solved it: I had to enable the Allow management... option at Network/MAC IP Anti-Spoof, then disable https management on the wan interface (x1), and re-enable it.

But that didn't help on the TZ370.

TonyA

Hi @Pischta ,

Please run a packet capture as that will help give some clues

MarkD

The management access rule (WAN-WAN) All X1 IP management address is enabled by when you enable management under the interface (HTTPS/SSH/Ping) on the Interface. if you have changed the management port from the default 443 under Device/Administration/Management specify the port when accessing the appliance https://xx.xx.xx.xx:mgmtport

Pischta

https://community.sonicwall.com/technology-and-support/discussion/comment/20764#Comment_20764

Thanks. I found a drop:

DROPPED, Drop Code: 742(Packet dropped - Policy drop), Module Id: 27(policy), (Ref.Id: _2776_qpmjdzDifdl) 3:3)

How can I find, which exact rule dropped the packet?

MarkD

Look at the Logs - set the log settings to Firewall action - import the template and then you can filter on the source.

Are you trying to access the WAN management from internally by chance?

Pischta

Thanks Markd. Which template should I import?

Are you trying to access the WAN management from internally by chance?

No. When I check the management interface port from outside, it is closed.

MarkD

log settings to Firewall action

Pischta

Thanks. I tried it out. When I try to connect to the firewall from outside, nothing appears about it in the log. If I ping it, I see log entries about it (but why it thinks it is a 'land attack'?). I see log entries about my traceroute. But nothing about my try to connect to its management interface.