Real-Time Firewall Troubleshooting

1. Internet not working behind firewall - What to check?

Start with interface status → verify IP & gateway → check DNS → confirm LAN WAN policy → validate NAT rule test with ping/tracereroute

2. How to identify NAT, Policy, or Routing issue?

Check logs first. If traffic hits policy but hits NAT issue → if no policy match → rule issue→ if no route → routing table problem

3. Policy configured but traffic blocked- Why?

Check policy order, source/destination objects, service ports, security profiles, and whether logging shows implicit deny

4. How to use logs for troubleshooting? - How to verify?

Go to traffic logs → filter by source IP → check action (allow/deny)→ identify blocked service or rule mismatch

5. Interface issue vs Policy issue How to verify?

interface OK → check policies. Ping firewall interface from client. if reachable

If not interface/VLAN/DHCP issue

6. Real-time troubleshooting tools?

Ping, traceroute, packet capture, flow debug, CLI diagnose commands, and session monitor

7. VPN not connecting - Steps?

Verify phase1/phase2 settings, user authentication, firewall rules, NAT traversal, and check VPN event logs

8. Why policy order matters?

Firewalls process rules top-down. First matching rule applies → wrong order
can block valid traffic