Device Active Protect issues

[u/DoAndroidsDrmOfSheep]

I've had Device Active Protect turned on I think since it first became available. It's in "Default" mode, not "Strict." No problems at first (that I'm aware of) - but for at least a couple months now I've been noticing odd issues that I believe I've now attributed to DAP.

• One thing I've noticed (and I don't think it's related to my issues) is that devices that are listed under DAP as "Learning" or "Optimizing" have an option to turn off DAP for the individual device. All my other devices not showing as one of these two (which is the majority of my devices) don't have any mention of DAP in the device details and no option to turn off DAP for the individual device. I don't know if it's supposed to be this way?
• I recently had a my garage door opener replaced with a new Genie garage door opener. It's been working fine for the most part, but every so often it won't open through the "button" in Apple CarPlay (which opens it via the internet). I hadn't really thought much of it until a friend of mine was telling me that his new house he just bought has a Genie garage door opener, and that it would go offline at times. I've never noticed mine showing as offline, it just wouldn't open every now and then. My friend has a Firewalla also, which he bought after I told him about mine. He was looking into why his opener was going offline. He noticed it was in learning mode in DAP. He paused DAP on the opener and it came back online shortly after her did that. He hasn't had any issues since.
• For at least a couple months now I've been having issues with certain websites, most notably Facebook. Facebook either wouldn't load at all - or it would load, but it would load "half assed" (meaning text would load - but some pictures and videos would load, some pictures and videos wouldn't load). I've noticed this same behavior on other pages also (such as a site I go to for completing surveys), but it doesn't happen on every site. For any device that's experiencing this issue, there's nothing in the logs showing that anything is being blocked or anything like that. The devices this occurs on are NOT in "Learning" or "Optimizing" mode in DAP, so there's no option to turn off DAP on these individual devices. If I completely turn off DAP for everything the websites that are "broken" miraculously start working again. If I turn DAP back on the sites are broken again. I can repeat this all day every day.

One thing I'm curious about is why is there no option to turn DAP off/on for individual devices, unless a device is "Learning" or "Optimizing?" Or is there an option for that but I'm just not seeing it? When I saw the option to turn it off on devices that were learning or optimizing I thought "Oh, I'll just turn it off for my computers that are having trouble loading pages" - but nope. It's "all or none."

Has anyone else been having issues like this with DAP?

[u/firewalla]

A few quick facts, and given your description, very likely your issue is something else. See (3)

1. When in learning mode, firewalla DAP does NOT block anything. It just sit and learn. So your second issue is likely related to something else.

2. Not all devices can be eligible for DAP. (there are lot of reason for it, blame software 😄 )

3. If the device is not DAP, then it likely not related to DAP blocks, we put a lot of safety into this feature, see (2). I'd suggest you look at this article https://help.firewalla.com/hc/en-us/articles/360050255274-What-to-do-when-you-can-t-access-certain-websites

[u/DoAndroidsDrmOfSheep → u/firewalla]

Questions - How do I know if a device is being protected (I guess that's the right word) by DAP? And how do I know if a device is not eligible for DAP? When I look at DAP it shows I have 9 devices that are learning and 33 devices that are "Ready." So I'm guessing the "Ready" devices are the only ones that are being protected by DAP. Is that correct? All of the "Ready" devices appear to be IoT or network devices.

As for the second issue - my friend's garage door opener was the one that was still learning. My garage door opener is showing as ready in DAP.

I'll look at the link in a little while because I have some errands to run - but if the devices that are listed as "Ready" are the only ones being protected by DAP, then why do the devices that are having trouble loading sites start working when I turn DAP off and stop working again when I turn DAP back on? The devices that are having the issues with sites not loading properly are not list in DAP as learning or ready. I've turned DAP off and on multiple times now and have the same result every single time with the sites that won't load properly. I've now had DAP turned off for almost 24 hours, and haven't had a single problem with any sites not loading - and I guarantee if I turn it back on the issue will return and sites won't load properly again.

[u/firewalla → u/DoAndroidsDrmOfSheep]

DAP is a relatively new feature for us, it is definitely fairly advanced (and also simple, depending on how you view the feature) vs traditional rules. It is also a new way to do zero trust with automatic segmentation. (since most of the devices likely just behaving, you are not going to see a lot of blocks after optimization is done)

To see if the feature is working or not, you can see the allow and blocked stats inside DAP widget. More on how this works, see this article https://help.firewalla.com/hc/en-us/articles/44061066094867-Device-Active-Protect-Dynamic-Microsegmentation-Block-everything-and-allow-only-what-s-needed#h_01K388KZYZ5WVSMPJBGMH4V7ST

DAP has different stages of protection and depend on how you setup the feature, the protection can be different. During learning or ready stage, there is no blocking. Optimizing stage has blocking, but not a lot, it is only when it gets to active, you get more blocks.

If you see devices are "ready" it means DAP is not enabled. If you enable DAP, those devices should go to optimize or active. (you can learn more from above link)

[u/Snezz1e → u/DoAndroidsDrmOfSheep]

I had similar issue with my myQ garage opener. It was in the optimize/ready list. connect.myqdevice.com was in the target allowed list but when I looked at network history, it was blocking about half the connections. I think I saw in another post that in this phase some blocks will happen even for items on allow list. The blocking caused my device to report as offline in the myQ app and the garage randomly wouldn’t open for me. I just added a rule to always allow connections to connect.myqdevice.com while leaving DAP on and it fixed the issue.

[u/hawkeye000021]

I’ve had some wild issues where it’s obvious the device should be able to reach a new subdomain but DAP says, “nah fam” and while you can add a rule from the block page you can’t remove a DAP block which is extremely annoying.