Your zone firewall exports no flow for a busy subnet pair - how do you tell a bypass an intruder can use from missing collection before booking a window?

## Why this is the tree's signature reconciliation problem The documented zone boundary is a claim. The cheapest evidence that the claim has quietly stopped being true is negative evidence: the device that is supposed to be between two zones reports no traffic between them, while the traffic obviously exists. Negative evidence is also the easiest evidence to misread, and misreading it here is expensive, because the conclusion buys a maintenance window and a change owner's night. ## What a flow record does and does not prove A NetFlow or IPFIX record carries the five-tuple (source and destination address, source and destination port, protocol), packet and byte counters, timestamps, and usually ingress and egress interface. It carries **no payload**. So: - A record at an exporter proves bytes moved past that exporter, at that time, between those endpoints. It does not tell you what they were. - The absence of a record proves the exporter did not report it. That is a statement about the exporter, not about the network. That asymmetry is the whole question. Three different worlds produce the same empty query result. ## The three worlds, and how to separate them **1. Collection is incomplete.** Export was configured on the interfaces that existed when the device was built, and the uplink added two years ago was never added. Or export is sampled - one in a few hundred packets - and a low-rate pair falls below the sampling floor for the interval you queried. Or the collector dropped records under load, or the device's export destination changed. Test it: are records from that same exporter arriving in the same window for other pairs? Are all its forwarding interfaces represented? Is sampling configured, and at what rate? Does the device's own interface and policy counters move for that pair? **2. The traffic genuinely does not transit the device.** The path resolves somewhere else - a newer fabric path, a stretched overlay segment reaching the same destination without crossing the routed aggregation boundary the diagram names, or an interconnect built to make two merged estates talk. Test it from forwarding state on both sides: what next hop is chosen for the other zone's prefix, and does the chain of hops include the enforcement device at all? Corroborate with a *positive* observation elsewhere - another exporter that does show the pair, with interface fields that name a link the diagram never had. **3. The traffic genuinely does not exist.** Rare, but check it before the other two: the pair may have moved, been decommissioned, or been re-addressed. ## Reading the two exporters The strongest artefact is a pair of observations rather than one absence: a healthy exporter that *does* see the pair, and the boundary device that does not, over the same interval. That is a positive statement about where the traffic goes, and it survives the obvious rebuttal ("your collection is broken"). Be careful about one adjacent claim you have not made. Showing that the device is not on the path is a different question from showing that the device, when it *is* on the path, actually denies what it says it denies. Do not let the two be conflated in an interview - a bypass finding says the policy is not consulted, not that the policy is wrong. ## The price, and why it is part of the answer Evidence here is not free and neither is the conclusion: - Closing the collection gap means enabling export on every path device and accepting the collector volume, or paying for sampling and accepting what sampling hides. - The conclusion cashes out as a change request. Moving enforcement onto the real path means a routing change or a policy relocation, and every one of those is a maintenance night with a named owner, an application owner who has to agree to the risk, and a rollback. An engineer who brings "the firewall shows nothing" to a change board will be sent away. An engineer who brings "here is the pair observed on the interconnect, here is the boundary device with export verified healthy and no records for thirty days, here is the next hop each side chooses" gets the window. ## The interview trap The weak answer is to read empty as proof of a bypass, or - the mirror image and just as common - to shrug and assume telemetry is always broken. Both skip the step that matters: establishing what your instrument can and cannot see before you interpret what it did not show you.