Geo Updatable Objects are referenced after the first implied rules, so you'll need to use Geo Policy instead of Geo Updatable Objects for blocking the attacker in this specific case. Or you could simply block that entire country with Geo Policy since it is applied prior to the first implied rules. I would suggest putting this attacking IP address in the SecureXL blacklist or in a SAM rule ( sk112454: How to configure Rate Limiting rules for DoS Mitigation (R80.20 and newer)), which would kill the traffic before it is even able to reach the first implied rules. The only way to change this is to modify the implied rules settings in the Global Properties, but this is a great way to cause all kinds of nasty problems with basic firewall functionality and is NOT recommended. You can't directly block UDP/TCP port 500 in the main Network/Firewall policy because it is allowed in the implied rules which are always "first" it has to be initially allowed then later denied by vpnd as an invalid peer. Run the display firewall session table verbose command to check whether IKE sessions exist (the default UDP port number is 500 or 4500).
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |