topic Re: Rejects with Drop rules in Firewall and Security Management

Rejects with Drop rules

kitetsu89 — Mon, 15 Mar 2021 10:33:29 GMT

Hi there,

I have a question about the following (R80.20)

I see in the logs that some traffic is "action: Reject", but if I look in the Access Policy I see that the action is "action: Drop".

I noticed this with certain inspections settings as well, for instance: HTTP incompliant packets states action: Drop, but in the logs I see "Reject".

Help is much appreciated! Thanks

Re: Rejects with Drop rules

PhoneBoy — Tue, 16 Mar 2021 21:07:52 GMT

The functional difference between a drop and a reject is that the gateway sends a RST or ICMP Unreachable message in response.
Which, for inspection settings, or anything IPS, makes sense, since you’re interrupting an in-progress connection.

Re: Rejects with Drop rules

the_rock — Wed, 17 Mar 2021 00:26:12 GMT

I agree 100% with answer phone boy gave. It makes total sense that anything ips related or to do with inspection would show reject, as you would get some sort of unreachable message.